Forensic Acquisition Of Ring Doorbell Data In Oxygen Forensic Detective

The latest version of Oxygen Forensic® Detective includes industry-exclusive support for Ring services by Ring, LLC. Investigators can now use Oxygen Forensic® Detective to extract data from Ring apps on PCs and mobile phones, as well as from Ring cloud.

What is Ring?

Ring services include devices developed for home security and ‘smart home’ synchronization via a companion mobile application. The service is delivered by Ring LLC, an Amazon-affiliated company, that develops products for home safety including motion sensor cameras and video doorbells. Collected data is stored on a cloud server and members may access it anytime using the Ring app.

Ring and the police: friend or foe?

The Ring privacy policy allows Amazon to disclose information about its users where required by law, to defend Amazon’s own legal rights, to prevent harm, in connection with a criminal investigation, or with the user’s consent.

In the US, Ring LLC has partnered with more than 400 police forces, allowing police to request videos recorded by homeowners’ cameras within a specific time and area. However, officers don’t receive ongoing or live-video access, and homeowners have the right to decline requests. Naturally, if the homeowner accepts the request and shares their feed, a crime can potentially be solved. A great example in solving heinous crimes came about when a California man was charged with the murder of his step-daughter after a neighbor’s Ring surveillance camera showed his car parked at her house right at the time of the death.

Additionally, the FBI published a Technical Analysis Bulletin entitled, “Internet of Things Devices Likely Present Both Opportunities and Potential Challenges for Law Enforcement Investigators”. In this report, the FBI expressed multiple “new challenges” regarding sensor and camera-equipped smart home devices.Specifically, if police are approaching a house for a search, the motion-sensored camera can offer an early warning or give away the officer’s location in a standoff. In other cases, it could capture pictures of law enforcement, which would present a “risk to their present and future safety”.

In these situations, data extracted from Ring apps and cloud may help to determine whether the device owner had seen police approaching or what the camera captured in general.

To extract this valuable data it is as easy as launching Oxygen Forensic® Detective., which provides full extraction, decryption, and analytic support for Ring services.

Ring in Oxygen Forensic® Detective: extract it all!

With Oxygen Forensic® Detective, investigators can extract Ring data from both mobile and PC apps, as well as from the cloud.

Computer Artifacts

The Ring PC app is available for Windows and macOS only. Investigators can use Oxygen Forensic® KeyScout to extract data from both operating system versions. Run this app on the target PC to acquire information about authorized devices, device owner, camera snapshots, and doorbell logs.

Mobile

Audio, video, account information, events, logs, cookies and cache with snapshots, as well as locations of Ring devices and information about them can be extracted from both Android and iOS Ring apps.

Cloud

Since Ring data is stored on a cloud server, we recommend using Oxygen Forensic® Cloud Extractor to collect and analyze its data, some of which might not have been yet synchronized with the device under investigation.

Login credentials or a token are required for cloud authorization. Both can be imported from the Accounts and Passwords section of the device home screen in Oxygen Forensic® Detective if the Ring app was used on the analyzed device. If 2-factor authentication is enabled in Ring, Oxygen Forensic® Cloud Extractor allows investigators to bypass it using an SMS code sent to the associated phone number or a confirmation email sent to the associated email address. Once logged in, an investigator can proceed to extract account data, events, videos, as well as a list of Ring devices.

We are excited to introduce Ring support to the industry. Currently, Oxygen Forensic® Detective is the only digital forensic solution offering extraction support for Ring products like the Ring Video Doorbell.

Leave a Comment