Added iOS Health SQLite (healthdb_secure.sqlite) plugin by annisadp · Pull Request #5027 · log2timeline/plaso

annisadp · 2026-01-18T08:11:07Z

The parser created consists of achievements, all watch sleep latest, all watch sleep, headphone audio levels, heart rate, height, resting heart rate, steps, source devices latest, source devices, watch by sleep period latest, watch by sleep period, watch worn data, weight, workouts latest, workouts and wrist temperature

One line description of pull request

Adds 17 new SQLite plugins for extracting iOS Health artifacts (iOS 13.3.1, iOS 13.4.1, iOS 15, iOS 16, iOS 17). Includes unit tests, formatters, ios.yaml and SQLite database

Description:

Plugins including:
plaso/plaso/parsers/sqlite plugins/ios_health_achievements.py
plaso/plaso/parsers/sqlite plugins/ios_health_all_watch_sleep_latest.py
plaso/plaso/parsers/sqlite plugins/ios_health_all_watch_sleep.py
plaso/plaso/parsers/sqlite plugins/ios_health_headphone_audio_levels.py
plaso/plaso/parsers/sqlite plugins/ios_health_heart_rate.py
plaso/plaso/parsers/sqlite plugins/ios_health_height.py
plaso/plaso/parsers/sqlite plugins/ios_health_resting_heart_rate.py
plaso/plaso/parsers/sqlite plugins/ios_health_steps.py
plaso/plaso/parsers/sqlite plugins/ios_health_source_devices_latest.py
plaso/plaso/parsers/sqlite plugins/ios_health_source_devices.py
plaso/plaso/parsers/sqlite plugins/ios_health_watch_by_sleep_period_latest.py
plaso/plaso/parsers/sqlite plugins/ios_health_watch_by_sleep_period.py
plaso/plaso/parsers/sqlite plugins/ios_health_watch_worn.py
plaso/plaso/parsers/sqlite plugins/ios_health_weight.py
plaso/plaso/parsers/sqlite plugins/ios_health_workout_latest.py
plaso/plaso/parsers/sqlite plugins/ios_health_workouts.py
plaso/plaso/parsers/sqlite plugins/ios_health_wrist_temperature.py

Unit Test including:
plaso/ test /parsers/sqlite plugins/ios_health_achievements.py
plaso/ test /parsers/sqlite plugins/ios_health_all_watch_sleep_latest.py
plaso/ test /parsers/sqlite plugins/ios_health_all_watch_sleep.py
plaso/ test /parsers/sqlite plugins/ios_health_headphone_audio_levels.py
plaso/ test /parsers/sqlite plugins/ios_health_heart_rate.py
plaso/ test /parsers/sqlite plugins/ios_health_height.py
plaso/ test /parsers/sqlite plugins/ios_health_resting_heart_rate.py
plaso/ test /parsers/sqlite plugins/ios_health_steps.py
plaso/ test /parsers/sqlite plugins/ios_health_source_devices_latest.py
plaso/ test /parsers/sqlite plugins/ios_health_source_devices.py
plaso/ test /parsers/sqlite plugins/ios_health_watch_by_sleep_period_latest.py
plaso/ test /parsers/sqlite plugins/ios_health_ watch_by_sleep_period.py
plaso/ test /parsers/sqlite plugins/ios_health_watch_worn.py
plaso/ test /parsers/sqlite plugins/ios_health_weight.py
plaso/ test /parsers/sqlite plugins/ios_health_workout_latest.py
plaso/ test /parsers/sqlite plugins/ios_health_workouts.py
plaso/ test /parsers/sqlite plugins/ios_health_wrist_temperature.py

SQLite database froom Digital Corpora places on plaso/test_data/:
healthdb_secure_iOS_13_3_1.sqlite
healthdb_secure_iOS_13_4_1.sqlite
healthdb_secure_iOS_15.sqlite
healthdb_secure_iOS_16.sqlite
healthdb_secure_iOS_17.sqlite

Notes:

All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

No new new dependencies are required or l2tdevtools has been updated.
Test data has a Plaso compatible license. If the test data was not authored by you (the contributor), make sure to mention its orginal source in ACKNOWLEDGEMENTS.
Reviewer assigned.
Automated checks (GitHub Actions, AppVeyor) pass.

joachimmetz · 2026-02-07T09:13:06Z

Thanks for the changes, unfortunately "Digital Corpora" is public domain. For context see https://opensource.org/blog/public-domain-is-not-open-source

joachimmetz · 2026-05-08T05:34:32Z

@annisadp can you rebase this PR with current HEAD and replace the test files with ones that are compatible with the Plaso license?

joachimmetz

pending questions/comments

joachimmetz · 2026-05-12T04:01:30Z

rebased with HEAD

joachimmetz · 2026-05-12T04:09:35Z

Looked into it a bit closer, we likely can use the test files, but they require a mention in the acknowledgement

joachimmetz · 2026-05-12T04:13:21Z

+    """Tests the Process function on a healthdb_secure.sqlite file."""
+    plugin = ios_health_all_watch_sleep.IOSHealthAllWatchSleepPlugin()
+    storage_writer = self._ParseDatabaseFileWithPlugin(
+        ['healthdb_secure.sqlite'], plugin)


this file does not exist, I assume this is healthdb_secure_iOS_13_3_1.sqlite ?

joachimmetz · 2026-05-12T04:23:05Z

+from plaso.parsers.sqlite_plugins import ios_health_watch_by_sleep_period_latest
+from plaso.parsers.sqlite_plugins import ios_health_watch_by_sleep_period
+from plaso.parsers.sqlite_plugins import ios_health_watch_worn_data
+from plaso.parsers.sqlite_plugins import ios_health_workout_latest


s missing, should be ios_health_workouts_latest

joachimmetz · 2026-05-12T04:32:38Z

+
+if __name__ == '__main__':
+  unittest.main()
+


trailing whitespace

joachimmetz · 2026-05-12T05:09:35Z

Given these appear to be different plugins for the same database, they should be merged into 1 plugin that creates different events

codecov · 2026-05-12T07:29:13Z

Codecov Report

❌ Patch coverage is 87.84810% with 48 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.18%. Comparing base (2738b78) to head (a132abc).
⚠️ Report is 33 commits behind head on main.

Files with missing lines	Patch %	Lines
...rsers/sqlite_plugins/ios_health_workouts_latest.py	83.45%	22 Missing ⚠️
...plugins/ios_health_watch_by_sleep_period_latest.py	87.36%	12 Missing ⚠️
...sqlite_plugins/ios_health_watch_by_sleep_period.py	82.60%	8 Missing ⚠️
...rsers/sqlite_plugins/ios_health_watch_worn_data.py	90.24%	4 Missing ⚠️
...qlite_plugins/ios_health_all_watch_sleep_latest.py	93.93%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5027      +/-   ##
==========================================
+ Coverage   85.16%   85.18%   +0.01%     
==========================================
  Files         456      462       +6     
  Lines       40682    41073     +391     
==========================================
+ Hits        34646    34986     +340     
- Misses       6036     6087      +51

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

joachimmetz · 2026-07-07T05:47:46Z

+    QUERIES = [
+        (
+            (
+                "WITH surface_temp AS (SELECT mv.object_id, mv.numerical_value "


both surface_temp and alg_ver return NULL values, is this query WAI?

joachimmetz · 2026-07-07T06:35:31Z

+            return None
+        text = str(value).replace("\xa0", " ").strip()
+        try:
+            fixed = text.encode("latin-1", errors="ignore").decode(


this is not transparant to the user and therefore debatable if forensically sound.

also see https://github.com/log2timeline/l2tdocs/blob/main/process/Style-guide.md#data-format-and-encoding-issue-handling

joachimmetz · 2026-07-07T07:08:25Z

+        seconds = total % 60
+        return f"{hours:02d}:{minutes:02d}:{seconds:02d}"
+
+    def _DistanceToKmMiles(self, total_distance):


Why not add this as an output formatter?

joachimmetz · 2026-07-07T07:27:12Z

+
+        if duration_seconds is not None:
+            try:
+                event_data.duration_in_minutes = float(duration_seconds) / 60.0


calculated but not used?

joachimmetz · 2026-07-07T09:57:54Z

+    QUERIES = [
+        (
+            (
+                "WITH TimeData AS (SELECT s.start_date AS start_cocoa, s.end_date AS "


Why not do this in an analysis plugin?

joachimmetz · 2026-07-07T10:02:19Z

+        except (TypeError, ValueError):
+            code = None
+
+        if code not in (2, 3, 4, 5):


this is not transparent to the user or the reviewer. What is the reason for skipping these codes?

joachimmetz · 2026-07-07T10:19:52Z

Heads up I'm splitting this PR, breaking out #5149 what has been refactored so far.

There is more work needed on the remainder in this PR

The parser created consists of achievements, all watch sleep, headphone audio levels, heart rate, height, resting heart rate, steps, source devices, all watch by sleep period, watch worn, weight, workouts and wrist temperature

joachimmetz · 2026-07-07T13:12:55Z

@@ -0,0 +1,129 @@
+"""SQLite parser plugin for iOS Health - All Watch Sleep Data (iOS 17)."""


Note to self, this is basically the same as ios_health._ParseAllWatchSleepSample with the exception of filtering on several category values

joachimmetz · 2026-07-07T13:16:39Z

+        self.manufacturer = None
+        self.model = None
+        self.software = None
+        self.sync_identity = None


Note to self: Only major difference to IOSHealthSourceDevicesEventData is sync_identity, which does not seem to be in previous versions of the database schema

joachimmetz · 2026-07-07T13:47:17Z

+
+    QUERIES = [
+        (
+            (


given this also uses sample type 63 as input should this be an analysis plugin?

joachimmetz self-assigned this Feb 7, 2026

joachimmetz self-requested a review February 7, 2026 09:10

joachimmetz added the pending reporter input Issue is pending input from the reporter label Feb 7, 2026

joachimmetz requested changes May 8, 2026

View reviewed changes

joachimmetz force-pushed the main branch from b4dae64 to 23edbe6 Compare May 12, 2026 04:01

joachimmetz removed the pending reporter input Issue is pending input from the reporter label May 12, 2026

joachimmetz reviewed May 12, 2026

View reviewed changes

Comment thread plaso/parsers/sqlite_plugins/__init__.py

joachimmetz reviewed May 12, 2026

View reviewed changes

joachimmetz added this to the Parking/Temporary release milestone May 12, 2026

joachimmetz changed the title ~~Add iOS Health plugins~~ Added iOS Health SQLite (healthdb_secure.sqlite) plugin May 12, 2026

joachimmetz force-pushed the main branch 2 times, most recently from 0082ef0 to d62240f Compare May 17, 2026 10:27

joachimmetz force-pushed the main branch from d62240f to 938e4ac Compare May 26, 2026 08:25

joachimmetz force-pushed the main branch from 938e4ac to 4b0d53f Compare July 7, 2026 04:30

joachimmetz reviewed Jul 7, 2026

View reviewed changes

joachimmetz force-pushed the main branch from 4b0d53f to c804349 Compare July 7, 2026 06:47

joachimmetz reviewed Jul 7, 2026

View reviewed changes

joachimmetz force-pushed the main branch from 253b65a to 7d55160 Compare July 7, 2026 10:06

joachimmetz force-pushed the main branch from 7d55160 to de4d978 Compare July 7, 2026 12:02

annisadp and others added 2 commits July 7, 2026 14:22

Add iOS Health plugins

f9e61d8

The parser created consists of achievements, all watch sleep, headphone audio levels, heart rate, height, resting heart rate, steps, source devices, all watch by sleep period, watch worn, weight, workouts and wrist temperature

Clean up and changes after rebase

4472e74

joachimmetz force-pushed the main branch from de4d978 to 4472e74 Compare July 7, 2026 12:32

joachimmetz reviewed Jul 7, 2026

View reviewed changes

Clean up

a132abc

joachimmetz added pending reporter input Issue is pending input from the reporter needs work PR is incomplete and needs work labels Jul 7, 2026

		@@ -0,0 +1,129 @@
		"""SQLite parser plugin for iOS Health - All Watch Sleep Data (iOS 17)."""

Uh oh!

Conversation

annisadp commented Jan 18, 2026 • edited by joachimmetz Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

One line description of pull request

Description:

Notes:

Checklist:

Uh oh!

joachimmetz commented Feb 7, 2026

Uh oh!

joachimmetz commented May 8, 2026

Uh oh!

joachimmetz left a comment

Choose a reason for hiding this comment

Uh oh!

joachimmetz commented May 12, 2026

Uh oh!

joachimmetz commented May 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joachimmetz commented May 12, 2026

Uh oh!

codecov Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joachimmetz commented Jul 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joachimmetz Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

annisadp commented Jan 18, 2026 •

edited by joachimmetz

Loading

codecov Bot commented May 12, 2026 •

edited

Loading

joachimmetz Jul 7, 2026 •

edited

Loading