Page 1
IOSHEALTH, FITNESS & MOTION · A GUIDE FOR UK LAWYERS iOS Health, Fitness and Motion Data The Quiet Witness in a Pocket: Steps, Sleep and Movement, and the Care Their Reading Demands COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM SPECIAL-CATEGORY DATA HANDLING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a witness people forget to silence 03 What iOS health, fitness and motion data records 04 Where it lives and how it is recovered 05 Indicative not clinical: interpreting with care 06 Special-category data and attribution 07 Deployment: corroborating or contradicting an account 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary low-level motion, a quiet witness that can corroborate or contradict an account of activity and movement, but health data is special-category, indicative not clinical, and must be attributed to a person and read with care.
§ 02 · FIRST PRINCIPLES The problem in plain English: a witness people forget to silence
§ 03 · WHATITRECORDS What iOS health, fitness and motion data records
Page 2
§ 04 · WHEREITLIVES Where it lives and how it is recovered
§ 05 · INDICATIVENOTCLINICAL Indicative not clinical: interpreting with care
§ 06 · SPECIAL - CATEGORYANDATTRIBUTION Special-category data and attribution
§ 07 · DEPLOYMENT Deployment: corroborating or contradicting an account
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE APPLE ENCRYPTED MAC / LOCATION DATA PHONE SYSTEM / HEALTH DB APP DATA PAIRED ICLOUD / PAIRED WATCH BACKUP IPAD
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESTEPCOUNTTHATANSWEREDTHEINJURYCLAIM EXAMPLE2 · THEMOTIONSTATETHATPLACEDTHEJOURNEY EXAMPLE3 · THESENSITIVEDATAHANDLEDPROPORTIONATELY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAHEA LT HANDMOTIONANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The health and motion checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can phone health data really be used as evidence? What does "indicative not clinical" mean? Why is health data treated differently under data protection? Can it show whether someone was really injured or inactive? Does the data prove the phone's owner did the activity? Should we just ask for all their health data?
§ 14 · REFERENCE Glossary Sources and authoritative references 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Health Fitness And Motion Data, Computer Forensics Lab, https://e-discovery.uk/library/ios-health-fitness-and-motion-data/pdf.