FORENSICS INVESTIGATION OF SMARTWATCHES: EXTRACTING DATA AND APPLICATION REMNANTS

Abstract

The Internet of Things (IoT) is a network of interconnected smart devices, which gathers the data, transmit the data, and can communicate with other smart devices over the network. A smartwatch is an IoT device that comes under the category of wearable. These smartwatches require smartphones for their functionality and a connection to synchronise the data. They are also called extensions to smartphones. Nowadays, newer versions can also act as standalone devices as they are Bluetooth enabled, have a SIM card, and are Wi-Fi-enabled. Besides providing the timekeeping feature, they can be used to make calls, send and receive SMS, Facebook, and WhatsApp messages, track and record the activities, create notes and reminders, provide GPS functionalities, etc. The latest models of these smartwatches are Wi-Fi-enabled which allows them to install applications, similar to applications installed on smart mobiles. These devices, as explained, may prove to be a great source of obtaining sensitive user data, therefore, they may prove vital for investigative purposes in a case involving these smartwatches. The recovered data from the applications installed on smartwatches and companion smartphones, therefore, would be a great help for investigators for creating a timeline that may give them a clue for someone’s innocence, victims’ death. This research aims to introduce forensics analysts and practitioners with the methodologies involved during the investigation of smartwatches having different manufacturing companies along with the analysis of companion smartphone. The forensics of applications from different categories (like Messages, Calls, Email, Reminders, Note, Fitness Applications) along with the application which assists in the connection of smartwatches with the smartphones have been focused. For this research, two smartwatches have been chosen based on the latest models, existing work, and affordability of the smartwatches. One of the smartwatches is Samsung Galaxy Watch Active having Tizen-based wearable OS 4.0. The second smartwatch used is LG Urbane W150 having Wear OS which is based on Android OS 7.1.1. Samsung Galaxy J4+ was used as a companion smartphone. Applications from different categories were installed from the App Store of the smartwatches which were highly rated by the users and were cost-free. As a result of experimentation, a large number of sensitive and crucial artifacts were recovered from the smartwatches and companion smartphone as a result of their interaction. These artifacts include messages conversation done via SMS, WhatsApp and Facebook, call logs, emails, account information, notes, reminders, user information, and activities performed using fitness applications. All the identified artifacts and the research methodology adopted to obtain user data from both of the devices have been highlighted which may prove valuable to investigators in any criminal case involving these smartwatches. Keywords: Digital Forensics, Mobile Forensics, IoT, IoT Forensics, Smartwatch, LG Urban