Apple Health Forensics: The Body's Own Timeline

Apple Health is one of the most continuous records a person carries. Where messages capture moments and locations capture places, Health captures the body over time: workouts with the GPS route the device traced, heart-rate readings through the day and the activity data the phone and any paired watch logged. It runs in the background, timestamped, without the wearer curating it, which is exactly what gives it evidentiary weight.

Sherlock Forensics iPhone Analyzer parses that record into dedicated views: workouts with their mapped GPS routes, heart-rate history and activity data, alongside Fitbit GPS tracks and heart rate where a Fitbit fed the device. Each view exports and plots. Every dated Health event feeds the merged Activity Timeline, so a run, a spike in heart rate or a gap in activity reads in sequence with the messages, locations and app use around it.

The value of Health as evidence is that it is dense and involuntary. A phone records a handful of messages an hour but hundreds of Health data points, none of them curated by the wearer. That density means the record often fills gaps other artifacts leave: a quiet stretch with no messages and no app use can still carry a continuous heart-rate trace and a step count, telling an examiner the device was on a moving person even when nothing else on the phone was active.

A single location ping puts a device at a point. A workout GPS route puts it along a continuous path, minute by minute, for the length of the activity. That continuity is what makes Health routes powerful whereabouts evidence: a recorded run or ride traces exactly where the device went and when. It is hard to reconcile with a claimed account that puts the device elsewhere at that time. Sherlock plots each route on an offline map, no internet connection touched, then carries it into the report.

The honest scope is the same as every location artifact. The route records where the device was, not who was carrying it, so attribution to a person rests on corroboration: a photo taken on the route, a message sent during it, a witness. What the route settles is the device's own movement, continuously, in its own contemporaneous record.

Apple Health is one of the categories iOS includes only when a backup is encrypted, alongside the keychain and Wi-Fi passwords; it is omitted from a plaintext backup. Because Sherlock always captures an encrypted backup, Health data comes through from a logical acquisition of an unlockable device. It is equally present in a Cellebrite UFED or VeraKey full-filesystem extraction. That places Health among the accessible high-value artifacts: you do not need enterprise full-filesystem tooling to reach it, only an encrypted backup.

From an unencrypted backup, Health shows an honest empty state because Apple did not include it there, not because the tool missed it. Sherlock says so rather than implying the data was absent from the device.

Whereabouts and alibi. A workout route is a continuous location record that a claimed timeline has to fit. A run logged across town at the time a person said they were home is a hard fact to argue around.

Activity and state. Step counts, activity gaps and heart-rate patterns can corroborate or undercut an account of what a person was doing at a given time. A device recording vigorous activity or none around a key moment is evidence the examiner can lay against the rest of the record.

Personal-injury and insurance matters. Health's activity record speaks directly to claims about capability and exertion over time, from the device's own logs rather than from testimony alone.

In each case the tool's job is the same: present the recorded data and its timestamps, plot the routes, feed the timeline and leave the interpretation and attribution to the examiner and the case.

Health evidence invites two overreaches. An honest report avoids both. The first is treating device activity as a specific person's activity; the record attributes to the device and its paired sensors; who was wearing the watch is a question for corroboration. The second is vouching for what the sensors measured; a heart-rate reading is what the sensor reported, subject to the accuracy and fit of the hardware, which the tool cannot certify. Sherlock carries the values through without adjustment and reports their source, so an examiner testifies to the device's own record rather than to a physiological conclusion the tool is not entitled to draw.

Analysis is 100 percent read-only; the evidence is never modified. The court-ready HTML report carries the mapped routes and Health views, case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. GPS routes export for plotting in mapping tools alongside the rest of the location evidence.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it.

Sherlock reads Health from evidence you can lawfully acquire: an encrypted backup of a device you can unlock, an existing encrypted backup or a full-filesystem extraction. It does not unlock a locked device, does not bypass a passcode and does not reach a subject's iCloud Health sync through a provider. Health is absent from an unencrypted backup by Apple's design. Sherlock shows that honestly. Confirmed extraction formats are Cellebrite UFED and VeraKey. Different source? Contact us before purchasing and we will confirm the layout is readable.

Download the free edition, open an encrypted backup or extraction and see the workouts, routes and heart-rate history for yourself. Unlock the full record when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Significant Locations forensics · Screen Time forensics · iPhone forensics fact checks · Product page