We have previously assisted in cases involving the forensics of children's watches, and recently assisted in several cases involving smart watches:
Case 1, Mi watch /oppo Watch boot password cracking:
The watch involved in the above picture is only a test machine of the same model as the test material and purchased by the company as a test machine for the test of the program, and is not a test material involved in the case (the content of the public account provides confidentiality for the specific case and the test material involved in the case, and only describes the software and technology)
Mi Watch as the founding work of Xiaomi smart watch, sales are still quite large, with relatively powerful performance of the CPU and 8G storage, you can install a third-party APP like a mobile phone, you can also register a mobile phone number through the esim card that comes with it, to achieve dialing calls and networking networks, such a smart watch can be seen as a super small smart phone, in fact, smart watches can also interact with real smart phones from time to time, so the watch also stores a lot of user data, and app data.
Oppo Watch as an OPPO brand into the wearable product market is more radical, we got the first impression after getting it is: beautiful! Fine workmanship, atmospheric appearance, designed for female consumers (Note: OPPO did not give me advertising fees)
However, the manufacturer has added a function more similar to that of a smart phone to the smart watch: the boot password. With the boot password, the watch data cannot be obtained, so the task of cracking the boot password for the smart watch falls to our team.
The process is not much to repeat, twists and turns, miwatch unlocking process is relatively smooth compared to OPPO, but in the end it successfully completed the task.
Case 2. MiWatch breakage does not boot data extraction and power outage time analysis
Both cases involve MiWatch, it can be seen that the sales of MiWatch are really quite large, the MiWatch in this case can not be used normally due to external forces, the motherboard is seriously deformed, and it has not been properly operated after trying to repair:
The memory image was extracted by chip off, but unfortunately, the amount of data in the storage was not large. In the communication with the customer, it was learned that the most difficult to confirm in the current case is the specific time of the occurrence of the case, only to determine the time of the case can be narrowed to lock the suspect as soon as possible, because the result of the broken watch is accompanied by the occurrence of the case, so the power outage time of the watch can also be identified as the time of the event, so we analyze the power failure time of the watch through the RX-Timer990 software, hoping to help the case detection. (Note: RX-Timer990 is a function module in RX-9300, the main function is to analyze the time of damaged smart devices, obtain key time node data, has not yet been officially updated.) ）