Service
Smartwatch forensics
What is examined
- Activity, sensor and location data on the smartwatch
- Notifications, messages and call records
- Pairing history and connected devices
- Data synchronised to the paired phone
How the examination is carried out
- 1.Joint examination of watch and paired device where available
- 2.Extraction appropriate to the platform, with hashes recorded
- 3.Correlation of sensor data with the timeline of the case
- 4.Manual plausibility check of automatically parsed values
Technical limits
These limits are stated before the instruction, not afterwards.
- Many smartwatches offer no direct extraction; the data is then only available through the paired phone.
- Sensor data is subject to measurement error and is not a precise record of movement.
- Cloud-held history is not part of a device examination.
- Deletion on the paired phone frequently removes the watch data as well.
FREQUENTLY ASKED QUESTIONS
Smartwatch forensics: frequently asked questions
It can show recorded activity and, in some cases, coarse location data. Sensor values are indicative, not exact, and are documented as such.
Analysis takes place on the secured working copy in the permanent examination rooms at the registered office in Krefeld, Germany. Devices are handed over in person or sent by insured carrier; by prior arrangement, processing in Munich is also possible. Where the technical conditions allow it, the acquisition itself can also be carried out at the client’s premises or at the location of the item; unavoidable changes to a running system are documented with reasons.
Whether an expert report is used in proceedings, and what evidential value it carries, is decided by the competent court or investigating authority. Our examinations are documented so that third parties can review them: recorded handover, cryptographic hashes, described methods and a clear separation between technical finding and assessment. A binding assurance of later admissibility cannot be given.
Equipment used
Systems used in this examination
- MOBILedit Forensic ULTRA
Analysis of paired mobile devices and manufacturer accounts.
Next step
Discuss your case
Describe the situation briefly. We will say what can realistically be established, and what cannot.