Forensic timeline investigation of Apple Health app on iOS.

Abstract

Apple Health data provide critical forensic insights into a user's physical activities, exercise routines, sleep patterns, and biometrics. However, the complexity of its database schema and frequent iOS updates pose significant challenges for automated forensic analysis. This research develops and integrates custom plugins into the log2timeline Plaso framework to automate the extraction of Apple Health records. The developed parsers were tested across multiple iterations, specifically addressing the database reorganizations found in iOS 13.3.1, iOS 13.4.1, iOS 15.3.1, iOS 16.1.2, and iOS 17.3. Results demonstrate the developed plugins outperform iLEAPP (iOS Logs, Events, and Plist Parser) by successfully extracting Apple Health features that previously unrecoverable. The plugins successfully integrate disparate schema variations across multiple iOS versions into a unified timeline, reducing manual analysis effort. This study concludes that adaptive plugins is essential for maintaining forensic tool efficacy amidst rapid mobile iOS evolution, providing a robust solution for timeline-based health data investigations.