Authors: Shishir Panta, Ruba Alsmadi, Ibrahim Baggili
DFRWS USA 2026
Abstract
Meta’s Ray-Ban smart glasses, paired with the Meta AI mobile application, are part of a rapidly growing class of generative AI-enabled wearable devices, with over two million units sold by early 2025. As adoption increases, these devices are becoming increasingly relevant to civil and criminal investigations. However, the forensic landscape for these systems remains underexplored and is not yet supported by existing tools. This paper presents (i) a forensic methodology for acquiring and analyzing the Ray-Ban Meta ecosystem, (ii) a forensic framework that formalizes evidence distribution, correlation, and attribution across the glasses–companion–cloud ecosystem, and (iii) an open-source contribution that operationalizes these findings. Through privileged filesystem acquisition of the Android companion application and correlation with Meta cloud exports, we recover and validate account and device identifiers, media artifacts, geolocation traces, and AI interaction records. We further evaluate user-initiated anti-forensic actions, including deletion, unpairing, and factory reset, demonstrating that certain identifiers and traces persist across these attempts and that cloud exports retain complementary conversational evidence. We also develop a Meta AI Parser plugin for the Android Logs, Events, and Protobuf Parser (ALEAPP) to automate artifact extraction and timeline correlation, providing digital forensic practitioners with a practical workflow for investigating generative AI-enabled smart glasses.