Forensic analysis of Samsung Galaxy Watch Active 2 smartwatch

Abstract

The Internet of Things (IoT) is a well-known paradigm that defines a dynamic and interrelated environment of database devices with different components for seamless connectivity and data transfer. The field of wearable technology is one of the most popular fields today and is expected to continue to grow due to increasing demands. Collecting data for digital forensic analysis in IoT is a challenge, as the devices are not created with this concern, which yields little or no standardization of data and great dispersion of information in the Internet of Things ecosystem. Furthermore, there are few softwares capable of supporting the criminal expert in this type of situation. This work addresses tools and procedures for analyzing forensic evidence in smartwatches, more specifically the Samsung Galaxy Watch Active 2. In the experimental part, data extraction was carried out without superuser access to the system. Device manufacturer tools were used for connecting and extracting files, and open source software for further analysis. Even without superuser access, it was possible to retrieve information relevant to forensic investigations: contact list, and call logs are some of the recovered evidence.