MOBILE FORENSICS

Apple Health (HealthKit) – IT forensic investigation

The Apple Health app aggregates health and activity data from various sources. Depending on the configuration, this information comes from the iPhone, an Apple Watch or compatible apps. As part of an IT forensic investigation, Health data can provide important clues for reconstructing the timeline of events.

Steps and walking distances
Heart rate
Sleep data
Training activities
Stairs and activity data
Physical characteristics
Timestamp
Synchronisation information
SQLite databases and metadata

TECHNICAL BACKGROUND

Technical Fundamentals

HealthKit serves as a central platform for storing and managing health-related data.

Information relevant to forensic investigations may include, amongst other things:

  • •Steps and walking distances
  • •Heart rate
  • •Sleep data
  • •Training activities
  • •Stairs and activity data
  • •Physical characteristics
  • •Timestamp
  • •Synchronisation information
  • •SQLite databases and metadata

The data that is actually available depends on the devices used and the features that have been enabled.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following the forensic backup, HealthKit data is analysed alongside other system and activity artefacts. Timestamps, data sources and metadata are correlated with one another in order to objectively illustrate technical relationships. All stages of the investigation are documented in a way that ensures traceability.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What activity data has been stored?
  • ✔When did certain exercises or training sessions take place?
  • ✔Which devices provided data?
  • ✔Is it possible to reconstruct the sequence of events?
  • ✔How reliable is the available data?

LIMITATIONS & CONCLUSION

What you should know

Health data depends on the sensors that are activated, the devices used and individual settings. Missing or incomplete data sets do not allow general conclusions to be drawn about a person’s actual behaviour.

Apple Health data can help to reconstruct the sequence of events and movement patterns. Its forensic analysis is always carried out in conjunction with other digital evidence.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have your Apple Health data examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What data does Apple Health store?
Depending on the configuration, this may include activity, health and training data, amongst other things.
Does the Apple Watch play a role?
Yes. A lot of health data is recorded by a paired Apple Watch.
Are there any timestamps?
Depending on the dataset, many entries contain relevant time information.
Can health data be used as evidence?
They may provide technical guidance, but must always be assessed within the overall context.
Can an expert report be drawn up?
Yes, provided that this forms part of the terms of reference for the investigation.