Wearable devices are becoming more and more prevalent in our daily lives as people become more curious about how well they are doing in monitoring, improving, or maintaining their health and fitness. Fitness trackers and smartwatches have become almost ubiquitous, so these devices have begun to play a critical role in forensic investigations. In this paper, the authors conducted a forensic analysis of the controlling applications for three popular fitness bands and smartwatches (i.e., Amazon Halo, Garmin Connect, and Mobvoi) on an Android smartphone device to (1) provide forensic investigators with a road-map of forensically relevant data that are stored within these applications and (2) highlight any privacy concerns that the stored data within these applications may present to the applications’ users. Our findings indicate that the three fitness applications store a wealth of user data. In particular, the Amazon Halo app stores daily, weekly, and monthly activity-related data for at least the last 13 days. The user’s Tone Analysis results were also recovered. The Garmin Connect application also records detailed user activity information, as it was possible to recover the last 15 days worth of user activity data. The Garmin Connect user’s general location was also determined via the application’s weather notification feature. Lastly, the Mobvoi application records all data points from the time the device is first used until the last time the device is used. These data points may include heart rates taken every 5 min and step counts. Our findings highlight the possibility of collecting personally identifiable information about users of these devices and apps, including their profile information, habits, location, and state of mind. These findings would be pertinent to forensic investigators in the event that these or similar applications are part of an investigation.

In the digital forensics discipline, the lack of comprehensive research that addresses investigative challenges and opportunities for newer mobile Operating Systems (OSs) such as Android and iOS keeps continuing. These two OSs are currently widely operated by millions of smartphones and used by millions of users; therefore, forensic investigators need to be prepared to analyze these OSs during an investigation giving consideration to mobile app updates. The current research efforts focus on the forensic analysis of individual applications of certain OSs. In this study, we conducted a detailed forensic investigation of both Android and iOS OSs to (1) elucidate their structures for investigators, (2) identify pertinent forensic artifacts, (3) highlight any privacy and security concerns in popular applications present on both OSs, and (4) validate the forensic investigation on the selected tools for reproducibility and verification purposes. This work aims to analyze 27 Android and 33 iOS mobile applications comprehensively.

TikTok has consistently been one of the most used mobile apps worldwide on any mobile operating system. However, despite people’s enjoyment of using the application, there have been growing concerns about the application’s origins and alleged privacy violations. These allegations have become such a big problem that the former President of the United States, Donald Trump, expressed a desire to ban the TikTok application from being offered on US application stores like Google’s Play Store and Apple’s App Store. This remark sent TikTok users into a frenzy to find alternatives before the ban took effect. To this end, several alternative applications for TikTok have surfaced and are already garnering millions of users. In this paper, we identified three popular alternatives to the TikTok application (Byte, Dubmash, and Triller) and forensically analyzed each on smartphones of Android version 8 and iOS version 13. We focused on identifying forensically relevant artifacts that may be helpful to investigators in the event of a criminal investigation, should these or similar apps fall under scrutiny. We used Magnet AXIOM Process and Cellebrite UFED 4PC for acquisition, and Magnet AXIOM Examine and DB Browser for SQLite for analysis and reading. The investigation resulted in successful extraction of expected yet unique data points, plain text sensitive data, directories and format. These results lead to a discussion about identifying and comparing these app’s privacy concerns to that of TikTok, as formulated from the literature.

The emergence of the Internet of Things technologies and the increase and convenience of smart home devices have contributed to the growth of self-installed home security systems. While home security devices have become more accessible and can help users monitor and secure their homes, they can also become targets of cyberattacks and/or witnesses of criminal activities, hence sources of forensic evidence. To date, there is little existing literature on forensic analysis and the security and privacy of home security systems. In this paper, we seek to better understand and assess the forensic artifacts that can be extracted, the security and privacy concerns around the use of home security devices, and the challenges forensic investigators might encounter, by performing a comprehensive investigation of the SimpliSafe security system. We investigated the interaction of the security system with the SimpliSafe companion app on both Android and iOS devices. We analyzed the network traffic as the user interacts with the system to identify any security or privacy concerns. Our method can help investigators working on other home security systems, and our findings can further help developers to improve the confidentiality and privacy of user data in home security devices and their applications.

Smart Homes are becoming increasingly popular with homeowners investing in new internet-connected technologies, from smart plugs to smart appliances. One particular area where homeowners use smart devices is at the front door, as they install smart doorbells and smart locks. In this paper, we embark on an investigative journey into the August smart device ecosystem, specifically looking at the interaction between the August Smart Doorbell Pro and the August Smart Lock Pro, with their controlling app, August Home. We aim to determine what type of data forensic investigators may be able to recover about these devices and their use. We also explore how these devices interact with each other, noting any privacy issues that may be discovered. We found that a wealth of forensic data could be recovered, particularly from rooted Android devices and jailbroken iPhone devices. Information about the owner of the smart device, guests who were given access to the devices, device interactions, and pictures taken by the doorbell camera, were all recoverable in plaintext. Our results also show that user’s GPS coordinates associated with the lock’s Auto-Unlock feature were recovered only from a rooted Android device.

The COVID19 pandemic has led to the proliferation of the usage of online shopping applications among millions of customers worldwide. The enormous potential in technological advancements, particularly mobile technology, has directly impacted mobile commerce, where the shopping process has become so convenient. While the benefits of mobile commerce are multi-fold, the current privacy practices and the extent of user data residue in shopping apps have been less explored. In this paper, we have conducted an in-depth, systematic analysis of two of the most popular mobile shopping apps - Amazon and Etsy. Our analysis led to the recovery of user data and shopping activity artifacts from Amazon’s and Etsy’s buyer and seller apps on Android/iOS devices. Based on the user data and artifacts found, we have also discussed the implications of default privacy settings, the importance of online safety policies prior to product listings, and implications for research and practice.