Tracking Hardware & Software via Apple Health

Apple Health has been expanding in scope for years now, What started as just tracking workouts it now has features including heart, medications, mental wellbeing, respiratory, sleep, audio levels and so much more.

Because of the Health app now correlating and ingesting so much information we can track where this information is coming from. First let's start with the file path of interest:

private/var/mobile/Library/Health/healthdb.sqlite*

If we open it in SQLite browser we see 40+ tables now. One table of interest is the "source_devices" table. Here we get entries for every hardware device that the Apple Health is pulling information from. You may think that's a lot of devices but this is also tracking software versioning so one device may have multiple entries if you are updating it (for instance iOS).

Figure 1: source_devices via healthdb.sqlite

This enables us to see when a device like an iPhone or Apple Watch got software updates and then subsequently recognized by Apple Health. This doesn't only track Apple devices though as it also tracks other third party devices such as headphones, speakers, and other Bluetooth devices.

Figure 2: example Bluetooth devices via healthdb

Here we can see I connected to a Roav (bluetooth car adapter) and Jabra headphones. We don't get software info but we do get Bluetooth MAC addresses which could come in handy as another point of evidence of connections.

A parser for these items has been added to iLEAPP.

There is plenty more items to analyze in Apple Health that I've barely scratched the surface with, hopefully more to come!