Authors: Shishir Panta, Ruba Alsmadi, Ibrahim Baggili
DFRWS USA 2026
Abstract
Meta’s Ray-Ban smart glasses, paired with the Meta AI mobile application, are part of a rapidly growing class of AI-enabled wearable devices, with over two million units sold to date. As adoption increases, these devices are becoming increasingly relevant to civil and criminal investigations. However, the forensic landscape for these systems remains underexplored and is not yet supported by existing tools. This paper presents (i) a forensic methodology for acquiring and analyzing the Ray-Ban Meta ecosystem, (ii) a forensic framework that formalizes evidence distribution, correlation, and attribution across the glasses-companion-cloud architecture, and (iii) an open-source contribution that operationalizes these findings. Through privileged filesystem acquisition of the Android companion application and correlation with Meta cloud exports, we recover and validate user/account identifiers, device identifiers, media artifacts, geolocation traces, and AI interaction records. We further evaluate user-initiated deletion and reset actions, demonstrating that certain identifiers and traces persist across anti-forensic attempts and that cloud exports retain complementary conversational evidence. We extend the Android Logs, Events, and Protobuf Parser (ALEAPP) with a Meta AI plugin that automates artifact extraction and correlation, providing digital forensic practitioners and researchers with a practical, repeatable workflow for investigating AI-enabled smart glasses.