Wearables And Fitness Tracker Forensics

WEARABLEDEVICEFORENSICS · AGUIDEFORUKLAWYERS Wearables and Fitness-Tracker Forensics Heart Rate, Steps, Sleep and GPS: The Body's Digital Diary COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CLOUD HEALTH-DATA COLLECTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the body keeps a log 03 What wearables record, and where the data lives 04 The watch, the phone and the cloud: the sync chain 05 Preserving and extracting wearable data 06 Accuracy, attribution and honest limits 07 Deployment: timelines, injury, location and health-data sensitivity 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: a wearable records the body's activity, heart rate, steps, sleep and often GPS, but keeps evidence is reached through the account, obtained lawfully, corroborated, and bounded by its accuracy and by the fact that it records the device, not certainly the wearer. § 0 2 · FIRSTPRINCIPLES The problem in plain English: the body keeps a log § 0 3 · WHATWEARABLESRECORD What wearables record, and where the data lives SENSORS WATCH BUFFER PHONE APP CLOUD HISTORY REACHED VIA ACCOUNT § 0 4 · THESYNCCHAIN The watch, the phone and the cloud: the sync chain § 0 5 · PRESERVINGANDEXTRACTING Preserving and extracting wearable data § 0 6 · ACCURACYANDHONESTLIMITS Accuracy, attribution and honest limits § 0 7 · DEPLOYMENT Deployment: timelines, injury, location and health-data sensitivity § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE THE PHONE APP MANUFACTURER PHONE'S OTHER DELETED / WATCH CACHE CLOUD OWN DATA PLATFORMS PRUNED § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEACTIVITYTHATTESTEDTHEINJURYCLAIM EXAMPLE2 · THERESETWATCHANDTHECLOUDTHATREMEMBERED EXAMPLE3 · THESLEEPRECORDTHATPLACEDAPERSONATREST § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a data holder) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAWEARABLE - DATA EXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The wearable-data checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is the data on the watch itself? How accurate is fitness-tracker data? Does the watch prove who was doing the activity? Can we get the other side's wearable data? The device was reset. Is the data gone? Is wearable health data specially protected? § 1 4 · REFERENCE Glossary Sources and authoritative references 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY