Health data is one of the hottest iOS topics, and I have spent a ton of time researching it to help former students put a person behind a crime. How? The two databases listed here track so much about the user. More than just a workout completed.

� �� /Library/Health/

� �� healthdb.sqlite: Activity Sharing, Settings, Sync, etc.

� �� healthdb_secure.sqlite: Achievements, Workouts, Friends, etc.

� �� /Library/Health/ActivitySharing/Contacts2.dat: friends you share workouts with

� �� /private/var/root/Library/Caches/locationd/cache_encryptedC.db: Steps, distance, floors climbed, timestamps and more (requires a jailbreak).

� �� /Library/Caches/locationd/cache_encryptedC.db

Sarah Edwards and I presented #DFIRFIT or Bust at the DFIR Summit in Austin, TX, in 2018. This talk drummed up a lot of interest. Our talk was recorded and is available on the SANS YouTube channel. Since then, I have done several talks on Health and Making a Murderer: Health Edition. These presentations can be found on smarterforensics.com. Health data provides so much information and can help solve many different crimes. Even insurance companies are using data to prove that someone was healthy and active while collecting workers compensation from the workplace. Think about it�. It�s scary!

Sarah Edwards released APOLLO, which will parse some of the health data. Most commercial tools parse health as well.

Reference:

https://github.com/mac4n6/Apollo