A smartwatch may store traces of activity, location, calls or notifications. Their significance depends, however, on where the record was created and what its associated time means. Comparing watch data with phone and cloud data may help reconstruct an event, provided the differences between these sources are preserved. Simply placing all entries on a single timeline does not remove uncertainty about synchronisation, clock settings or the person using the device.
The source first, then the time
Similar information may be stored directly on the watch, in the companion phone application and in an online service. Some entries are copied, some are recalculated, and others are created only during import. A record repeated in three places does not necessarily represent three independent observations.
| Material | The question that needs answering |
|---|---|
| Watch record | Does the time indicate a measurement, the start of an activity or a file being saved? |
| Phone application | Did the entry originate on the watch, or was it added or processed later? |
| Cloud data | Does the time describe an event, transmission, modification or download? |
The MOBILedit manufacturer describes, for example, analysis of Garmin backups, while for certain other devices it identifies application data on the phone. The term ‘smartwatch data’ therefore requires clarification of the actual storage medium and acquisition method.
Read access depends on the specific configuration
The technical assessment begins with the model, operating system and version, device condition, available connection and tool compatibility. The required adapter, reader and driver must also be checked. General information that a brand is supported does not establish whether a particular unit can be examined or which artefacts will be available.
Smartwatch Kit has its own versions and equipment. Selecting a reader or adapter is part of assessing the particular watch. Compatibility of the connection, operating system and tool must be confirmed before specifying the method and possible scope of data.
Hypothetical example: one activity and three times
Consider a wholly hypothetical example. A watch record describes the start of an activity as 08:10 UTC. The phone application records import completion at 09:12 CET, and the online service records the data being added at 09:40 CET. The first time converts to 09:10 CET. The others may describe successive stages of data transfer rather than new user actions.
The report should retain all three values and explain the meaning of the fields. Only then can the interval between the activity and its synchronisation be assessed. If the system did not specify the time zone of the first record, further clarification would be needed instead of automatically adding an hour. The UTC designation in the example is a teaching assumption, not a property of every export.
Linking a device to a person requires additional data
A profile name, logged-in account and sensor reading can indicate the context in which a watch was used. However, on their own they are insufficient to establish who was wearing it at a particular moment. The device may be shared, left somewhere or passed to another person. A conclusion about a particular person's presence requires consideration of these possibilities and checks against other, independent sources.
Similar caution applies to health and communication. A heart rate record is not a diagnosis in itself, and a notification may contain only part of a message. A missing measurement may result from a recording interruption, configuration or incomplete material. It does not automatically justify a finding of no activity or no conversation.
What should remain verifiable in the report
A good timeline preserves original values and, separately, standardised values together with the conversion rule. It describes the record's source, device identification, software version, acquisition method and known gaps. Where a correlation rests on an assumption, it should be marked as a hypothesis rather than presented as an established link between events.
MOBILedit reporting documentation provides for labelling data origins and mechanisms for checking material integrity. This does not replace assessment of what entries mean. A verifiable conclusion shows which artefact supports it and what alternative explanations remain possible.
The manufacturer's documentation was checked on 1 November 2026. The method and possible scope of examination are determined for the particular model, operating system and material.