Mobile and wearable device examination

With the arrival of 5G technology, the increasing popularity of fitness trackers and smart watches, and growth in other “wearable tech”, the amount of data…

Carl Purser profile picture
Carl Purser

July 9, 20193 minute read

With the arrival of 5G technology, the increasing popularity of fitness trackers and smart watches, and growth in other “wearable tech”, the amount of data being collected is increasing at an unprecedented rate. And whilst many consumers might consider this data to be “private” that is no-longer necessarily true. And for the law enforcement or corporate IT community, access to this information could be vital in the successful capture and prosecution of those with criminal intent, or during misconduct proceedings.

Since May 2017, OpenText™ EnCase™ Forensic and OpenText™ EnCase™ Endpoint Investigator have included the ability to analyse many mobile devices including those running Android and Apple iOS. At the same time, OpenText launched OpenText™ EnCase™ Mobile Investigator, giving users specific functionality which is crucial for examination of mobile devices, including:

  • Mobile-specific reporting features
  • Optical Character Recognition (OCR) to allow textual searches within (for example) images and pictures
  • In built SQLite viewing capabilities

By using both EnCase Mobile Investigator alongside EnCase Forensic and EnCase Endpoint Investigator, investigators have been able to successfully examine and research acquired data on Apple iOS device, highlighting the importance of having access to multiple forensic products.

Mobile Browsing

In a recent example relating to Mobile Safari internet browsing activity, EnCase Mobile Investigator can present the current internet history – and the last state of the browser in terms of tabs open in the web browser – in tabular form.

Using the in-built SQLite viewing capabilities of EnCase Mobile Investigator, examination of the supporting databases was conducted and indicated some of the tabs had been viewed using the Private mode. Subsequently, additional data was identified that could verify website information for those Private tabs.

Using the flexibility and power of EnScript programs within EnCase Forensic, the encoded data was extracted and subsequently parsed (using SQLite BLOB extractor and plist parser EnScript programs).

Hence, the combination of the two EnCase products provided a streamlined examination of automated output relating to internet activity, but also ‘deep-dive’ functionality to expose additional information, including some Private internet activity.

Wearables

Similar research/examinations has been conducted on wearable devices and smart watched using EnCase Forensic and EnCase Endpoint Investigator.

Currently, the forensic examination of data relating to Apple Watch is limited in terms of automation. However, backup data can exist on the paired handset, as well as in Apple Health.

Following an acquisition of an Apple iPhone with encrypted backups, EnCase software can – with the relevant passwords – decrypt the Apple Health data fed by an Apple Watch. Using similar techniques to those as mentioned, the recorded heart rate can be identified, indicating workout information or daily activity records.

Finally, using a direct Apple Health export from the iPhone, detailed location data was identified. Using the single file feature of EnCase Forensic, a custom EnScript program was used to create a KML file that could be opened in Google Earth, showing the route taken during the workout.

Similar information has also been identified for a Fitbit Ionic, with location information recorded in a supporting application and database.

Learn more:

To learn more about EnCase Mobile Investigator and how to use EnCase products to examine the ever-increasing number of mobile devices, check out our Learning Services course DF125-Mobile Device Examinations with EnCase or contact us.

Share this post

Share this post to x. Share to linkedin. Mail to
Carl Purser avatar image

Carl Purser

Carl has been engaged in the field of digital forensics for nearly 17 years, having started his career with the Metropolitan Police London in 2002. Primarily focusing on forensic examination of Windows and Apple computer systems he has forensically examined numerous iPhone and iPad devices. In November 2010 he become an EnCase instructor, providing in-depth instruction in the use of EnCase in the field of digital forensics.

See all posts

More from the author

Apple property list parsing with EnScript

Apple property list parsing with EnScript

The third blog in the series following on from Using the Generic SQLite Database Parser EnScript in forensic examination of a mobile device, will focus…

6 minute read

Using the Generic SQLite Database Parser EnScript in forensic examinations of a mobile device

Using the Generic SQLite Database Parser EnScript in forensic examinations of a mobile device

In my previous blog, the use of EnScript was introduced as a benefit to extend the artifact reach and add custom parsing for the yet…

5 minute read

Mobile device examination with EnCase

Mobile device examination with EnCase

Anyone engaged in DFIR (Digital Forensics & Incident Response) will recognize and understand the field moves and evolves at a rapid rate. There is always…

4 minute read

Stay in the loop!

Get our most popular content delivered monthly to your inbox.

Sign up