GMDSOFT Tech Letter Vol20.Health App Data Analysis

From iOS 8 and later versions, Apple has provided a built-in Health app that automatically tracks and stores a wide range of physical activities, including step count, distance traveled, heart rate, flights climbed, and workout records. Health app data is aggregated across all devices linked to the same Apple Account, including iPhone and Apple Watch. The physical activity and health data recorded in the Health app can serve as evidence to verify subject statements and reconstruct behavioral timelines during an investigation.

This article aims to introduce Apple’s Health app and the available information in the app. The findings are based on data extracted from iOS 26 device and watchOS 26 via MD-NEXT v2.2.13 and analyzed via MD-RED v4.0.10.

Table of Contents

• iOS Health App Overview
  • Types of Recorded Health Data
  • Data Recording Method
  • Health Data Sharing
• Available Information
  • Device Information & Data Entry Method
  • User Profile & Health Records
  • Shared Health Data from Other Users
• Summary

---

1.iOS Health App Overview

1.1. Types of Recorded Health Data

Data from all devices connected to the same Apple Account is aggregated in the Health app. When an Apple Watch is paired with an iPhone, step count and distance data are automatically recorded in the iOS Health app, without additional configuration. Tap the    icon in the bottom right corner of the app to see the categories of data that can be recorded in the Health app. For more details, refer to https://support.apple.com/guide/iphone/view-your-health-data-iphe3d379c32/26/ios/26

The table below summarizes the key data that may be recorded in iPhone and Apple Watch, and how they serve during investigation.

Category	Key Data Examples	Data on iPhone	Data on Apple Watch	Investigative Application
Activity	Steps, distance traveled, flights climbed	O	O	Verify movement during a specific timeframe; estimate whether stairs were used indoors
Heart	Heart rate, HRV, ECG	–	O	Estimate physical exertion or stress from sudden heart rate spike; identify abnormal physiological responses
Respiratory	Respiratory rate	–	O	Reference for sleep state and physiological responses
Sleep	Sleep duration	O (based on schedule)	O	Verify whether the subject was actually asleep during the timeframe in question
Mobility	Gait stability, walking speed	O	O	Cross-check claims of physical injury
Hearing	Environmental noise exposure	–	O	Indirectly infer surrounding environment (e.g., high-noise locations)
Cycle Tracking	Menstrual cycle, ovulation records	O	O	Supplementary reference for statements regarding physical condition

Data Recording Method

Health app data can be collected automatically through the sensors built into iPhone and Apple Watch, or input manually by the user. To manually input the data, follow the steps below.

1. Open the Health app and tap Steps.

2. Then tap the icon to manually input the data.
3. When finished, tap    icon to save.

Health Data Sharing

The health data sharing feature has been available since iOS 15 and watchOS 8. Sharing is limited to users who have added each other as contacts, and shared data is continuously synchronized.

Follow the steps below to share the health data. For more details, refer to the Apple support page https://support.apple.com/guide/iphone/view-your-health-data-iphe3d379c32/26/ios/26

1.In the Health app, go to the ‘Sharing’ tab.

2.Tap [Share with Someone].

3.Search for and select a person from the contacts list.

4.Select the health data categories to share, then tap [Share].

2.Available Information

2.1. Device Information & Data Entry Method

The healthdb.sqlite contains the device information, initial Health app setup timestamp, and manual and automatic data entry flag. Any manually input records may suggest potential data manipulation.

Table	Available Information
sources	Device name
source_devices	Model name OS version Initial Health app pairing timestamp Value indicating whether data was input manually or automatically

2.2 User Profile & Health Records

The healthdb_secure.sqlite file contains the user’s personal information, the start and end timestamps of health data recording, health data entries, and location records.

Table	Available Information
samples	User name, gender, date of birth, and other user information Data type Recording start/end timestamps
quantity_samples	Health data value

2.3 Shared Health Data from Other Users

Health data shared by another user is stored in /private/var/mobile/Library/Health/Profiles/{SharedAccoundInternalID}/.

The healthdb.sqlite and healthdb_secure.sqlite files at this path follow the same structure as the primary Health database. Records of health data sharing requests are stored in /private/var/mobile/Library/Health/Client/HealthApp.sqlite.

Path	File	Available Information
/private/var/mobile/Library/Health/Profiles/{Shared Account Internal ID}/	healthdb.sqlite healthdb_secure.sqlite	Health data shared by other users
/private/var/mobile/Library/Health/Client/	HealthApp.sqlite	Account information of the sharing requester and the target recipient Timestamp of the sharing request and acceptance Current health data sharing status

 

3.Summary