Timothy R. Primrose, Mobile Forensic Analyst

Apple’s health application monitors and documents a user’s day-to-day activity in detail. Some data is collected by the iPhone, while other data can be collected from a synced Apple Watch or input directly by the user. These datatypes include steps, body measurements, menstrual cycle tracking, hearing, heart rate, mindfulness, mobility, nutrition, respiratory, sleep, vitals, and other user input data such as blood glucose and inhaler usage.

From a forensic standpoint, you might not think that health data can help decipher the events that unfolded in a given situation; however, some of these datatypes can be utilized creatively to assist in bizarre scenarios. The hearing datatype proved useful in one of our recent cases.

The purpose of the hearing category in Apple’s health application is to monitor headphone audio levels to ensure that the user’s ears are exposed to a healthy level of sound decibels to prevent hearing issues caused by extended exposure to loud audio. Users can view their listening history that Apple has recorded within the health application. In the image below you can see the audio levels that a user’s headphones were set to, the time frame in which they used their headphones, the media source of the audio, and even the type of headphones utilized.

How was hearing data useful in a forensic investigation? A vehicle operator was traveling at the posted speed limit of 45 mph when a woman suddenly stepped out in front of him. He did not have enough time to stop, and unfortunately the woman did not survive after being struck by the vehicle. The woman had headphones in and was reportedly looking at her cellphone when she stepped into oncoming traffic. Data extracted from her phone showed that the pedestrian had the YouTube application open prior to and at the time of the incident. Audio level data recorded by Apple’s health application showed that the user’s device was outputting an audio level of 150 decibels. This volume level would have prevented the woman from hearing any approaching vehicles or the buzz of traffic. Seeing that the YouTube application was open and not an application such as Pandora or Spotify aids the vehicle operator’s story that the pedestrian was looking at her phone and distracted from where she was walking.

Health data can be utilized for more than what Apple intended. Even if you do not plan on using this information for a case, check it out for yourself and make sure your audio levels are safe.

Timothy R. Primrose, Mobile Forensic Analyst with DJS Associates, Inc., can be reached via email at experts@forensicDJS.com or via phone at 215-659-2010.

Categories: Mobile Forensics | Timothy R. Primrose

Tags: Audio Data | Cellphone | Smartphone