The Watch Knows: A Unified Forensic Framework for Non-OS Smartwatches Leveraging BLE Sniffing And ADB Log Analysis

Non-operating system (non-OS) smart wearables present formidable challenges in digital forensics due to their restricted interfaces and proprietary data encodings. This paper introduces a forensic framework for non-OS smartwatches that brings together BLE sniffing, ADB-based log extraction, and analysis of archived logs. Using this approach, investigators can capture real-time data, recover communication events and notifications, and access historical call and SMS records. Data Integrity of the content is ensured through hashing. In addition, comprehensive reconstruction of user activities, covers real-time physiological metrics (e.g., heart rate), telephony logs (incoming, outgoing, missed calls), SMS details, and notifications from applications such as WhatsApp and Telegram, supported by inferred location data from weather service interactions. Our approach using commercial non-OS wearables demonstrates high-fidelity, non- invasive data recovery, achieving accurate decoding of hex- encoded metrics and structured log analysis. This study advances the state of wearable forensics by introducing a validated framework that ensures evidentiary soundness, supports cross-device adaptability within IoT ecosystems, and strengthens the reliability of digital investigations in judicial and law enforcement contexts.