# The Digital Footprints on the Run: A Forensic Examination of Android Running Workout Applications
## 4 Post Mortem Analysis
### Nike Run Club  
_Nike Run Club_ has 10M+ downloads in Google Play Store (see Table 3) and focuses on preparing athletes for competitions by mixing virtual personal training with a gamification system and social network. Users can connect with friends through the club feature, which acts as a small community. Within this community, they can engage in challenges, compete with each other and collectively work toward enhancing their overall fitness levels.  
Nike Run Club lacks a built-in authentication method. During login request or account creation, the application opens a webview for the URL [[https://accounts.nike.com/](https://accounts.nike.com/)]([https://accounts.nike.com/](https://accounts.nike.com/)) (accessed on 8 August 2024), where the browser will display the authentication form. This fact means that the authentication is performed in the browser and is exposed to possible website vulnerabilities, which is vital for future forensic dynamic analysis. The registration form asks for (_i_) the email (where the verification code is sent); (_ii_) password; (_iii_) name; and (_iv_) birth date. After successfully creating an account, the user returns to the application, where the application asks for (_v_) gender, (_vi_) height and (_vii_) weight.  
Upon login, the authenticated user lands on the main dashboard, featuring a live Google Maps display of their current location, shown in Figure 2(a). Here, users can track their activity, with metrics such as distance, calories burned and duration showcased alongside the activity's route on the map. This run-tracking dashboard is standard, complemented by extras like training plans and audio-guided runs accessed by swiping. The app includes a side menu with options like an activity summary screen detailing stats and a log of past activities. Users can delve into individual activities for detailed statistics like pace, duration, calories burned, heart rate and GPS route, as shown in Figure 2(b). Although all studied running applications are unique, we identified similar points, such as the activity screen and the challenges page. This fact is essential from a forensic standpoint because it helps us to identify the possible data commonly stored in all of them.  
Figure 2: Graphical interface of ADB extractor.  
Data Synchronization  
As standard in modern applications, Nike Run Club can synchronize data between different devices. After analyzing its main database, as will be explained in Section 4.4, we discovered that the application can store, in its local databases, the data from the devices that are synchronizing in the same account.  
In addition, the Nike Run Club application can import activities from the cloud of companion applications. We had previously used the Nike Run application on an iOS device, and all activities from Apple's Healthkit were seemingly imported into the Android database. To test this venue further for collecting data, we installed the application on an Android emulator, resorting to Android Studio. After installing the application and logging into the Nike Run account, we extracted the application's private directory. Again, all previous activities were stored in the databases. This finding is relevant from a forensic standpoint since digital practitioners are not bound to using a rooted device to access data. Indeed, with access to the account credentials, one can install the application on an emulator and collect all data. Moreover, suppose that the Nike Run Club account is connected to a companion application such as Garmin Connect or Fitbit. In that case, one can potentially access activities recorded by devices running under iOS, resorting to Healthkit.