Supplements

Custom Plaso plugins outperform iLEAPP in extracting Apple Health records across multiple iOS versions

The study developed custom plugins for the log2timeline Plaso framework that successfully extracted Apple Health data from iOS versions 13.3.1 through 17.3, outperforming iLEAPP by recovering previously unrecoverable features. The plugins integrated disparate database schema variations into a unified timeline, reducing manual analysis effort.

1 min read•Updated Jul 7, 2026•0 RCTs•View structured evidence →
Evidence Score32/100
Human RCT☆☆☆☆☆
Meta-analysis☆☆☆☆☆
Mechanism★★★★★
Safety★★★★☆
Confidencelow

This article is automatically generated from the structured evidence profile behind the claim above. Scores reflect the quality and quantity of available research, not clinical advice.

Custom Plaso plugins outperform iLEAPP in extracting Apple Health records across multiple iOS versions The current body of evidence comprises 1 study. EvidenceHub rates the overall confidence at 32/100 (low).

The Claim

Custom Plaso plugins outperform iLEAPP in extracting Apple Health records across multiple iOS versions

This conclusion is most relevant to: Apple Health app data from iOS versions 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3.

What the Research Shows

The conclusion draws on 1 linked study. Highlights from the cited literature:

  • ▸Forensic timeline investigation of Apple Health app on iOS. (Journal of forensic sciences, 2026) —

How It Works

The proposed biological pathway:

  • ▸Develop custom plugins for Plaso framework
  • ▸Test plugins across multiple iOS versions with database reorganizations
  • ▸Compare extraction success with iLEAPP
  • ▸Result: Plugins outperform iLEAPP by recovering previously unrecoverable features

Who Might Benefit

Evidence fit by population:

  • ▸Apple Health app data from iOS versions 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3

Limitations & Caveats

Important context when interpreting this evidence:

  • ▸Study only tested on specific iOS versions (13.3.1, 13.4.1, 15.3.1, 16.1.2, 17.3), not covering all possible updates
  • ▸No quantitative metrics provided for extraction accuracy or false positive rates

Frequently Asked Questions

What is the Plaso framework?▼

Plaso (log2timeline) is an open-source tool for automated timeline analysis in digital forensics, used to parse and correlate digital evidence from various sources.

How does this plugin compare to iLEAPP?▼

The developed plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable, particularly across different iOS versions with varying database schemas.

Which iOS versions were tested?▼

The plugins were tested on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, covering multiple major updates with database reorganizations.

What types of Apple Health data can be extracted?▼

The plugins extract physical activities, exercise routines, sleep patterns, and biometrics from the Apple Health app's database.

References

  1. 1.Puspitarini AD, Studiawan H. “Forensic timeline investigation of Apple Health app on iOS..” Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385
Disclaimer: This article is auto-generated from structured research data for educational purposes only and is not medical advice. Evidence scores reflect the quality and quantity of available research, not clinical recommendations. Always consult a healthcare professional before starting any supplement or intervention.