Page 1
WEAROS & PAIREDDEVICES · A GUIDE FOR UK LAWYERS Wear OS and Android Paired-Device Forensics Watches, Tablets, Earbuds and Cars: The Wider Android Estate, Its Stronger Attribution and Its Many Makers COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM PAIRED-DEVICE ESTATE ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone rarely lives alone 03 What Android wearables and paired devices record 04 Stronger attribution: the device on the body 05 Many makers: acquiring across the Android estate 06 Interpretation and honest limits 07 Deployment: the wrist, the tablet and the wider estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an Android phone rarely lives alone, and its smartwatch, tablet, earbuds, car and other person more directly than a pocketed phone, and provides redundancy, because the same data is reachable on its own terms.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone rarely lives alone
§ 03 · WHATTHEYRECORD What Android wearables and paired devices record WATCH HEALTH / MIRRORED COMMS TABLET (ACCOUNT) CONNECTION PAIRED ESTATE MOTION RECORDS
Page 2
§ 04 · STRONGERATTRIBUTION Stronger attribution: the device on the body
§ 05 · MANYMAKERS Many makers: acquiring across the Android estate
§ 06 · INTERPRETATIONANDHONESTLIMITS Interpretation and honest limits
§ 07 · DEPLOYMENT Deployment: the wrist, the tablet and the wider estate
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAKER TABLET WATCH COMPANION ACCESS OR Y / IF PHONE (WORN) APP (PHONE) CAR RECORDS GONE GOOGLE / CLOUD
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEWATCHTHATSTRENGTHENEDATTRIBUTION EXAMPLE2 · THECARCONNECTIONTHATPLACEDTHEPHONE EXAMPLE3 · THEWIPEDPHONEANDTHEESTATEAROUNDIT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROID PA IRED - DEVICE ANALYSIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android paired-device checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why examine the watch and paired devices as well as the phone? Are Android watches the same as an Apple Watch forensic all y? Does the watch prove who was doing something? What do connection records show? Can the estate help if the phone is wiped or lost? Is watch health data reliable evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Wear OS And Android Paired Device Forensics, Computer Forensics Lab, https://e-discovery.uk/library/wear-os-and-android-paired-device-forensics/pdf.