Page 1
WEARABLEDEVICEFORENSICS · A GUIDE FOR UK LAWYERS Wearables and Fitness-Tracker Forensics Heart Rate, Steps, Sleep and GPS: The Body's Digital Diary COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CLOUD HEALTH-DATA COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the body keeps a log 03 What wearables record, and where the data lives 04 The watch, the phone and the cloud: the sync chain 05 Preserving and extracting wearable data 06 Accuracy, attribution and honest limits 07 Deployment: timelines, injury, location and health-data sensitivity 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: a wearable records the body's activity, heart rate, steps, sleep and often GPS, but keeps evidence is reached through the account, obtained law full y, corroborated, and bounded by its accuracy and by the fact that it records the device, not certainly the wearer.
§ 02 · FIRST PRINCIPLES The problem in plain English: the body keeps a log
§ 03 · WHATWEARABLESRECORD What wearables record, and where the data lives SENSORS WATCH BUFFER PHONE APP CLOUD HISTORY REACHED VIA ACCOUNT
Page 2
§ 04 · THESYNCCHAIN The watch, the phone and the cloud: the sync chain
§ 05 · PRESERVINGANDEXTRACTING Preserving and extracting wearable data
§ 06 · ACCURACYANDHONESTLIMITS Accuracy, attribution and honest limits
§ 07 · DEPLOYMENT Deployment: timelines, injury, location and health-data sensitivity
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE THE PHONE APP MANUFACTURER PHONE'S OTHER DELETED / WATCH CACHE CLOUD OWN DATA PLATFORMS PRUNED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEACTIVITYTHATTESTEDTHEINJURYCLAIM EXAMPLE2 · THERESETWATCHANDTHECLOUDTHATREMEMBERED EXAMPLE3 · THESLEEPRECORDTHATPLACEDAPERSONATREST
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a data holder) Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAWEARABLE - DATA EXAM IN AT I ON
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The wearable-data checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is the data on the watch itself? How accurate is fitness-tracker data? Does the watch prove who was doing the activity? Can we get the other side's wearable data? The device was reset. Is the data gone? Is wearable health data specially protected?
§ 14 · REFERENCE Glossary Sources and authoritative references 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Wearables And Fitness Tracker Forensics, Computer Forensics Lab, https://e-discovery.uk/library/wearables-and-fitness-tracker-forensics/pdf.