Supplements

Custom Plaso plugins outperform iLEAPP by successfully extracting previously unrecoverable Apple Health features across multiple iOS versions

The study developed custom plugins for the log2timeline Plaso framework to automate extraction of Apple Health records. Tested across iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, the plugins outperformed iLEAPP by recovering features that were previously unrecoverable, integrating disparate schema variations into a unified timeline.

1 min read•Updated Jul 7, 2026•0 RCTs•View structured evidence →
Evidence Score32/100
Human RCT☆☆☆☆☆
Meta-analysis☆☆☆☆☆
Mechanism★★★★★
Safety★★★★☆
Confidencelow

This article is automatically generated from the structured evidence profile behind the claim above. Scores reflect the quality and quantity of available research, not clinical advice.

Custom Plaso plugins outperform iLEAPP by successfully extracting previously unrecoverable Apple Health features across multiple iOS versions The current body of evidence comprises 1 study. EvidenceHub rates the overall confidence at 32/100 (low).

The Claim

Custom Plaso plugins outperform iLEAPP by successfully extracting previously unrecoverable Apple Health features across multiple iOS versions

This conclusion is most relevant to: Apple Health app data from iOS devices across multiple versions.

What the Research Shows

The conclusion draws on 1 linked study. Highlights from the cited literature:

  • ▸Forensic timeline investigation of Apple Health app on iOS. (Journal of forensic sciences, 2026) —

How It Works

The proposed biological pathway:

  • ▸Analyze Apple Health database schema across iOS versions
  • ▸Develop custom plugins for Plaso framework
  • ▸Test plugins on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3
  • ▸Result: Successful extraction of previously unrecoverable features and unified timeline integration

Who Might Benefit

Evidence fit by population:

  • ▸Apple Health app data from iOS devices across multiple versions

Limitations & Caveats

Important context when interpreting this evidence:

  • ▸Study only tested on specific iOS versions up to 17.3, not covering later updates
  • ▸Performance comparison limited to iLEAPP, not other forensic tools

Frequently Asked Questions

What is the Plaso framework?▼

Plaso (log2timeline) is an open-source tool for automated timeline analysis in digital forensics, used to parse and correlate event data from various sources.

How does this plugin compare to iLEAPP?▼

The custom plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable, particularly across different iOS schema versions.

Which iOS versions were tested?▼

The plugins were tested on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3.

What types of Apple Health data can be extracted?▼

The plugins extract physical activities, exercise routines, sleep patterns, and biometrics from the Apple Health app database.

References

  1. 1.Puspitarini AD, Studiawan H. “Forensic timeline investigation of Apple Health app on iOS..” Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385
Disclaimer: This article is auto-generated from structured research data for educational purposes only and is not medical advice. Evidence scores reflect the quality and quantity of available research, not clinical recommendations. Always consult a healthcare professional before starting any supplement or intervention.