From the event logs, we show when user activity was synced with the app and uploaded to the device cloud storage.

We recovered data associated with past user activities stored in proprietary activity files and databases maintained by the app on an Android smartphone. We show forensic metadata associated with the device information, past user activities, and audio files from the physical smartwatch. Our forensic methodology and analysis involved the combination and use of a non-forensic tool, a commercial forensic tool, and a non-forensic manufacturer-independent analysis platform tool specifically designed for endurance athletes to identify, extract, analyse, and reconstruct user activity data in an investigative scenario. In this paper, we conduct a comprehensive forensic analysis and show artefacts of forensic value from the physical TomTom Spark 3 GPS fitness smartwatch, its companion app installed on an Android smartphone, and Bluetooth event logs located in the app’s metadata. However, current commercial and traditional forensic tools available to forensic investigators fall short of conducting device extraction and analysis of forensic artefacts from many IoT devices due to their heterogeneous nature. Wearable IoT devices like fitness trackers and smartwatches continue to create opportunities and challenges for forensic investigators in the acquisition and analysis of evidential artefacts in scenarios where such devices are a witness to a crime.

Tomtom clear flash tool mac