Forensic analysis of hidden artifacts: A comprehensive investigation framework for smart wearables

The rapid proliferation of smart devices introduced challenges and opportunities in digital forensics. These devices continuously collect sensitive user data, such as health metrics, location history, and authentication credentials, often stored across complex, platform-dependent environments. This article proposes the digital forensic investigation framework for wearable devices (DFIF-WD), supported by two key algorithms, DFX-WD, and DFA-WD, that enable efficient application-level artifact extraction from smart wearables. The framework emphasizes logical extraction techniques that eliminate the need for administrative privileges, thereby ensuring minimal invasiveness and broader device compatibility. The study successfully identifies persistent digital artifacts from rooted mobile devices through systematically analyzing companion mobile applications associated with commercial smartwatches. The findings reveal significant shortcomings in current data deletion mechanisms and underscore the forensic potential of residual application data. The proposed framework is validated across multiple device ecosystems, highlighting its adaptability, scalability, and relevance in real-world Internet of things (IoT) investigations. This research enhances the reliability and reproducibility of wearable forensics and sets the stage for standardized practices in the evolving domain of IoT digital investigations.