Custom Plaso plugins outperform iLEAPP by extracting previously unrecoverable Apple Health features across multiple iOS versions
The study developed custom plugins for the log2timeline Plaso framework to automate extraction of Apple Health records. Tested across iOS versions 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, the plugins successfully extracted features that iLEAPP could not recover, integrating disparate schema variations into a unified timeline.
This article is automatically generated from the structured evidence profile behind the claim above. Scores reflect the quality and quantity of available research, not clinical advice.
Custom Plaso plugins outperform iLEAPP by extracting previously unrecoverable Apple Health features across multiple iOS versions The current body of evidence comprises 1 study. EvidenceHub rates the overall confidence at 32/100 (low).
The Claim
Custom Plaso plugins outperform iLEAPP by extracting previously unrecoverable Apple Health features across multiple iOS versions
This conclusion is most relevant to: Apple Health app database across iOS versions 13.3.1 to 17.3.
What the Research Shows
The conclusion draws on 1 linked study. Highlights from the cited literature:
- ▸Forensic timeline investigation of Apple Health app on iOS. (Journal of forensic sciences, 2026) —
How It Works
The proposed biological pathway:
- ▸Analyze Apple Health database schema across iOS versions
- ▸Develop custom plugins for Plaso framework
- ▸Test plugins on multiple iOS iterations
- ▸Result: Successful extraction of previously unrecoverable features
Who Might Benefit
Evidence fit by population:
- ▸Apple Health app database across iOS versions 13.3.1 to 17.3
Recommended Dose
N/A
Limitations & Caveats
Important context when interpreting this evidence:
- ▸Study only tested on specific iOS versions (13.3.1, 13.4.1, 15.3.1, 16.1.2, 17.3), not all possible versions
- ▸Performance comparison limited to iLEAPP only, not other forensic tools
Frequently Asked Questions
What is the Plaso framework?▼
Plaso (log2timeline) is an open-source forensic timeline analysis tool that automates extraction and correlation of digital evidence from various sources.
Why are Apple Health data important for forensics?▼
Apple Health data provide critical insights into a user's physical activities, exercise routines, sleep patterns, and biometrics, which can be valuable in forensic investigations.
What challenges did the study address?▼
The study addressed the complexity of Apple Health database schema and frequent iOS updates that make automated forensic analysis difficult.
How did the plugins perform compared to iLEAPP?▼
The custom Plaso plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable with iLEAPP.
References
- 1.Puspitarini AD, Studiawan H. “Forensic timeline investigation of Apple Health app on iOS..” Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385