# The Digital Footprints on the Run: A Forensic Examination of Android Running Workout Applications
## 8 Conclusions  
In this work, we developed a post mortem forensic analysis of six popular fitness applications for Android focusing on outdoor running: _Adidas Running_, _MapMyWalk_, _Nike Run Club_, _Pumatrac_, _Runkeeper_ and _Strava_. We resorted to a rooted Android smartphone and a Garmin Vivosmart 4 smart band to generate, collect and analyze data in search of meaningful forensic artifacts.  
As all applications were similar in nature and structure, we focused on one application--NikeRunClub--and then used the process and knowledge learned to adapt the analysis methodology to the other applications.  
The NikeRunClub application stores forensically meaningful data--activities, GPS coordinates and account data--in SQLite 3 databases in its private directory, mainly in the databases directory. Related work has already demonstrated the high value of accessing data from applications that track running workouts as they frequently merge locations with date/time. These can yield critical proof for refuting or, on the contrary, confirming someone's alibi.  
We analyzed the remaining applications based on NikeRunClub and, by using the same methods, we acquired similar information in their respective files. The main findings are as follows:  
* The applications do not store data in their public directory. The exception is Strava.
* Workout activities are stored in SQLite 3 databases, with the most significant forensic data being GPS coordinates, timestamps and duration. Strava is again the exception, resorting to the FIT file format to store workouts.
* The format for GPS coordinates depends on the applications, with some encoding geolocation coordinates using the _polyline_ format and others relying on a text-based pair of latitude/longitude values.
* User's account data are often stored in a database, although they can also be in XML format in the shared_prefs folder.  
To decode FIT files, we developed the decode_FIT Python script. It extracts activity data and formats them for rendering on an OpenStreetMap map or generates a KMZ file for visualization in Google Earth. Additionally, we created a set of modules for the ALEAPP framework to parse application data and generate a case report for streamlined data interpretation. We further enhanced the ALEAPP report with a new timeline feature, previously incorporated into the ALEAPP repository. As ALEAPP is integrated with the Windows version of the Autopsy forensic software, our modules will also be seamlessly incorporated into this forensic application.  
As future work, we plan to assess the privacy and security features of the applications, analyzing the data collected and sent to their respective cloud servers. For this purpose, one needs to resort to dynamic analysis techniques of mobile applications, intercepting and analyzing the HTTPS traffic between applications and their cloud servers, to decode and map their APIs [34]. Another task for future work is to assess the performance of our methodologies, looking for possible optimization. Finally, we also plan to analyze the iOS version of the studied applications and see if the same or even more data can be obtained so that we can adapt our ALEAPP modules to the iOS Logs, Events, And Plists Parser (iLEAPP) framework focused on, which is similar to ALEAPP but focused on iOS applications.  
Conceptualization, F.N., P.D. and M.F.; software, F.N.; Validation, P.D. and M.F.; writing: F.N., P.D. and M.F. All authors have read and agreed to the published version of the manuscript.  
This research was funded by Fundacao para a Ciencia e a Tecnologia grant number UIDB 04524/2020 and by European Union grant number UIDB/EEA 50008/2020.  
Data Availability Statement: Data are not available due to privacy concerns.  
The authors declare no conflicts of interest.