The femicide in Glyka Nera, in recent hours, has shocked the entire Greek nation. The heinous crime of the murder of two innocent souls by 32-year-old Babis Anagnostopoulos has angered hundreds of citizens, resulting in Twitter being on fire in the last 24 hours.
However, we will not stop at commenting on the news, nor will we refer to how this murder has affected the psychology of all of us, because that is not our position. We want, through this article, to focus on how technology has once again proven its greatness.
See Also: Windows 11 leak See what the new operating system brings!
While following the developments, we cannot help but dedicate a few lines to the unfortunate Caroline's smartwatch that proved to be the police's best ally. We also cannot help but reflect that if the smartwatch had not existed, we might never have learned the truth, or at least the truth would have taken much longer to be revealed. A more saddening thought in our minds tries to list the millions of other murder cases where there was no smartwatch to point out the murderer.
It doesn't matter if Caroline's smartwatch was expensive or cheap, if it was the latest version or an older one, if it was Apple, Samsung, Xiaomi, etc. What matters is that it was there to "nail" the killer, something that the unfortunate family dog whose pure soul was the cause of his death would have done.
The murderer Babis was probably not a fan of technology, so he didn't think about covering his "electronic traces."
See Also: Researchers analyze the LockBit ransomware "operation"
Ultimately, smartwatches save lives! Whether through health notifications, heart rate measurements, alerts in cases of accidents, or by acting as a key element in forensic investigations, which although in this particular case may not have essentially saved Caroline's life, it did save her soul.
Below we tell you how a Smartwatch Forensics analysis by specialized experts works to identify evidence. An example of the analysis is an Android smartwatch.
The scope of use of Android, the open source mobile operating system, is expanding every year with new innovations. It started with the transformation of mobile phones into Smartphones and today it has reached a point where regular wristwatches are being transformed into Smart Watches.
See Also: Why is it important to enhance diversity in cybersecurity?
Android Wear and its origins – Android Smartwatch Forensics
Established to reduce the constant use of our phones, for the so-called purpose of keeping notifications, Android Wear allows you to check a notification at a glance. All it needs to do is keep the device connected to the smartphone via Bluetooth connection and keep the activities in sync on both ends with the Android Wear app.
Technical specifications
- Most of Android Wear's functionality depends on your smartphone, which it must remain connected to at all times.
- A Bluetooth connection is required at all times to keep devices synchronized.
- Wear uses an internet connection used by the connected smartphone to keep apps up to date and connected.
First Stage: Initialization of the Research
Ultimately, Android Wear OS is just part of the Android OS family, meaning it's still Linux-based. So, accessing system data and running Android Wear smartwatch forensics is pretty much the same as on any Android smartphone/tablet.
See Also: New phishing campaign abuses Google Docs/Drive
Rooting and connecting the device
In practice, logging into the device is only possible if you root the device and grant it access to the computer. This means that both must be able to communicate and access root folders. For this, you must enable the following options and follow the rest of the procedures that follow. In our case, we have used a Sony Smartwatch3 (SWR50):
- Developer options
- ADB Debugging
To enable Developer Options on your watch:
- Tap on the clock to see the list of options
- Scroll down to locate "About"
- Click on this
- Scroll to find the build number and tap it multiple times
Once enabled, swipe back to go to the options list, tap Developer Options where you can enable debugging.
Sony Smartwatch Forensics Analysis Prerequisites
The Wear is ready to communicate with the computer via ADB, (part of the Android SDK). Fulfilling a few more conditional requirements will fully prepare the device for a thorough Android Wear forensics analysis.
Condition 1: If you do not have Android SDK, you must download and install it on the computer to proceed further with the research that requires using ADB Shell.
Condition 2: When you are developing or trying to gain internal access to an Android-based device on a Windows computer, not only do you need ADB, but you also need to install the correct USB driver on the machine.
Different OEMs (Original Equipment Manufacturers) support different drivers. Therefore, it is recommended to install a globally supported ADB driver to avoid conflict. Once installed, the machine must be rebooted.
See Also: Pornhub Sued for Showing Non-Consensual Sex Acts
The device is now ready to connect. Create a connection between your Wear and your computer using a USB cable and do the following:
- Open the command prompt
- Type: adb devices
NOTE: At this point, an error may usually occur if the device has not been factory reset, because otherwise authentication of the RSA key sent to the paired device is required, which, in our case, is not possible.
- Once the device displays a serial number, it means everything is fine.
- Reboot Wear
Check if the bootloader is unlocked or not and if it is locked, unlock it. Just remember that the device will erase the entire user data from the device, just like a phone/tablet. Later, you can flash (upgrade the device’s features beyond its default potential) the device to customize its specifications and capabilities. However, there are chances that the device will go into Brick mode, which is the worst that can happen as the situation cannot be recovered.
See Also: Audi/Volkswagen Customer Data Sold on Hacking Forum
Validation and Imaging
When running the “df” command in ADB Shell, the device directories will be listed as follows:
As part of any research process, the analysis of original/primary data is never carried out. Therefore, a visualization of the recorded lists, i.e. lists that are important from a research point of view, must be done.
To be on the safer side, every time imaging is performed, a hash value of the data before and after the process must be created to validate its authenticity.
See Also: New malware prevents victims from visiting “pirate sites”
NOTE: Keep the device in write-protected mode to avoid writing new data or overwriting existing data on the device, as it will be considered tampering with the data.
Here, we use the Cat command, which is intended for Unix-like operating systems, to display the memory blocks on the system. However, the objects will be displayed in a way that may not be understandable for identification purposes. To change the listing order by name, run the command:
Now, for the first time, the imaging process of the corresponding directories marked earlier as important, run the following “dd” command in ADB Shell (as per the instructions):
Here, the MountingPoint will be the programmer block that needs to be imaged, the destination path will be the location where you want the image to be stored, the partition type is the type of partition you are imaging in the process, and the block size, that is, the size that refers to the corresponding block you are imaging.
Are you ready to track... trace!
Once the forensic images of the desired memory blocks have been created, the analysis process can begin on the corresponding .img files.
Sony Smartwatch Forensics Stage Two: Android Wear Data Analysis
According to the study conducted so far, two of the most important facts that have been gathered are:
Location Access: Accessing Wear's Directory Folders via ADB shell is a possible and conventional method of analyzing device data.
Communication Channels: An individual can easily attack the device by intercepting the communication channels on which it operates, i.e. NFC (Near Field Communication) or Bluetooth. This could provide anyone with unauthorized access to vital and highly private information/data exchanged between the device and the paired smartphone. Many of the popular methods and utilities for carrying out such an attack are usually available for free.
In the next section, we will begin traversing Android Wear System directories through its forensic image as part of continuing the investigation.
See Also: Ransomware Many companies will pay the ransom if they are attacked
Android Wear User Data Forensic Image Examination
The problem with Android Wear is that it can't store any apps separately on its system. The process requires first downloading the app to the paired smartphone, and then syncing it by downloading a copy of the app to the device. Also, there are a limited number of basic health-based apps that can be installed on Wear. Chat messenger, gaming, email, or other important widgets can only be synced to the device and not installed or used on it.
Therefore, a very thin part of the complete data can be obtained from the device, which is actually on the smartphone. This is because the device was synchronized with the phone and received all possible notifications from applications that were compatible with it (WhatsApp, Gmail, Facebook, etc.).
Image analysis applications can be used in the process such as: FTK Imager or Scalpel, to mount and parse the forensic image of the directories. We used the latter to mount the image and extract its SQLite database.
System
This memory block consists of information that is completely related to the device's system. This included: installed applications, fonts set by default, the framework and applications that come from the manufacturer, etc.
The name of the memory block can be used to find out who is storing the system image information and then the command can be run to list all directories. There you can find fine details about the system including the file system, and directories like app, bin, Bluetooth etc.
Data
Although, a smartwatch is not programmed in such a way that it can store a lot of data in it. But, it is still one of the most important folders of Android Wear OS, just like it is in the forensics of Android OS. All the data stored, if stored at all, is in the form of a database. It is a sqlite3 DB file and therefore clearly has a shared preferences folder which also consists of a settings file owned by all the apps which includes the following folders: calendar, gms, contacts, media and settings. Each of these folders consists of corresponding information collected by the same app on the paired device. For example, a calendar folder will store all the events, alarms, important calendar dates, etc., marked in the calendar of the paired device which is synced with Android Wear for the user’s notification.
Cache
Cache, as already known, is the data stored by the system, related to an application, so that future requests can be handled quickly. The data is usually the copy of existing data or the result of a calculation performed in the past. In the case of Android Wear, the data serves the same purpose.
So, in the cache memory block image, we discovered an fstab entry which is used to define partitions and devices or where and how to use partitions on a device along with information about the file system being used. Therefore, it encapsulates a very important information storage file. On further exploration, the findings led to the discovery that recovery information, partition files and recovery information etc. were also stored. Apart from this, the information related to Last_log, Last_install, etc., proved to be quite beneficial for the monitoring purpose.
Apart from that, cache gathered log file gathered log file information that the log file is copied or converted as last_log.
Concluding remark
The steps implemented, if followed carefully along with suggested precautions, mainly facilitate the exploration of the Android Wear smartwatch and the collection of information from the device. Although the information found was scattered in different memory blocks, but collectively it was of great importance in discovering the paired device. Apart from this, the activities of the paired device were also detectable by examining the system directories of the smartwatch although it does not store the complete data as it is, but the partial information related to the connection of things proves useful.
Useful technical information: www.dataforensics.org
