Uma proposta de procedimento operacional padrão para smartwatches

Abstract

The internet of things (IoT) defines a dynamic and interrelated environment of everyday and industrial devices connected to the Internet. The growth of IoT devices has significantly increased the dangers of cyber attacks, leading computer forensics to an ongoing effort to overcome challenges to obtain reliable evidence in a complex, heterogeneous and diverse environment such as the IoT ecosystem. Wearable devices are one of the most popular these days. Extracting data for digital forensic analysis on IoT devices is a challenge, because in its conception there is no concern with this type of activity, given the non-existent standardization in writing and collecting data in the IoT ecosystem. With so many devices connected, the volume of data stored and transmitted over the network is enormous, providing opportunities for gathering evidence at various stages of a forensic analysis process. Despite this, the lack of standards in writing and reading data increases the difficulty of obtaining records that can be easily traced and maintaining the integrity of the devices, which could accelerate the process of solving a cybercrime. This work aims to define procedures for analyzing forensic evidence on wearable devices such as smartwatches, maintaining their chain of custody and integrity. In the experimental part, used as proof of concept of the proposed procedures, two smartwatches were used, one from the manufacturer Samsumg and another from apple, as they are the market leaders in this segment, and from these devices, data was extracted without superuser (root) access to the system, using various tools, including proprietary software from specialized companies, as well as software from device manufacturers. For data analysis, open source software was used. Even without superuser access, and Through the use of the proposed operating procedure, the recovery of relevant information from the tested smartwatches was demonstrated, such as: phonebook, call log, reminders, profile photos of telephone contacts, last wireless networks connected, hardware and software data installed, photos and videos saved on the devices, physical activities, information about bank cards, among others.