Custom Plaso plugins outperform iLEAPP by extracting previously unrecoverable Apple Health features across multiple iOS versions
The study developed custom plugins for the log2timeline Plaso framework to automate extraction of Apple Health records. Tested across iOS versions 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, the plugins successfully extracted features that iLEAPP could not recover, integrating disparate schema variations into a unified timeline.
Evidence Score
Study Evidence
Study 1. Forensic timeline investigation of Apple Health app on iOS.
observationalPuspitarini AD, Studiawan H · Journal of forensic sciences (2026)
Result:
Mechanism Graph
Limitations
- ⚠Study only tested on specific iOS versions (13.3.1, 13.4.1, 15.3.1, 16.1.2, 17.3), not all possible versions
- ⚠Performance comparison limited to iLEAPP only, not other forensic tools
Frequently Asked Questions
What is the Plaso framework?▼
Plaso (log2timeline) is an open-source forensic timeline analysis tool that automates extraction and correlation of digital evidence from various sources.
Why are Apple Health data important for forensics?▼
Apple Health data provide critical insights into a user's physical activities, exercise routines, sleep patterns, and biometrics, which can be valuable in forensic investigations.
What challenges did the study address?▼
The study addressed the complexity of Apple Health database schema and frequent iOS updates that make automated forensic analysis difficult.
How did the plugins perform compared to iLEAPP?▼
The custom Plaso plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable with iLEAPP.
Products
Affiliate links coming soon. We only recommend products that match the doses and forms used in the cited research.
References
- 1.Puspitarini AD, Studiawan H. "Forensic timeline investigation of Apple Health app on iOS.." Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385