Post-mortem digital forensic analysis of the Garmin Connect application for Android

Abstract

The Garmin Vivosmart 4 smartband can monitor various health metrics, including heart rate, oxygen saturation, body composition, and stress levels. It is a quite popular fitness tracking device, as its Android companion application – Garmin Connect – has been downloaded more than 10 million times and can provide critical forensic artifacts such as timestamped GPS-based locations. In this work, we analyze the Garmin Connect application to identify i) relevant digital forensic artifacts, and ii) assess methods to retrieve cloud-based data relevant to a digital forensic examination. For this purpose, we first establish a test scenario where the paired device/application collects data in regular real-world situations using a rooted smartphone running Android 11. The smartphone is then examined to gain insights into the data stored by the application and identify meaningful digital artifacts.To ease and automate the task of digital forensic practitioners, we have developed the Garmin Connect for Android Analyzer (GC4AA) set of Python 3 modules tailored for the digital forensic framework Android Logs Events And Protobuf Parser (ALEAPP). These open-source modules parse dumps of a Vivosmart 4 data directory and create reports displaying several digital artifacts, such as health metrics, GPS data and routes, and phone notifications. They automate the information-gathering process and produce a report specially tailored for Garmin Connect data, highlighting the most relevant artifacts. Our results show that the analysis of paired Garmin Collect/Vivosmart 4 with GC4AA can yield more digital forensic artifacts than existing open-source tools, including the following new artifacts: i) Daily Summary data; ii) GPS data; iii) Response Cache data; iv) Network Logs; v) Facebook API tokens; vi) Device Synchronization cache; vii) SpO2 reading charts. Our contributions include a graphical presentation of the collected data, greatly improving its readability and analysis.