December 2019

Breaking Health Clouds
Fitbit and other health trackers: obtaining vital
evidence for your investigation
Vladimir Katalov, ElcomSoft© ElcomSoft Ltd. www.elcomsoft.com

1

Fitbitand Other Health Trackers
Obtaining vital evidence
for your investigation
Vladimir Katalov, ElcomSoft

2

Introduction to Mobile Forensics
How to access the evidence?
§ Off the phone extraction▫ Logical acquisition: backups, photos, shared files,
some logs▫ Physical (file system) imaging: everything sansdeleted files, might be complex or unavailable§ Cloud (over-the-air) acquisition▫ No device required▫ Remote access to a lot of data
▫ Sometimes, extracts more data than stored on asingle device
3Wearable Market Share…

4Wearable Market Share5

Health Evidence
Health evidence is stored in the cloud§ Apple and Google cloud platforms§ Single point access to all health data is very
tempting§ Some manufacturers sync Health data, and some
don’t
§ Apple requires sharing data with Apple Health toapprove manufacturer’s HealthKit integration▫ Some manufacturers ignore HealthKit altogether§ Google does not have any requirements

healthsync▫ Most manufacturers ignore Google Fit
6

Health Evidence
Apple Watch, Google WearOS (ex- Android Wear)§ Apple Watch: iCloud only
▫ Exclusively works through Apple HealthKit▫ No integration with Google or Android§ Google WearOS watches (all models)▫ Works on iOS devices, but…
▫ No integration with Apple HealthKit (Google’sdecision)▫ Full integration with Google Fit

healthsync

7Health Evidence
Fitness trackers with proprietary cloud services§ Samsung Health: proprietary Samsung Cloud▫ Ignores Apple HealthKit and Google Fit§ Xiaomi, Amazfit: Mi Cloud, proprietary cloud▫ Integration with Apple HealthKit▫ Google Fit: limited (steps only) integration
healthsync

8Health Evidence
Fitness trackers with proprietary cloud services§ Garmin: Garmin Connect, proprietary cloud▫ One-way sync > to Apple HealthKit▫ Google Fit: no integration§ Fitbit: proprietary cloud only
▫ Ignores Apple HealthKit and Google Fit
healthsync

9Wearables Data Flow
Wearable device > Phone > Cloud§ The wearable device collects information(steps, heart rate, GPS, activity, screen
time etc.)§ The data is synchronized with an app on
the phone via a low-energy connection(e.g. Bluetooth LE, Wi-Fi and LTE sync
available on some models)§ The app (Apple Health, Google Fit,
Samsung Health, Mi Fit etc.) processes
the data and (optionally) syncs with Apple
Health Kit (or Google Fit on Android)

Wearabledevice /tracker

SmartphoneCloud§ And then…
10Wearables Data Flow
Wearable device > Phone > Cloud§ The data ends up in the cloud§ If the data is synced with Apple
HealthKit, the Health app aggregates
the data and syncs with iCloud§ If the data is synced with Google Fit,
then Google takes care of the sync
§ More often than not, manufacturersemploy their very own, proprietary cloudservice

Wearable
device /tracker

Smartphone

Cloud§ Such as Fitbit
11

Data collected by vendors
Mi FitData
User profile
Device list
Running history
Band data
Hearth rate
Event reminders
Manual data
Health settings
ETE and THA events
Weight records

Description
Information provided by the user such as age,height and weight
List of devices registered for Mi Fit
Detailed information about running workouts
Service information from the tracker device
Raw hearth rate data
Events and reminders
Any information the user added manually
Settings of the Health app
ETE and THA rhythm events
Timestamped weighing data

12

Data collected by vendors
Samsung Health§ As one can expect, Samsung collects lots offinely detailed information§ More than 100 distinct data categories§ As an example, ALP, albumin, amylase, bloodpressure, blood glucose, caffeine intake,creatinine, CPK and bilirubin data fields areavailable for the blood§ Unsurprisingly, Samsung does not sync withApple HealthKit or Google Fit, which define amuch smaller (and less detailed) subset of
health data
13

Data collected by vendors
Fitbit§ Fitbit collects, stores and processes data toestimate a variety of metrics§ The data is stored in Fitbit cloud▫ Step count and distance traveled▫ Calories burned▫ Weight▫ Heart rate
▫ Sleep stages and active minutes▫ Location
14

Data collected by vendors
Where Fitbit stores data
§ Fitbit stores data in the proprietary cloud service§ Fitbit offers a Web API to access data:
https://dev.fitbit.com/build/reference/web-api/§ Web API gives access to all of the following:▫ Activity▫ Friends▫ Body & weight▫ Heart rate

▫ Devices and alarms▫ Sleep▫ Food logging▫ User profile

15

Data collected by vendors
Data in Fitbit cloud§ Activity▫

Daily activity summary including:▫

Daily goals for elevation (elevation, floors), steps,calories burned, and distance▫

Activity time series: time series data in the specified
range

▫

Activity logging: the same data in user’s locallanguage▫

Activity types: a tree of all valid Fitbit public activities
as well as private custom activities the user created▫

Activity goals: a user's current daily or weekly activitygoals▫

Lifetime stats: the user's activity statistics
16

Data collected by vendors
Data in Fitbit cloud§ Body & Weight▫ Body fat: the list of all user's body fat log
entries for a given day▫ Body time series: time series data in thespecified range▫ Goals: a user's current body fat percentage
or weight goal
▫ Weight: a list of all user's body weight log
entries for a given day

17Data collected by vendors
Data in Fitbit cloud§ Devices and alarms▫ Data provided through the Fitbit API does notnecessarily represent a single tracker▫ Data can change frequently, as trackers sync
at different intervals and the unified data isrecalculated at each sync
▫ Distance and number of steps are correlated
when GPS data is available

18

Data collected by vendors
Data in Fitbit cloud§ Food logging▫ Public and private food logs
▫ Nutrition information▫ Hydration logs
▫ Including goals and time series

19Data collected by vendors
Data in Fitbit cloud§ Friends▫ List of user's friends▫ Links to friends profiles▫ Friends data (e.g. number of steps)▫ Invitations▫ Invitation responses

20

Data collected by vendors
Data in Fitbit cloud§ Sleep logs
▫ Detailed information on the user’s sleeping
sessions▫ Sleep and awake minutes, time in bed,minutes to fall asleep▫ Summaries: minutes after wakeup, minutes
asleep, minutes awake, minutes to fallasleep, start time, time in bed, sleep phase▫ Sleep phase (“level”): wake, rem, awake,restless, asleep etc.
21Data collected by vendors
Data in Fitbit cloud§ User profile▫ Detailed information on authenticated user
▫ Basic information about user’s friends▫ No access to other users profiles

22Fitbit Acquisition
Will Google acquisition of Fitbit affect the cloud?
§ Most definitely, it will
§ Fitbit acquisition gives Google access to a trove ofdata from sleep tracking to heart rates§ “Fitbit and Google Announce Collaboration toAccelerate Innovation in Digital Health andWearables”§ “Fitbit to leverage Google Cloud to increase
operational efficiency, agility and speed to market”§ “Fitbit intends to use Google’s new Cloud Healthcare
API to help the company integrate further into thehealthcare system”§ Source: Fitbit press release23

Fitbit Acquisition
Does Fitbit acquisition affect users and/or forensics?
§ No, at least not immediately§ The changes, if any, will occur slowly§ Most probably to new products only
§ Most probably not before Q3’ 2020
anyway because of development
pipeline§ Existing products will be likely
grandfathered, keep using existing Fitbit
services24

Apple HealthKit
What is Apple HealthKit?
§ Introduced in Sep 2014 with iOS 8§ Health app pre-installed on all iPhones§ Always active, always collecting information§ Supported by Apple Watch, additional datacollected§ Integrates data supplied by third-party fitnesstrackers§ Fitbit does not support HealthKit

25

Apple HealthKit
Who integrates with Apple HealthKit§ Apple Watch (all models)§ Many third-party fitness trackers§ Xiaomi, Amazfit§ Garmin§ Withings§ Huawei (own OS only)

26

Apple HealthKit
Who integrates with Apple HealthKit§ Dozens of health and tracking apps
▫ Workouts++▫ Strava▫ Endomondo§ They have proprietary cloud services, too§ From time to time,these cloud services leak data27

Apple HealthKit
Who does not integrate with Apple HealthKit§ Samsung§ Google (WearOS watches)§ Dozens of manufacturers§ Fitbit28

What apps contributeApps contribute a lot to Health data
§ Steps, detailed heart rate, calories burned§ GPS track, automatic workout detection§ Cycling, swimming, walking, wheelchair distances§ Weight and body mass index§ Sleep analysis§ Active energy§ And a lot more

29
Page 29

30
Page 30

31
Page 31

Apple HealthApple Health and iCloud§

Apple Health data can be obtained from iCloud§

May contain significantly more information compared to what is availableon device§

Technically, Apple Health belongs to “synced data” as opposed to “cloudbackups”§§

This results in significantly more reliable extraction§Loose expiration rules of iCloud tokens compared to backups

Unlike iCloud Keychain or Messages, iCloud Health data has no additional
protection§No need to enter device passcode, no additional encryption

32

Apple HealthAccessing Health Data in iCloudUse Elcomsoft Phone Breaker to download synced
data, which includes Apple Health
What can go wrong:§ Two-factor authentication may be an issue§ Access to secondary authentication factor isrequired (unless using authentication token)§ Passcode of one of the trusted devices isneeded (iPhone or Mac)33

Apple HealthKit
Extracting Synced Data
§ Start Elcomsoft Phone Breaker§ Select Tools > Apple > SyncedData§ Authenticate with Apple ID andpassword + 2FA, or…
§ Use authentication token§ Select categories to download

34

Apple HealthKit
Viewing Health Data
§ Use Elcomsoft Phone Viewer

35

Google Fit
Data collected by Google Fit§ Activity: active minutes, activity segments, heart points,
sessions (workouts), walking and running, steps, Location§ Body Measurements: height and weight§ Heart: heart rate and blood pressure§ Nutrition: carbohydrates, cholesterol, dietary energy,
dietary fiber, protein, saturated fat, sodium, total fat,caffeine, calcium, monounsaturated fat, polyunsaturatedfat, potassium, sugar, etc.
§ Sleep: sleep data
§ Sensors: raw timestamped sensor data
36
Page 36Google Fit
Where Google Fit data is stored§ Google collects Fit data only if the optional Google Fit
app is installed from Google Play store§ The app collects and syncs Fit data with Google Drive§ Health data is stored in Google Drive with no additional
protection§ Can be exported via Google Takeout, extracted withElcomsoft Cloud Explorer or requested by LE§ Can be downloaded with updated Elcomsoft CloudeXplorer (ETA: Q1’2020)
37
Page 37

Google Fit vs. Apple Health
The two systems compared§ A third-party fitness tracker or smart watch device
supporting both Android and iOS is more likely to sharedata with Apple Health rather than Google Fit§ Apple Health standardizes data. HealthKit compliant
apps cannot supply types of data that are not definedby Apple.
§ Google Fit will accept data of any type including
unknown. Unknown types of data will not be displayed
but will be synced in the cloud.

38Page 38

Google Fit vs. Apple Health
Security of health data in the cloud§ Apple Health▫ iOS 12 and 13 protect Health data with the user’s devicepasscode▫ To extract, need all of the following: Apple ID, password, 2FAcode, device screen lock passcode▫ Cannot be extracted from the cloud via GDPR requests; notprovided to LE§ Google Fit▫ Stored in the cloud with no additional protection▫ Can be easily exported, extracted or requested from Googleby LE39Page 39

December 2019

Breaking Health Clouds
Fitbit and other health trackers: obtaining vital
evidence for your investigation
Vladimir Katalov, ElcomSoft© ElcomSoft Ltd. www.elcomsoft.com

40