Part 3 of 5

Smart Device Analysis

🕑 120-150 minutes 📖 Intermediate Level 📋 Module 6

Introduction

Smart devices have become integral to daily life, constantly listening, watching, and recording data about our activities. Voice assistants, smart TVs, and wearable devices create rich data trails that can be invaluable for forensic investigations. This part focuses on the forensic analysis of specific consumer smart devices.

📚 Learning Objectives

By the end of this part, you will be able to extract and analyze data from Amazon Alexa devices, conduct Google Home forensics, investigate Smart TVs from major manufacturers, and analyze fitness trackers and wearable devices.

Amazon Alexa Forensics

🗣
Amazon Echo & Alexa
Voice assistant ecosystem with extensive cloud integration

Echo Device Types

  • Echo Dot: Compact smart speaker, most common
  • Echo Show: Smart display with screen and camera
  • Echo Studio: High-fidelity speaker
  • Echo Auto: In-vehicle Alexa device
  • Fire TV: Streaming devices with Alexa built-in

Evidence Sources

🎤
Voice Recordings
All voice commands stored in cloud
📋
Activity Logs
Commands, responses, timestamps
🔒
Smart Home Actions
Device controls, routines triggered
🛒
Shopping History
Voice purchases, lists, orders
📞
Communications
Calls, messages, Drop In logs
🎧
Media History
Music, podcasts, audiobooks played

Alexa Data Acquisition Methods

1
Amazon Account Access
With proper legal authority, access the Amazon account associated with the device via alexa.amazon.in or the Alexa app.
2
Request Your Data
Use Amazon's "Request Your Data" feature (Settings > Privacy > Download Your Data) to obtain a comprehensive data export.
3
Review Voice History
Access Settings > Alexa Privacy > Review Voice History to see all voice recordings with timestamps and transcripts.
4
Legal Process to Amazon
For investigations, submit formal legal requests to Amazon Legal (via LEA portal) for preserved data including deleted recordings.

Alexa App Mobile Forensics

Alexa App Data Locations (Android)
# Main database
/data/data/com.amazon.dee.app/databases/

# Cached data
/data/data/com.amazon.dee.app/cache/

# Shared preferences
/data/data/com.amazon.dee.app/shared_prefs/

# Key files:
- DataStore.db (device settings, routines)
- map_data_storage.db (smart home devices)
Wake Word Recordings

Alexa devices begin recording when they detect the wake word ("Alexa", "Echo", "Amazon", or "Computer"). However, false triggers can capture unintended audio. These recordings remain in the cloud until the user manually deletes them or configures auto-deletion. Some recordings may capture conversations that occurred before and after the intended command.

Google Home/Nest Forensics

🗣
Google Home & Nest
Google Assistant-powered smart home ecosystem

Google Home Devices

  • Nest Mini/Home Mini: Compact smart speakers
  • Nest Audio: Full-size smart speaker
  • Nest Hub/Hub Max: Smart displays with screens
  • Nest Cameras: Security cameras with Assistant integration
  • Nest Doorbell: Video doorbell
  • Nest Thermostat: Smart temperature control

Evidence Sources

🎤
Voice & Audio
Commands stored in Google Account
📷
Camera Footage
Nest Aware cloud recordings
🏠
Home/Away Data
Presence detection, routines
🌡
Climate History
Temperature logs, occupancy

Google Data Acquisition

Method Data Available Procedure
Google Takeout Complete account data export takeout.google.com - select specific products
My Activity Voice recordings, commands myactivity.google.com - filter by Assistant
Nest App Camera events, device history In-app history and event timeline
Legal Request Extended data including deleted Google Law Enforcement Request System
Google Home App Data (Android)
# Main application data
/data/data/com.google.android.apps.chromecast.app/

# Nest application data
/data/data/com.nest.android/

# Google Assistant
/data/data/com.google.android.googlequicksearchbox/

# Key artifacts:
- Device configurations
- Home member information
- Automation routines
- Cached activity data
💡 Case Study: Google Home in Murder Investigation

In a notable case, investigators obtained Google Home data showing the timing of voice commands that contradicted a suspect's alibi. The device logs revealed someone was home at a time when the suspect claimed to be elsewhere. The voice activity timeline helped establish the sequence of events during the crime window.

Smart TV Forensics

📺
Smart TV Analysis
Connected televisions from major manufacturers

Major Smart TV Platforms

📺

Samsung Tizen

Samsung Smart TVs use Tizen OS. Data in Samsung Account, SmartThings integration, voice assistant logs.

📺

LG webOS

LG TVs use webOS. ThinQ app integration, voice recognition, viewing history, installed apps.

📺

Android TV / Google TV

Sony, TCL, others. Full Google integration, Play Store apps, Google Account sync.

📺

Roku TV

TCL, Hisense Roku TVs. Channel history, search history, voice commands.

Smart TV Evidence Types

  • Viewing History: Channels watched, streaming content, timestamps
  • Search History: Content searches, voice searches
  • App Usage: Installed applications, usage patterns
  • Network Connections: WiFi history, connected devices
  • Voice Commands: If voice assistant enabled
  • USB Device History: External devices connected
  • HDMI-CEC Logs: Connected device interactions
  • Screenshots/Recordings: Some TVs can capture screen

Smart TV Acquisition Approaches

Approach Description Data Obtained
On-Device Extraction Access TV settings and menus directly Viewing history, app list, network info
Mobile App Analysis Extract data from companion apps Sync data, remote control history
Account Data Request Request from Samsung, LG, Roku, etc. Cloud-stored viewing data, account info
Router Log Analysis Analyze network traffic from TV Streaming services accessed, timing
Physical Forensics Extract internal storage (advanced) Cached content, deleted data
ACR Technology

Automatic Content Recognition (ACR) is used by most Smart TVs to identify what content is displayed on screen, even from external sources like gaming consoles or cable boxes. This data is often sent to manufacturers and advertisers. ACR logs can show exactly what was watched and when, providing detailed viewing timelines.

Fitness Trackers & Wearables

Wearable Device Forensics
Fitness trackers, smartwatches, and health monitors

Popular Wearable Platforms

  • Apple Watch: watchOS, tight iOS integration, Health app sync
  • Fitbit: Proprietary OS, Google account integration (post-acquisition)
  • Samsung Galaxy Watch: Tizen/Wear OS, Samsung Health
  • Garmin: Proprietary OS, Garmin Connect cloud platform
  • Xiaomi Mi Band: Budget trackers, Mi Fit/Zepp app
  • Wear OS devices: Google's smartwatch platform

Wearable Evidence Types

💓
Heart Rate Data
Continuous monitoring, anomalies
🚶
Step/Activity
Movement patterns, exercise
🌍
GPS Location
Routes, workout paths
💤
Sleep Data
Sleep patterns, wake times
🔔
Notifications
Synced alerts, messages
💉
Health Metrics
SpO2, stress, temperature

Fitbit Forensics

Fitbit devices store minimal data locally but sync extensively with cloud services. Key acquisition methods include:

Fitbit Data Sources
# Fitbit App (Android)
/data/data/com.fitbit.FitbitMobile/
- databases/activity_db (exercise data)
- databases/sleep_db (sleep records)
- databases/device_db (paired devices)

# Cloud Data Export
fitbit.com > Settings > Data Export
- Account archive (JSON format)
- Includes all synced data

# Legal Request
Submit to Fitbit/Google Legal
- Extended historical data
- GPS routes, minute-by-minute data

Apple Watch Forensics

Apple Watch data is primarily accessed through the paired iPhone:

  • Health App: Contains all synced health and fitness data
  • Watch App: Device settings, installed apps, notifications
  • iCloud: Health data may sync to iCloud if enabled
  • iTunes/Finder Backup: Watch data included in iPhone backup
💡 Case Study: Fitbit as Alibi Buster

In a Connecticut murder case, a woman's Fitbit contradicted her account of events. She claimed an intruder killed her husband, but her Fitbit showed she was awake and moving during the time she claimed to be asleep. The heart rate data showed elevated stress levels before the alleged attack. The step count data indicated movement throughout the house at critical times, leading to her arrest and conviction.

Forensic Value of Wearable Data

Data Type Forensic Application
Heart Rate Stress detection, time of death estimation, activity verification
Step Count Movement verification, alibi confirmation/contradiction
GPS/Location Route reconstruction, presence at locations
Sleep Data Verify sleeping/awake status at specific times
Workout Data Precise timing and location of physical activities

Other Smart Devices

Smart Doorbells (Ring, Nest)

  • Video recordings of visitors and motion events
  • Two-way audio communications
  • Motion detection zones and sensitivity settings
  • Cloud storage (subscription-based retention)
  • Shared video with neighbors (Ring Neighbors app)

Smart Locks

  • Access logs with user identification (code/fingerprint/app)
  • Lock/unlock timestamps
  • Failed access attempts
  • Battery and connectivity status
  • Remote access history

Smart Appliances

  • Refrigerators: Door open/close times, inventory (some models)
  • Washing Machines: Cycle history, water usage
  • Ovens: Cooking times, temperatures, remote start logs
  • Coffee Makers: Brewing schedules, usage patterns
📚 Key Takeaways
  • Amazon Alexa stores voice recordings, activity logs, and smart home actions in AWS cloud accessible via account or legal request
  • Google Home/Nest data is available through Google Takeout, My Activity, and formal legal requests to Google
  • Smart TVs with ACR technology log detailed viewing history including external source content
  • Fitness trackers provide heart rate, location, activity, and sleep data that can verify or contradict alibis
  • Wearable data has been successfully used in criminal investigations to establish timelines and presence
  • Smart doorbells, locks, and appliances create additional evidence about home activity patterns
  • Multiple data sources (device, app, cloud) should be acquired for comprehensive analysis
  • Privacy considerations and proper legal authorization are essential for smart device investigations