Garmin watches reveal your personal data, and what you can do

Summary

TL;DR A walk-through of obtaining sensitive data from a Garmin watch using forensic techniques How digital forensics on a Garmin watch helped solve a double murder case A comparison of Garmin’s privacy with other brands including Fitbit, Apple, and Samsung Understand the security and privacy implications of wearable device data Advice for Garmin users on securing their watch Introduction Related to my last post which detailed forensic techniques for recovering data in smart watches, this post looks specifically at Garmin watches. This time, we’ll explore how data can be accessed much easier, without any user credentials or the linked mobile device, and how users can protect themselves. Garmin smartwatches hold a raft of data covering much more than fitness metrics, but they also have privacy issues. For instance, a misplaced Garmin smartwatch can be easily connected to a computer, exposing its stored data to unauthorised access. This post explores both the forensic opportunities, and the security risks associated with Garmin smartwatches. The Garmin Vivo Active 3 could simply be plugged into a computer, and was then presented as a USB drive, where the file directory can be browsed as if the device was an external USB device. Garmin file directory The main GARMIN folder contains several sub-folders which relate to things that have occurred or have been recorded on the physical device. These include activity data, GPS data, sleep data, messages, and device information. Garmin file directory: Example of data: Data is stored in .FIT (Flexible and Interoperable data Transfer) files. These are a standardized file format used by Garmin to store and share data from fitness and health devices. The FIT protocol is designed to be compact, interoperable, and extensible. These files store various types of data, including configuration data, activity logs, courses, and workouts. They also capture detailed information such as heart rate, speed, pace, and power. They can be importe...