Adaptive forensic plugins for Apple Health data extraction outperform existing tools across multiple iOS versions
The study developed custom plugins for the log2timeline Plaso framework to automate extraction of Apple Health records across iOS versions 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3. The plugins successfully extracted previously unrecoverable Apple Health features and outperformed iLEAPP by integrating disparate schema variations into a unified timeline, reducing manual analysis effort.
Evidence Score
Study Evidence
Study 1. Forensic timeline investigation of Apple Health app on iOS.
observationalPuspitarini AD, Studiawan H · Journal of forensic sciences (2026)
Result:
Mechanism Graph
Limitations
- ⚠Abstract does not report quantitative metrics such as extraction accuracy or time savings
- ⚠Study only tested on five specific iOS versions, limiting generalizability to other versions or future updates
Frequently Asked Questions
What is the log2timeline Plaso framework?▼
It is an open-source forensic tool for creating super timelines from digital evidence, and this study integrated custom plugins to handle Apple Health data.
How does this plugin compare to iLEAPP?▼
The developed plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable with iLEAPP.
Which iOS versions were tested?▼
The plugins were tested on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3.
What types of data does Apple Health app contain for forensic analysis?▼
Apple Health data includes physical activities, exercise routines, sleep patterns, and biometrics, which can provide critical forensic insights.
Products
Affiliate links coming soon. We only recommend products that match the doses and forms used in the cited research.
References
- 1.Puspitarini AD, Studiawan H. "Forensic timeline investigation of Apple Health app on iOS.." Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385