Post-mortem digital forensics analysis of the Zepp Life android application (2023)

Since the inception of the first Apple's iWatch in 2015, smartwatches – that is, digital devices worn at the wrist – have been gaining popularity, merging commodity features such as phone calls and message notifications, with activity tracking, acting as an appendix of the ubiquitous smartphone. This popularity trend has increased with the emergence of low-cost and feature-charged wrist-worn devices, also known as smart bands (Canalys Newsroom, 2021). Examples include Samsung Gear Fit, Huawei's Band, Huami's Amazfit Band, and Xiaomi's Mi Band, to name just a few. Smart band devices can perform basic functions such as timekeeping, alarm clock, displaying received SMS, and notifying of incoming phone calls or messages. They can also perform more advanced functions such as triggering the paired smartphone to ring to facilitate its localization, or displaying the weather prediction for the next few days. In addition, they can also collect health metrics, such as heart rate, level of blood oxygen saturation, perform sleep analysis, and track calorie consumption, as well as gather activity-related metrics, such as steps taken, running, biking, or pool swimming.

A significant portion of a smart band's usefulness comes from its companion mobile application, which is usually a vendor-specific app that runs on a smartphone and communicates with the smart band via Bluetooth Low Energy (BLE). The companion app is an essential part of the smart band/smartphone pair, as it receives and processes data collected by the band and provides internet connectivity for tasks such as uploading data to the band vendor's cloud, downloading firmware updates for the band, or simply accessing weather forecast data.

Smart bands companion apps also serve as a rich source of digital forensic evidence, as they gather a vast amount of sensitive personal information and usage patterns, which can be used to reconstruct the user's activities and provide valuable insights into criminal investigation (Kim and Lee, 2020; Reedy and Houck, 2023). For instance, heart rate may provide evidence on the time of death of a victim, as it was the case in a murder in the USA in 2015, where data from the Fitbit device worn by the victim was used to establish a precise time of death and refute the alibi of a suspect (BBC News; Dorai etal., 2018). The murder in the USA of Karen Navarra in 2018 is another case where data from a Fitbit device worn by the victim assisted investigators in contradicting the alibi of the suspect, as the victim's heart rate soared then slowed and stopped in a period coincident with the suspect's presence at the victim's house (BBC News, 2018). In the Crouch case, heart data rate from a biometric watch worn by the victim along with the paired smartphone was used to disprove the alibi of the main suspect (BBC News, 2021). UK's Mitesh Patel case is another example where data from the suspect's Fitbit showed intense physical activity following the female victim's death, contradicting his testimony (Franqueira and Horsman, 2020). Recognizing the growing importance of adequately assessing mobile and wearable devices, Scotland Yard has announced plans to strengthen its resources for collecting data from wearables and IoT devices, namely FitBit, doorbells, and others (France, 2021).

This paper analyzes the digital forensic artifacts left by the Zepp Life Android application (formerly Mi Fit) coupled with the Mi Band 6. The Mi Band is a lineage of low-cost wrist-worn wearable activity monitors. Version 6 is identified as Mi Band 6 and packs a vast set of activity-related features for a cost of around 35 euros. Its long list of features, low price, and several-week-long battery life have made the Mi Band a commercial success, with each model selling several million units and establishing itself as a market leader in the realm of smart bands (Canalys Newsroom, 2021). For instance, in Q2 2021, Xiaomi sold around eight million Mi Band 6, leading the market with a share close to 20% (Canalys Newsroom, 2021). This market leadership is also visible for the Mi Band default companion application – Zepp Life – whose Android version has more than 100 000 000 downloads, and over nearly 2 500 000 reviews in Google Play,¹ with an average score, at the time of this writing, of 4 out of 5. Note that Xiaomi's Mi Fit was renamed in 2022 as Zepp Life. As observed by Gadgets & Wearables (Xiaomi re, 2022), Zepp is the name of Huami's Amazfit bands software,² with Huami being the manufacturer of the Xiaomi Mi Bands. The two applications share many similarities. In this paper, we present a case study of the Zepp Life mobile application in an Android rooted smartphone paired with the Xiaomi Mi Band 6.

The main contributions of this paper are: i) identification and analysis of the digital forensic artifacts available in a post-mortem examination of a rooted Android smartphone with Zepp Life installed; ii) Development of an open source digital forensic software consisting of a Python 3.6+ script called ZL_std and a module called ZL_autopsy for the open-source Autopsy software.

The remainder of this paper is organized as follows. Section 2 reviews related work, while Section 3 describes the materials and methods of this study. Section 4 analyzes the Zepp Life application, highlighting its primary forensic artifacts. Section 5 presents our open-source software tools ZL_std and ZL_autopsy. Finally, Section 6 concludes the paper.