# Investigating Wearable Fitness Applications: Data Privacy and Digital Forensics Analysis on Android
## 2 Review of the Literature
The authors showed that it was possible to recover artifacts related to the user's entered profile information (e.g., birth date, name, weight, and height), the device used (device's MAC address and ID), daily sleep and step records, activity data (step counts and distance timestamps), and activity tracking data (start times and GPS coordinates) from the Mi Fit app. Regarding the Fitbit app, the authors noted that they could recover the device information, step counts, sleep information, activity information, and GPS data associated with a tracked exercise. The authors noted that the sleep and activity data could be modified by the account users for both apps, while the activity data cannot be modified, but only deleted. These two observations have profound implications should these devices/apps appear during a forensic investigation. One limitation of this work was the lack of information on how the fitness trackers were populated as this process was unclear in the paper. [PERSON] et al. [14] conducted a forensic analysis of the Fitbit Windows 10 desktop app after populating the app with data from an Ionic smartwatch and Alta fitness tracker device. The authors focused on guiding forensic investigators with navigating the Fitbit data stored in the desktop app, showing how to distinguish between manually entered data and automatically logged data, and how to handle and conduct a quick but thorough analysis of Fitbit health data using open-source tools. The authors detailed their investigative methodology, which comprised of four phases: (1) Environment Setup, wherein the authors created two Fitbit accounts and signed into each on a separate virtual Windows 10 computer and the Fitbit Web app. Each wearable device was then synced with the Fitbit mobile app on a different mobile phone. (2) Feature Discovery and Data Population, wherein the authors identified all valuable features that may be useful during a forensic investigation. (3) Data Collection, where the authors obtained the Fitbit wearable data from the virtual machine files for examination and analysis. (4) Analysis, where the authors used open-source tools like Autopsy and BulkExtractor to go through the image files to identify any forensically relevant artifacts. One limitation of this work was the limited scope of the forensic investigation, as the authors only investigated the Windows 10 Fitbit desktop app. In addition to health data obtained through a wearable device, there has been research on traditional health apps. [PERSON] et al. (2017) conducted an in-depth forensic analysis of 13 health and fitness apps, including Strava, MapMyFitness, and Nike Training Coach, on an Android device, to identify the forensically relevant artifacts stored by these apps. The authors also discuss any privacy concerns that result from the recovered artifacts. This ethical issue has been thoroughly investigated by researchers such as [PERSON] and [PERSON] (2016), wherein they found that data protection is one of four main issues concerning the ethical problems involved with using smart watches. The authors' methodology involved downloading 13 apps onto an Android device, generating user data by using the apps every day, acquiring the data from the device, and analyzing the acquired data. The authors were able to recover artifacts related to the app user's personal data, including birthdate, gender, height, weight, age, name, email, and location. Artifacts related to plaintext passwords, GPS locations, and user health data were also recovered to varying degrees from the apps the authors investigated. Two limitations or shortcomings of this work are the fact that the analysis was done using Android 6 and Android 7 devices and that the authors did not precisely detail how they populated the apps on the Android devices.