Smartwatch & Apple Watch Forensics


Over the past few years, as the miniaturization of technology marches on, manufacturers have been making enormous strides in wearable computing technology. While your smartphone is now the computer in your pocket, smartwatches are becoming the computer on your wrist. With many smartphone manufacturers branching out into smartwatches, these devices are gradually carving out their own niche of consumers. Like smartphones, smartwatches can contain a treasure trove of meaningful data for forensic investigators, but the data within them can be difficult to acquire. Gillware Digital Forensics offers smartwatch forensics services for law enforcement and legal professionals.


The History of Smartwatches

The digital watch has been around since the 1970s. However, it wouldn’t be until the 1990s that the very first precursor to what we now know as the smartwatch would be invented. The Timex Datalink, produced in 1994, could transfer data wirelessly between itself and a PC and store appointments and contact lists created in Microsoft Schedule+.

Smartwatch Forensics

The first Linux wristwatch by Steve Mann, “father of wearable computing”

1998 saw the invention of the first Linux wristwatch by Steve Mann. Mann’s presentation at IEEE ISSCC2000 two years later granted him the title of “the father of wearable computing”. Also in 1998, Seiko launched its Ruputer in Japan (distributed outside of Japan as the Matsucom onHand PC). Since the onHand PC featured its own graphics display and could run third-party apps, it could be considered the world’s first smartwatch.

In 1999, Samsung announced its SPH-WP10, the world’s first watch phone, with an integrated speaker, microphone, and a protruding antenna. It looks just like what you’d expect a late-90s cell phone with a wrist strap to look like.

Throughout the first decade of the twenty-first century, Microsoft, Samsung, IBM, and other companies pushed wearable computers further. But it wasn’t until 2013 that tech startup Omate used a Kickstarter campaign to fund production of the first smartwatch boasting all of the capabilities of a smartphone.

It was at this point that the technology had been suitably miniaturized such that these types of devices could be inexpensive to make and easy to use. Major computer and smartphone manufacturers jumped into the game, prompting consumer device analyst Avi Greengart to suggest that 2013 was the “year of the smartwatch” (funnily enough, various outlets have continued to pronounce the three subsequent years the “year of the smartwatch” as well, perhaps robbing the term of some of its grandiosity). Over the next few years, more and more manufacturers threw their hats into the ring, with Apple announcing its own Apple Watch in 2014 and releasing it the next year.

Smartwatches have yet to prove as ubiquitous as smartphones, with many still skeptical these devices will ever fully catch on the way smartphones have, but their usage continues to increase.


Why Would You Ever Need Smartwatch Forensics Services?

Apple Watch Forensics

The Apple Watch, released in 2014

It may seem strange to expect a smartwatch forensics investigation to yield anything of value. After all, it’s a wristwatch, and how much can a wristwatch tell you about your case? Well, as it turns out, these smart watches, along with the phones they’re connected to, can reveal a whole lot. Smartwatches are wearable computers, and today even the most basic models are packed with features that can store highly relevant information for your case.

The personal data you can find on a smartwatch and/or the user’s phone associated with it includes:

GPS and activity tracking data: Many of these smartwatches are marketed as sport watches, and can record data on the user’s whereabouts, such as the path they take on their morning jog. Many smartwatches can also include fitness tracker applications that keep track of its owner’s activities, help them manage and record their workouts, and even monitor their heart rate. These highly-personal tidbits of information can be stored within the watch or the phone it’s been set to sync to.

Calendars, schedulers, personal organizers: Smartwatches can carry a wealth of data relating to the user’s daily life. The user’s smartwatch can store calendar events for the user, such as their appointments, reminders, shopping lists, and search history, which is often synced between the watch and their smartphone and/or PC.

Text messages and phone calls: Many smartwatches fall under the category of “watch phones” and feature full mobile phone capabilities. Users can, on their smartwatch, receive and send text messages and phone calls via a Bluetooth or USB headset. Other smartwatches connect wirelessly to the user’s smartphone, allowing the owner to use their phone’s features and capabilities through the watch.

Smartwatches can also tell time.

If a smartwatch turns up during your investigation, there could be a wealth of valuable forensic data living inside it, but you might not have the resources to acquire the data within. Fortunately, Gillware Digital Forensics is here for you.


Smartwatch Forensics Services

As the prefix “smart-” suggests, smartwatches have a lot in common with smartphones. Many of the same manufacturers who produce smartphones also produce smartwatches of their own, such as Motorola, Samsung, LG, Huawei, Alcatel, and Apple. Other smartwatch manufacturers include Pebble, with its popular Pebble Time line, as well as Sony and Asus.

Many models of smartwatch run on Android operating systems. A special smartwatch-optimized version of the Android O/S, dubbed “Android Wear”, runs on some models of smartwatch such as Sony’s SmartWatch 3 and LG’s Watch Urbane. For these devices, forensic analysis bears many similarities to Android forensics.

Apple uses its own proprietary WatchOS on its Apple Watch, while Samsung typically relies on the linux-based Tizen operating system. Pebble smartwatches use their manufacturer’s own proprietary Pebble OS as well. Some smartwatches run on Ubuntu Touch, a touchscreen-optimized O/S for mobile devices based on the popular open-source Linux operating system.

Smartwatches can be quite physically similar to smartphones as well. The core of the smartwatch is an internal flash memory chip. Some smartwatches even have SIM cards of their own, which can hold relevant data to forensic investigators. Many smartwatches also hold slots for microSD cards to expand their data storage capabilities.

Smartwatch forensics shares many aspects with smartphone forensics. Like smartphones, these devices can be password-locked to prevent unwanted intrusions, and one of the great difficulties in forensic investigations can be getting past a password lock to acquire the device’s contents.

Acquiring a smartphone’s contents can require a very large bag of tricks, from software tools like Cellebrite to delicate JTAG operations or invasive chip-off forensics. Each brand and model of smartwatch will require a slightly different approach to navigating its hardware and software terrain. Like smartphone forensics, there is no one-size-fits-all approach to smartwatch forensics, and certain techniques and levels of data acquisition can be more useful than others in some circumstances and less useful in others.


Apple Watch Forensics Services

Apple threw its hat into the rapidly-widening smartwatch ring in 2014 with the announcement of its Apple Watch, which it released in 2015. The Apple Watch runs on the WatchOS, which is based on iOS, the mobile O/S used in Apple’s iPhone line. It does not have full smartphone capabilities on its own, and must be paired with an iPhone 5 or later with the Apple Watch app installed on it. For this reason, it’s important to examine both the watch and the paired iPhone. The Apple Watch can receive notifications, messages, and phone calls from the user’s paired iPhone, and can be used along with Apple Pay to pay for goods and services.

In much the same manner as iOS forensics, Apple Watch forensics can turn up important forensic data regarding the user’s app usage, and may be able to reveal information about the user’s physical activity and whereabouts that cannot be found through forensic examination of their iPhone alone. While much of the data accessed by an Apple Watch user merely passes through the device and actually originates from their iPhone itself, these actions can leave traces on the smartwatch, which Apple Watch forensics analysis can uncover.

Forensic examiners can  acquire an Apple Watch’s contents using many of the same techniques used to acquire the contents of an iOS device. Like iOS devices, Apple Watches have no removable data storage capacity, only an internal flash memory chip, and its internal storage uses the HFS+ filesystem. As a result, Apple Watches have limited space for storing data—around eight gigabytes of storage space. And yet, important forensic artifacts may live even in such a small space. The digital forensics experts at Gillware can assist you with your Apple Watch forensics needs as well as forensic investigation of other smartwatches of various brands and models.


Gillware Digital Forensics’ Smartwatch Forensics Services

Gillware Digital Forensics features skilled digital forensics experts who can help you in every step of the way through your investigation. From the initial forensic assessment of the smartwatch you need analyzed to the final forensic results, to expert testimony in court to make sure our findings are represented clearly and accurately, the experts at Gillware Digital Forensics have your back.

Gillware Digital Forensics’ president is Cindy Murphy, an industry veteran with decades of experience working in law enforcement as a digital forensic expert and several major industry certifications, including recommendation as an expert from Cellebrite.

When the smartwatch you need analyzed is damaged or broken, Gillware Digital Forensics can leverage the expertise of our secure, GSA-contracted data recovery lab. Our data recovery and forensic experts can acquire as much data as possible, sift through it, and report our findings. With the tools and experience borne out of years of data recovery and digital forensics work, the experts at Gillware Digital Forensics can excel at even the most delicate, sensitive, and complex cases.

If you need assistance with smartwatch or Apple Watch forensics, the experts at Gillware Digital Forensics are here to help you.

To get started on a case, follow the link below to request an initial consultation with Gillware Digital Forensics.