Health for iOS is amazing.
It's very easy to examine.
Sarah Edwards and I spent a drastic amount
of time researching this a few years ago, to the point where
I was even dragging bodies around on tarps, trying
to escalate my heart rate to show what
it looked like if I killed someone and dragged them
up a hill.
It was a nightmare.
You can replicate all kinds of things with quick testing.
So we wanted to know our steps in meters or in feet.
What does it look like if you climb stairs?
Can you trick climbing stairs?
I can honestly tell you, I have tried marching in place.
I have not been able to trick walking up stairs.
There are two primary databases of interest,
healthdb.sqlite and healthdb_secure.sqlite.
Healthdb.sqlite is going to track activity sharing.
So when you're sharing activity with your friends,
your settings, your sync, and more.
healthdb_secure is all of your achievements,
all of your workouts, all of your friends, and more.
Contacts2.dat are all of your fitness friends.
It is going to track passively, so periods
of active and non-active.
It will know how long you slept.
I take my watch off every single night when I go to bed,
so you should be able to get a good pattern of life
from me saying, seems like Heather
goes to bed around 11:00 PM.
That's when her watch comes off.
Seems like she wakes up around 6:00 AM.
That's when her watch goes on.
If you notice that I am consistently active, and then
suddenly, I have huge periods of inactivity, why?
Some of the research that initially drove me
into diving deep into this.
I was asked by a detective in Florida--
they believed that this man shot his wife in the head
and pretended to be her for three days using her iPhone.
So he would pick up the device, pace in a circle--
so say, 18 steps, update her Facebook profile.
He would then pick up her device,
text her parents or a friend, and put it back down.
And it was always almost, like, 25 steps or less-- just pacing.
Their question was, when a person dies,
does the watch send a notification to the iPhone?
Can you tell if the pulse stopped
or if the device battery died?
The issue is, at that, time we didn't have a jailbreak,
so we couldn't get a full file system extraction.
So we tried to do the best we can with these periods of time
and all this testing.
But when you look at this stuff--
here, you can see, this is what my device looked like.
January 23, I was doing downhill skiing.
It tells you where I was, how many calories, the heart rate,
and even shows you the path of where I was skiing.
You can see the spikes in my heart rate.
When we look on June 8, I have an outdoor walk.
We can see the distance.
We see the calories.
We see my heart rate, average pace.
We can see that.
If you look at the video and it's available--
Sarah and I did this at the DFIR summit.
And the link is in the notes.
It's also in your Dropbox.
If you look at my body dragging, when
I was trying to drag the body, it's
a huge spike in my heart rate.
So if you see consistency and then you see a huge spike
and it's not a workout time, that's interesting.
We were trying to test, at Cellebrite, what
does it look like?
So trying to replicate an attack.
That's difficult. So essentially, you're
doing no activity, but your heart rate spikes out of fear.
For the longest time, I was unsure
how we would get this data.
I then went horseback riding with my friend.
And I will not forget, I was sitting in the water--
I told her, oh, getting in the water on a horse is very easy.
They love it.
Her horse did not love it, and she was terrified.
So I'm sitting in the water on my horse
watching my friend get run away with.
And I remember thinking, I finally have the data.
I'm sitting still, but my heart was
through the roof, because I honestly
thought she was going to get bucked off this horse
and get hurt.
Sometimes, the scenarios come to you
in random situations like that.
Look at your health data.
If you do an encrypted iTunes backup,
you will get access to this data.
Also, library caches, cash encrypted C,
will have some artifacts here.
But make sure you locate something else to associate it,
because those may not be as valid.
And notice, it's also in italics.