Wearable devices such as smartwatches and smartbands generate large volume of personal information through sensors, which, in turn, can be used for providing a range of services to users, such as heart rate measurement and making calls. As the generated data are preserved in the internal storage of the wearable device, getting access to this data from the device's internal storage can prove useful in criminal investigations. We, therefore, propose a forensic model based on direct connections using wireless or internal/external interfaces beyond indirect forensics for wearable devices. The forensic model was derived based on the ecosystem of wearable devices, and the proposed forensic methods were divided into logical and physical forensic methods. To confirm the applicability of the forensic model, we applied it to wearable devices from Samsung, Apple, and Garmin. Our results demonstrate that the proposed forensic model for wearable devices can be successfully used to derive artifacts such as device information and health data.
