Academic Journal
Forensic timeline investigation of Apple Health app on iOS.
| Τίτλος: | Forensic timeline investigation of Apple Health app on iOS. |
|---|---|
| Συγγραφείς: | Puspitarini AD; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia., Studiawan H; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia. |
| Πηγή: | Journal of forensic sciences [J Forensic Sci] 2026 Sep; Vol. 71 (5), pp. 2373-2385. Date of Electronic Publication: 2026 Jul 02. |
| Τύπος έκδοσης: | Journal Article |
| Γλώσσα: | English |
| Στοιχεία περιοδικού: | Publisher: Blackwell Pub Country of Publication: United States NLM ID: 0375370 Publication Model: Print-Electronic Cited Medium: Internet ISSN: 1556-4029 (Electronic) Linking ISSN: 00221198 NLM ISO Abbreviation: J Forensic Sci Subsets: MEDLINE |
| Imprint Name(s): | Publication: 2006- : Malden, MA : Blackwell Pub. Original Publication: [Chicago, Ill.] : Callaghan and Co., 1956- |
| Ιατρικοί όροι (MeSH): | Mobile Applications* , Forensic Sciences*, Humans ; Digital Health |
| Περίληψη: | Apple Health data provide critical forensic insights into a user's physical activities, exercise routines, sleep patterns, and biometrics. However, the complexity of its database schema and frequent iOS updates pose significant challenges for automated forensic analysis. This research develops and integrates custom plugins into the log2timeline Plaso framework to automate the extraction of Apple Health records. The developed parsers were tested across multiple iterations, specifically addressing the database reorganizations found in iOS 13.3.1, iOS 13.4.1, iOS 15.3.1, iOS 16.1.2, and iOS 17.3. Results demonstrate the developed plugins outperform iLEAPP (iOS Logs, Events, and Plist Parser) by successfully extracting Apple Health features that previously unrecoverable. The plugins successfully integrate disparate schema variations across multiple iOS versions into a unified timeline, reducing manual analysis effort. This study concludes that adaptive plugins is essential for maintaining forensic tool efficacy amidst rapid mobile iOS evolution, providing a robust solution for timeline-based health data investigations. (© 2026 American Academy of Forensic Sciences.) |
| References: | Forensic Sci Int Synerg. 2020 Mar 19;2:489-520. (PMID: 33385144) Forensic Sci Int Digit Investig. 2021 Sep;38:. (PMID: 36911421) |
| Grant Information: | Lembaga Pengelola Dana Pendidikan |
| Contributed Indexing: | Keywords: Apple Health; forensic timeline; iOS forensics; log2timeline Plaso |
| Entry Date(s): | Date Created: 20260703 Date Completed: 20260902 Latest Revision: 20260904 |
| Update Code: | 20260904 |
| PubMed Central ID: | PMC13534974 |
| DOI: | 10.1111/1556-4029.70385 |
| PMID: | 42394193 |
| Βάση Δεδομένων: | MEDLINE |
| ISSN: | 1556-4029 |
|---|---|
| DOI: | 10.1111/1556-4029.70385 |