Academic Journal
Προβολή σε EDS

Forensic timeline investigation of Apple Health app on iOS.

Λεπτομέρειες βιβλιογραφικής εγγραφής
Τίτλος: Forensic timeline investigation of Apple Health app on iOS.
Συγγραφείς: Puspitarini AD; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia., Studiawan H; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia.
Πηγή: Journal of forensic sciences [J Forensic Sci] 2026 Sep; Vol. 71 (5), pp. 2373-2385. Date of Electronic Publication: 2026 Jul 02.
Τύπος έκδοσης: Journal Article
Γλώσσα: English
Στοιχεία περιοδικού: Publisher: Blackwell Pub Country of Publication: United States NLM ID: 0375370 Publication Model: Print-Electronic Cited Medium: Internet ISSN: 1556-4029 (Electronic) Linking ISSN: 00221198 NLM ISO Abbreviation: J Forensic Sci Subsets: MEDLINE
Imprint Name(s): Publication: 2006- : Malden, MA : Blackwell Pub.
Original Publication: [Chicago, Ill.] : Callaghan and Co., 1956-
Ιατρικοί όροι (MeSH): Mobile Applications* , Forensic Sciences*, Humans ; Digital Health
Περίληψη: Apple Health data provide critical forensic insights into a user's physical activities, exercise routines, sleep patterns, and biometrics. However, the complexity of its database schema and frequent iOS updates pose significant challenges for automated forensic analysis. This research develops and integrates custom plugins into the log2timeline Plaso framework to automate the extraction of Apple Health records. The developed parsers were tested across multiple iterations, specifically addressing the database reorganizations found in iOS 13.3.1, iOS 13.4.1, iOS 15.3.1, iOS 16.1.2, and iOS 17.3. Results demonstrate the developed plugins outperform iLEAPP (iOS Logs, Events, and Plist Parser) by successfully extracting Apple Health features that previously unrecoverable. The plugins successfully integrate disparate schema variations across multiple iOS versions into a unified timeline, reducing manual analysis effort. This study concludes that adaptive plugins is essential for maintaining forensic tool efficacy amidst rapid mobile iOS evolution, providing a robust solution for timeline-based health data investigations.
(© 2026 American Academy of Forensic Sciences.)
References: Forensic Sci Int Synerg. 2020 Mar 19;2:489-520. (PMID: 33385144)
Forensic Sci Int Digit Investig. 2021 Sep;38:. (PMID: 36911421)
Grant Information: Lembaga Pengelola Dana Pendidikan
Contributed Indexing: Keywords: Apple Health; forensic timeline; iOS forensics; log2timeline Plaso
Entry Date(s): Date Created: 20260703 Date Completed: 20260902 Latest Revision: 20260904
Update Code: 20260904
PubMed Central ID: PMC13534974
DOI: 10.1111/1556-4029.70385
PMID: 42394193
Βάση Δεδομένων: MEDLINE
FullText Text:
  Availability: 0
CustomLinks:
  – Url: https://resolver.ebsco.com/c/fiv2js/result?sid=EBSCO:cmedm&genre=article&issn=15564029&ISBN=&volume=71&issue=5&date=20260901&spage=2373&pages=2373-2385&title=Journal of forensic sciences&atitle=Forensic%20timeline%20investigation%20of%20Apple%20Health%20app%20on%20iOS.&aulast=Puspitarini%20AD&id=DOI:10.1111/1556-4029.70385
    Name: Full Text Finder (for New FTF UI) (ns324271)
    Category: fullText
    Text: Full Text Finder
    MouseOverText: Full Text Finder
Header DbId: cmedm
DbLabel: MEDLINE
An: 42394193
AccessLevel: 3
PubType: Academic Journal
PubTypeId: academicJournal
PreciseRelevancyScore: 0
IllustrationInfo
Items – Name: Title
  Label: Title
  Group: Ti
  Data: Forensic timeline investigation of Apple Health app on iOS.
– Name: Author
  Label: Authors
  Group: Au
  Data: <searchLink fieldCode="AU" term="%22Puspitarini+AD%22">Puspitarini AD</searchLink>; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia.<br /><searchLink fieldCode="AU" term="%22Studiawan+H%22">Studiawan H</searchLink>; Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia.
– Name: TitleSource
  Label: Source
  Group: Src
  Data: <searchLink fieldCode="JN" term="%220375370%22">Journal of forensic sciences</searchLink> [J Forensic Sci] 2026 Sep; Vol. 71 (5), pp. 2373-2385. <i>Date of Electronic Publication: </i>2026 Jul 02.
– Name: TypePub
  Label: Publication Type
  Group: TypPub
  Data: Journal Article
– Name: Language
  Label: Language
  Group: Lang
  Data: English
– Name: TitleSource
  Label: Journal Info
  Group: Src
  Data: <i>Publisher: </i><searchLink fieldCode="PB" term="%22Blackwell+Pub%22">Blackwell Pub </searchLink><i>Country of Publication: </i>United States <i>NLM ID: </i>0375370 <i>Publication Model: </i>Print-Electronic <i>Cited Medium: </i>Internet <i>ISSN: </i>1556-4029 (Electronic) <i>Linking ISSN: </i><searchLink fieldCode="IS" term="%2200221198%22">00221198 </searchLink><i>NLM ISO Abbreviation: </i>J Forensic Sci <i>Subsets: </i>MEDLINE
– Name: PublisherInfo
  Label: Imprint Name(s)
  Group: PubInfo
  Data: <i>Publication</i>: 2006- : Malden, MA : Blackwell Pub.<br /><i>Original Publication</i>: [Chicago, Ill.] : Callaghan and Co., 1956-
– Name: SubjectMESH
  Label: MeSH Terms
  Group: Su
  Data: <searchLink fieldCode="MM" term="%22Mobile+Applications%22">Mobile Applications*</searchLink> <br /><searchLink fieldCode="MM" term="%22Forensic+Sciences%22">Forensic Sciences*</searchLink><br /><searchLink fieldCode="MH" term="%22Humans%22">Humans</searchLink> ; <searchLink fieldCode="MH" term="%22Digital+Health%22">Digital Health</searchLink>
– Name: Abstract
  Label: Abstract
  Group: Ab
  Data: Apple Health data provide critical forensic insights into a user's physical activities, exercise routines, sleep patterns, and biometrics. However, the complexity of its database schema and frequent iOS updates pose significant challenges for automated forensic analysis. This research develops and integrates custom plugins into the log2timeline Plaso framework to automate the extraction of Apple Health records. The developed parsers were tested across multiple iterations, specifically addressing the database reorganizations found in iOS 13.3.1, iOS 13.4.1, iOS 15.3.1, iOS 16.1.2, and iOS 17.3. Results demonstrate the developed plugins outperform iLEAPP (iOS Logs, Events, and Plist Parser) by successfully extracting Apple Health features that previously unrecoverable. The plugins successfully integrate disparate schema variations across multiple iOS versions into a unified timeline, reducing manual analysis effort. This study concludes that adaptive plugins is essential for maintaining forensic tool efficacy amidst rapid mobile iOS evolution, providing a robust solution for timeline-based health data investigations.<br /> (© 2026 American Academy of Forensic Sciences.)
– Name: Ref
  Label: References
  Group: RefInfo
  Data: Forensic Sci Int Synerg. 2020 Mar 19;2:489-520. (PMID: <searchLink fieldCode="PM" term="%2233385144%22">33385144)</searchLink><br />Forensic Sci Int Digit Investig. 2021 Sep;38:. (PMID: <searchLink fieldCode="PM" term="%2236911421%22">36911421)</searchLink>
– Name: GrantInfo
  Label: Grant Information
  Group: Grant
  Data: Lembaga Pengelola Dana Pendidikan
– Name: SubjectMinor
  Label: Contributed Indexing
  Group:
  Data: <i>Keywords: </i>Apple Health; forensic timeline; iOS forensics; log2timeline Plaso
– Name: DateEntry
  Label: Entry Date(s)
  Group: Date
  Data: <i>Date Created: </i>20260703 <i>Date Completed: </i>20260902 <i>Latest Revision: </i>20260904
– Name: DateUpdate
  Label: Update Code
  Group: Date
  Data: 20260904
– Name: PubmedCentralID
  Label: PubMed Central ID
  Group: ID
  Data: PMC13534974
– Name: DOI
  Label: DOI
  Group: ID
  Data: 10.1111/1556-4029.70385
– Name: AN
  Label: PMID
  Group: ID
  Data: 42394193
PLink https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=cmedm&AN=42394193
RecordInfo BibRecord:
  BibEntity:
    Identifiers:
      – Type: doi
        Value: 10.1111/1556-4029.70385
    Languages:
      – Code: eng
        Text: English
    PhysicalDescription:
      Pagination:
        StartPage: 2373
    Subjects:
      – SubjectFull: Humans
        Type: general
      – SubjectFull: Digital Health
        Type: general
      – SubjectFull: Mobile Applications
        Type: general
      – SubjectFull: Forensic Sciences
        Type: general
    Titles:
      – TitleFull: Forensic timeline investigation of Apple Health app on iOS.
        Type: main
  BibRelationships:
    HasContributorRelationships:
      – PersonEntity:
          Name:
            NameFull: Puspitarini AD
      – PersonEntity:
          Name:
            NameFull: Studiawan H
    IsPartOfRelationships:
      – BibEntity:
          Dates:
            – D: 01
              M: 09
              Text: 2026 Sep
              Type: published
              Y: 2026
          Identifiers:
            – Type: issn-electronic
              Value: 1556-4029
          Numbering:
            – Type: volume
              Value: 71
            – Type: issue
              Value: 5
          Titles:
            – TitleFull: Journal of forensic sciences
              Type: main
ResultId 1