Samsung Watch

On earlier models of Samsung Watch the Tizen OS can be found, on later versions they use WearOS.

Prerequisites:

• MOBILedit Forensic PRO or ULTRA software should be installed and running.

• The Samsung watch you wish to connect.

• Specialized reader for Samsung smartwatch extraction.

• Developer access to the Samsung watch.

• For Samsung watch with Tizen OS, the Samsung driver should be installed. The driver can be found here. For Wear OS, Windows drivers for Android devices are sufficient.

Connection Steps:

1. Prepare the Samsung Watch:

   • To access the watch's diagnostic port, you must remove the backplate. This should be done carefully to avoid damage.

   • Unlock the Samsung watch if a PIN is set.

2. Enable Developer Mode and ADB Debugging:

   • On the Samsung watch, access the Settings menu.

   • Scroll down and find the “About watch” section.

   • Locate “Software Information” and tap on it.

   • Find “Build number” and tap on it multiple times to enable Developer mode.

   • Now, navigate back to the main “Settings” menu.

   • You should now see “Developer options”, enter this menu.

   • Find “ADB Debugging” and enable it. This step is crucial for connecting to MOBILedit Forensic.

3. Choose the Correct Adapter:

   • Select the appropriate adapter for your Samsung watch model.

     

4. Choose the Correct Reader:

   • For the Samsung Watch series 2,3 and 4, choose the black reader. For the Samsung Watch series 5 and above, choose the red reader.

   • Although it may look like the red reader missing one pin, it is deliberate and meant to be like that.

5. Position the Switch:

   • Ensure that the switch on the reader is set to position "I", the “read” position. This setting is necessary for extracting the data. Position “II” is for “write” and is used to switch the watch into Odin mode.

     

6. Place the Adapter on the reader and connect the watch:

   • Gently insert the chosen adapter into the reader, and connect the watch.

7. Secure the Watch:

   • To maintain a stable connection during the process, it is recommended to use the strap to hold the watch and adapter securely in place.

8. Confirm RSA Fingerprint:

   • MOBILedit Forensic may prompt you to confirm the RSA fingerprint for the Samsung watch. Verify that the fingerprint matches the expected value.

9. Successful Connection:

   • Once all the above steps are completed successfully, your Samsung watch should be visible in MOBILedit Forensic for data extraction and analysis.

List of watches and compatible adapters:

Extracted data types

• Contacts

• Calls

• Images

• Audio

• Documents

• Other files

• Applications list

• Notifications

• Deleted data – Contacts, Calls, Notifications

• Sleep data (MOBILedit Forensic ULTRA > Exynos decrypt only).

Samsung Galaxy Health App

The Health app stores crucial data for investigations and is shown in the report under the following categories:

Report categories:

• Exercises

• Devices

• Blood oxygen

• Cycle

• Heart rate

• Sleep

• Stress

• Weight

• Variations (of heart rate)

• Abnormal heart rates (Above 115 bpm or below 50 bpm)

The application package is com.samsung.android.wear.shealth and can be found on both Samsung Android phones and Samsung Galaxy watches with Wear OS.

To acquire the application data, MOBILedit Forensic ULTRA is required for security bypassing, using Exynos decrypt.

Heart rates are recorded every minute during activity and every 10 minutes outside of activities. Data is retained within the application for many weeks.

Here are some examples of the reports:

Samsung Watch Nanohub Logs

There are many sensors built into Samsung Smartwatches that can provide useful investigative data. The sensors provide data to various applications, especially health and navigation applications.

Many of the sensors generate logs which are stored in the “Nanohub” logs.

Sensor logs typically retain around 2 days of data while the watch is actively worn.

If a watch is left unused, logs are generally retained until the device is worn again, potentially preserving historical data for longer.

Within the reports, you will see the following categories from Samsung smartwatches:

• Sensors on/off status

• Nanohub heart rates

• Nanohub skin temperatures

• Nanohub altitudes

• respirations

• pressures

• Watch Off Body Status

• Nanohub locations