Supplements

Custom Plaso plugins outperform iLEAPP by successfully extracting previously unrecoverable Apple Health features across multiple iOS versions

The study developed custom plugins for the log2timeline Plaso framework to automate extraction of Apple Health records. Tested across iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, the plugins outperformed iLEAPP by recovering features that were previously unrecoverable, integrating disparate schema variations into a unified timeline.

Last updated: Jul 7, 2026•0 RCTs•📖 Read as article →

Evidence Score

Evidence Score32/100
Human RCT☆☆☆☆☆
Meta-analysis☆☆☆☆☆
Mechanism★★★★★
Safety★★★★☆
Confidencelow

Study Evidence

Study 1. Forensic timeline investigation of Apple Health app on iOS.

observational

Puspitarini AD, Studiawan H · Journal of forensic sciences (2026)

Participants: N/A
Duration: N/A
Intervention: Custom Plaso plugins for Apple Health data extraction
Outcome: Successful extraction of Apple Health features and integration into unified timeline
Effect Size: N/A
Population: Apple Health app database across iOS versions 13.3.1 to 17.3

Result:

PubMed: 42394193DOI: 10.1111/1556-4029.70385

Mechanism Graph

Analyze Apple Health database schema across iOS versions
↓
Develop custom plugins for Plaso framework
↓
Test plugins on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3
↓
Result: Successful extraction of previously unrecoverable features and unified timeline integration

Limitations

  • ⚠Study only tested on specific iOS versions up to 17.3, not covering later updates
  • ⚠Performance comparison limited to iLEAPP, not other forensic tools

Frequently Asked Questions

What is the Plaso framework?▼

Plaso (log2timeline) is an open-source tool for automated timeline analysis in digital forensics, used to parse and correlate event data from various sources.

How does this plugin compare to iLEAPP?▼

The custom plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable, particularly across different iOS schema versions.

Which iOS versions were tested?▼

The plugins were tested on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3.

What types of Apple Health data can be extracted?▼

The plugins extract physical activities, exercise routines, sleep patterns, and biometrics from the Apple Health app database.

Products

Affiliate links coming soon. We only recommend products that match the doses and forms used in the cited research.

References

  1. 1.Puspitarini AD, Studiawan H. "Forensic timeline investigation of Apple Health app on iOS.." Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385
Disclaimer: This content is for educational purposes only and is not medical advice. Evidence scores reflect the quality and quantity of available research, not clinical recommendations. Always consult a healthcare professional before starting any supplement or intervention.