perspective: can steps and distances registered during walking and running be used as digital evidence?

The iPhone Health App automatically collects data on daily activities for health purposes. Detailed information on the number of steps taken and distances travelled is stored in a database together with timestamps with a time granularity of a couple of minutes. While such information can potentially be very valuable in a forensic investigation, one needs to have a good understanding of its reliability in order to make proper use of it.

In this study we investigate the accuracy of steps and distances registered by the Health App under a broad range of experimental conditions for an iPhone 6, iPhone 7 and iPhone 8. For five subjects, we varied carrying location of the telephone, walking distances, walking speed and compared steps and distances registered by the telephone to manually measured steps and the real distance.

The results of the experiments were similar for all three telephones. Steps registered by the iPhone Health App agree very closely to those measured manually with an averaged error of about 2%. The reliability of the registered distances, however, depends on a number of factors, including walking speed and walking style of the subject and can deviate up to 30–40% from the true value.

These results suggest that, if you take the properties of the iPhone Health App into account, digital traces from the Health App can be used for evidential purposes, for example to make a probability statement about different routes that may have been travelled in a case.

Besides traditional use such as communication, entertainment and banking, modern consumer electronics have in recent years increasingly proliferated into the field of health support (see e.g. Deep Knowledge Ventures (2018) for an overview). As a result, numerous applications are available on modern smartphones which monitor health related activities. For example, amount of daily activity can be monitored by keeping track of the number of steps taken during the day. These health related applications range between system apps, shipped with the phone by the manufacturer (e.g. Shealth on Samsung phones or Health App on iPhones) and third party apps (e.g. Runkeeper). Besides smartphone applications, dedicated wearable sensors such as Apple Watch or Fitbit are available for health support. Often, data collected by these wearables can be synchronized with smartphones or computers to get a more detailed picture of daily activities.

Although usually not specified in much detail, all these health related applications rely on data produced by sensors in the telephone or the wearable, such as accelerometers and gyroscopes to infer information on health related issues. Also, manufacturers are not very explicit about the way these sensor signals are processed, which makes it hard to independently judge the accuracy of health information derived from this sensor information.

Nevertheless, sizeable amount of processed data are stored in databases by health related apps. The information that is stored varies, but some apps are known to store detailed information with timestamps with a small time granularity. A good example of this is the Health App, which is shipped as a system App on iPhones since iOS 8. During the day, the Health App automatically collects data on number of steps taken, traveled distances and number of floors climbed which is stored in periods of a couple of minutes.

From a forensic perspective, such detailed information on (physical) user activity can, of course, be very valuable for investigative and evidential purposes. Numerous forensic applications of data from the iPhone Health App are imaginable, including the following examples:

Probability statements about scenario's or routes

If there are two or more scenarios in a case about what has happened, a probability statement can be made, for instance in the form of a likelihood ratio, about the support that traces found in the iPhone Health App give to either of the scenario's in question. Similarly, if there are several possible routes which might have been travelled in a case, a probability statement can be made about the likelihood of the traces found in the Health App under the assumption that either one of these routes was travelled.

Analysis of (physical) user activity over time

On the basis of timestamps in data stored by the Health App, one can try and make an estimate of relevant time periods in which physical activity was performed by the user, leading to information being stored by the Health App.

The fact that data from health related apps are a potential treasure trove of forensic information has not gone unnoticed in the law-enforcement community. In the Netherlands, data from the iPhone Health App has been used as evidence in a number of high profile cases. While these data is potentially a very valuable source of information in a criminal investigation, one needs, of course, to have a good understanding of its reliability in order to infer forensically correct information from it. Therefore, on a number of occasions the Netherlands Forensic Institute (NFI) has been asked to make an assessment of the accuracy of data collected by the iPhone Health App as part of its regular casework. As a spin-off of our casework, we present in this paper an in-depth analysis of the reliability of data registered by the iPhone Health App from a forensic perspective.

Our approach is to compare, under a wide range of experimental conditions, data from the iPhone Health App against independently collected data on number of steps and distances, which serve as the so-called ground truth. In the biomedical literature, a number of similar reliability studies on the accuracy of various activity trackers have appeared (e.g. Höchsmann et al., 2018; Duncan et al., 2018). The aim of these studies is to assess the applicability of activity trackers and the iPhone Health App for physical activity assessment and focus is therefore on accuracy of registered steps only.