Custom Plaso plugins outperform iLEAPP in extracting Apple Health records across multiple iOS versions
The study developed custom plugins for the log2timeline Plaso framework that successfully extracted Apple Health data from iOS versions 13.3.1 through 17.3, outperforming iLEAPP by recovering previously unrecoverable features. The plugins integrated disparate database schema variations into a unified timeline, reducing manual analysis effort.
Evidence Score
Study Evidence
Study 1. Forensic timeline investigation of Apple Health app on iOS.
observationalPuspitarini AD, Studiawan H · Journal of forensic sciences (2026)
Result:
Mechanism Graph
Limitations
- ⚠Study only tested on specific iOS versions (13.3.1, 13.4.1, 15.3.1, 16.1.2, 17.3), not covering all possible updates
- ⚠No quantitative metrics provided for extraction accuracy or false positive rates
Frequently Asked Questions
What is the Plaso framework?▼
Plaso (log2timeline) is an open-source tool for automated timeline analysis in digital forensics, used to parse and correlate digital evidence from various sources.
How does this plugin compare to iLEAPP?▼
The developed plugins outperformed iLEAPP by successfully extracting Apple Health features that were previously unrecoverable, particularly across different iOS versions with varying database schemas.
Which iOS versions were tested?▼
The plugins were tested on iOS 13.3.1, 13.4.1, 15.3.1, 16.1.2, and 17.3, covering multiple major updates with database reorganizations.
What types of Apple Health data can be extracted?▼
The plugins extract physical activities, exercise routines, sleep patterns, and biometrics from the Apple Health app's database.
Products
Affiliate links coming soon. We only recommend products that match the doses and forms used in the cited research.
References
- 1.Puspitarini AD, Studiawan H. "Forensic timeline investigation of Apple Health app on iOS.." Journal of forensic sciences, 2026. PMID: 42394193 DOI: 10.1111/1556-4029.70385