While the inclusion of start/stop time difference and workout duration may seem repetitive these time values can differ. When executed, the query yields the following from completed workouts using the Apple Watch:įigure 7 – Depicting the Workout Duration within the Workout Metadata Query, through DB Browser. As the query is lengthy, we will review it in sections. This data can be exported from DB Browser as a.
The below sqlite query obtains as much relevant data as is available for completed workouts within one query. Once a File System Extraction was obtained of the paired test Apple iPhone, the healthdb_secure.sqlite, healthdb_secure.sqlite-wal, and healthdb_secure.sqlite-shm files were extracted and opened through DB Browser. While the location data can be parsed correctly with software such as Cellebrite Physical Analyzer, key data was not obtained through basic parsing – such as timestamps and the related workout type.
The Workout App on the Apple Watch tracks a user’s activity once a workout has been initiated and the Apple Watch records location data during ongoing workouts. Location Data and Obtaining Metadata for Workouts: This location additionally holds the healthdb.sqlite file as well as the healthdb_secure.hfd and healthdb_secure.hfd-wal files, the latter contains additional location data that will be covered within this article. This folder contains the healthdb_secure.sqlite, healthdb_secure.sqlite-wal, and healthdb_secure.sqlite-shm files required for a review of Health application data. Once a file system extraction of the Apple iPhone has been obtained, the Health application database is located within /private/var/mobile/Library/Health.
#Db browser for sqlite export query result full#
This article will focus entirely on the data gained from an Apple Watch through a Full File System Extraction/Advanced Logical File System Extraction of the paired Apple iPhone. This process additionally allows the validation of data parsed through other software, if available.
#Db browser for sqlite export query result how to#
Knowing where to locate, how to review, and how to display this data in a readable format can provide the picture required to aid investigations. As I will cover, beneficial location data and activity/heart rate data is maintained within the paired device. Whether the Nilsson case 1, where watch activity and heart rate data indicated a time of physical attack and subsequent death, or the Dabate case 2, where Fitbit data (correlated with other data) from the wife and victim pointed to the charging of her husband for her death, these smart devices provide a side of the story otherwise not available.
While an Apple Watch itself offers limited extraction options, the paired device can provide significant data for today’s criminal investigations. McGee, Digital Forensic Examiner, United States Army, Background:
0 kommentar(er)
