# Investigating Wearable Fitness Applications: Data Privacy and Digital Forensics Analysis on Android
## 1 Introduction  
The Internet of Things (IoT), such as smartphones, is becoming a ubiquitous technology [1]. These IoT devices have made their way into almost every corner of our lives, from transportation to healthcare, and everything in between. These gadgets have even made their way into our lives in the form of wearable devices. Wearable devices are electronic devices that can be worn as accessories, embedded in clothing, implanted in the user's body, or even tattoed on the skin [2]. Two of the most popular types of wearable devices are smartwatches and fitness trackers [3]. Henceforth, _wearables_ will be used to refer to smartwatches and fitness trackers in the rest of this paper, unless stated otherwise.  
In recent years, fitness tracking has become popular with people looking to track their daily statistics or improve their fitness. Smartwatch sales were about 69 million in 2019 and are projected to reach more than 113 million in 2022 [4]. Their associated applications(apps) have access to fine-grain data about persons, which need to be protected and stored securely. However, there have been instances of fitness data from wearables being leaked [5; 6; 7], exposing the user's location, personal information, and even the location of army bases [7]. These wearables have also been used as 'digital witnesses' in multiple forensic investigations [8; 9].  
These wearable devices have been crucial in various court cases in recent years, being used to corroborate or refute witnesses' and suspects' claims about the events surrounding a crime. In 2018, investigators were able to use the victim's Fitbit smartwatch data to determine her time of death, which poked holes in the suspect's alibi [10], resulting in a conviction. Similarly, in 2021, a husband confessed to killing their wife after her smartwatch data was able to disprove their accounts of what happened [11].  
There is a need to keep up with the technical changes that result from the release of these newer wearables, in order to help forensic investigators and consumers. Previous literature has focused on conducting forensic analyses of wearables with older mobile operating systems [12], computer operating systems [13; 14], or the same app (Fitbit) [12; 13; 14; 15; 16]. The main contributions of this paper are as follows.  
* The authors conducted a forensic analysis of three smartwatch/fitness tracker applications on an Android smartphone to identify privacy concerns that arise due to the way these apps store data on the Android device. The apps investigated are Amazon Halo, Garmin Connect, and Mobvoi.
* Provide the first comprehensive forensic analysis of the Amazon Halo app on Android.
* Compare the findings between Magnet AXIOM and Basis Technology's Autopsy, taking note of any differences or advantages of using open-sourced tools over proprietary software.
* Provide a forensic roadmap to investigators tasked with examining these and similar smartwatch/fitness tracker devices.
* Identify security and privacy concerns related to the data stored by these three apps on an Android device.  
The rest of this paper is organized as follows. Section 2 offers some background on previous works that have been done regarding the security and privacy of wearable devices, particularly fitness trackers and smartwatches. Section 3 details the methodology the authors propose to conduct the forensic investigation of our three chosen health apps, while Section 4 highlights our findings. Finally, Section 5 discusses the findings, while Section 6 reiterates our main points and concludes our work.