# HealthProbe - Risks, Limitations & Forensic Capabilities

**Version:** 1.5
**Last Updated:** 2026-05-23

## 1. Product Boundary

HealthProbe is a local Health DB Time Machine. It preserves selected HealthKit-accessible observations on one device, explains how those observations differ over time, and exports scoped evidence.

HealthProbe is not:
- a proof engine for Apple Health bugs
- a cross-device HealthKit database comparator
- a CloudKit/iCloud sync product
- a guarantee that HealthKit currently exposes all historical detail
- a replacement for Apple Health or Apple exports
- a disaster-recovery tool that mutates HealthKit or patches iOS backups

## 2. Known Limitations

### 2.1 HealthKit Framework Constraints

| Gap | Why | Mitigation |
|-----|-----|------------|
| **No stable raw database contract** | HealthKit exposes API objects, not a forensic SQLite dump | Store what the API exposes at each observation |
| **Representation changes** | Older high-frequency samples can become intervalized, thinned, or aggregated | Compare records and aggregates; label consolidation separately from loss |
| **Modifications without explicit change events** | HealthKit primarily reports added/deleted objects | Use observation diffs and fingerprints |
| **Missed background windows** | iOS can delay or skip background work | Manual capture, app-launch capture, observation timestamps |
| **Private Health types** | Some data is not available to third-party apps | Document inaccessible gaps |
| **Cross-device divergence** | Apple devices may expose different local HealthKit states | Compare only within the current device timeline |

### 2.2 Interpretation Limits

A disappeared fingerprint does not automatically mean permanent user data loss. It may mean:
- Apple Health consolidated older records
- a permission changed
- a source app rewrote or re-imported data
- HealthKit query timing changed
- the user deleted or edited data
- the app missed one or more background windows

HealthProbe should present evidence and uncertainty. Count-only drops must not be shown as critical alerts without supporting detail.

### 2.3 Data Retention Constraints

HealthProbe can only preserve detail after it has observed it. It cannot reconstruct records that were already aggregated or unavailable before installation.

The local archive can preserve selected details beyond what future HealthKit queries or Apple exports expose, but only for data types the user has enabled and granted permission to read.

## 3. Privacy & Security Risks

| Risk | Impact | Mitigation |
|------|--------|------------|
| **Raw health data exposure** | Critical | Local-only archive; explicit user exports only |
| **Device/source re-identification** | High | Hash or redact identifiers where possible; avoid personal data in logs/docs/tests |
| **Behavior inference from timestamps** | Medium | No automatic cloud sync; scoped exports |
| **Lost archive on uninstall/device loss** | High | Encourage explicit exports for important evidence |
| **Local device compromise** | High | Rely on iOS data protection; no network copy by default |

## 4. Questions HealthProbe Can Answer

### Q1: "What did my Health data look like at this observation date?"

Method:
1. Select an observation.
2. Load archived records visible at that observation.
3. Show per-type counts, date ranges, aggregates, source summaries, and record tables.
4. Export the selected view if needed.

### Q2: "What changed between these two observations?"

Method:
1. Compare adjacent or selected observations from the same local device timeline.
2. Group records as appeared, disappeared, retained, or representation-changed.
3. Compare aggregate totals and coverage windows.
4. Label likely consolidation when record detail changed but aggregate meaning is preserved.

### Q3: "Can I export details that are no longer available from current HealthKit?"

Method:
1. Query the local archive by observation date and sample type.
2. Select the historical record set.
3. Export JSON/CSV plus manifest hashes and observation metadata.

### Q4: "When did this record first become visible to HealthProbe?"

Method:
1. Search the archive observation history for the record fingerprint.
2. Report first-seen, last-seen, last-verified, and disappeared-at timestamps.
3. Include context events without claiming causality.

### Q5: "Is a change probably consolidation rather than loss?"

Method:
1. Compare missing old records with newer interval or aggregate records over the same time window.
2. Check value sums, date coverage, and source metadata.
3. Report "consolidation likely" only when aggregate evidence supports it; otherwise report "uncertain."

## 5. Export Formats

### JSON Diff Report

```json
{
  "report_id": "DIFF_SYNTHETIC_001",
  "exported_at": "2026-05-23T12:00:00Z",
  "from_observation": "2026-04-23T12:00:00Z",
  "to_observation": "2026-05-23T12:00:00Z",
  "sample_type": "HKQuantityTypeIdentifierStepCount",
  "summary": {
    "appeared": 12,
    "disappeared": 84,
    "representation_changed": 6,
    "aggregate_delta_percent": 0.1,
    "label": "consolidation_likely"
  },
  "manifest_hash": "synthetic-example-hash"
}
```

### CSV Point-In-Time Table

```csv
observation_at,type,start_date,end_date,value,unit,source_hash,record_hash
2026-05-23T12:00:00Z,step_count,2026-01-01T00:00:00Z,2026-01-01T00:10:00Z,42,count,source_hash_example,record_hash_example
```

### Markdown Summary

```markdown
# HealthProbe Observation Diff

Observation A: 2026-04-23 12:00 UTC
Observation B: 2026-05-23 12:00 UTC

## Summary
- Appeared records: 12
- Disappeared records: 84
- Representation changes: 6
- Aggregate delta: 0.1%
- Interpretation: consolidation likely

## Notes
This report describes local HealthKit observations from one device.
It does not infer cause or compare against another device as a source of truth.
```

## 6. Forensic Techniques Enabled

**Timeline reconstruction:** Walk observation history and rebuild visible records for a selected date.

**Representation-change analysis:** Compare count, intervals, value sums, value max, and coverage windows to distinguish detail thinning from meaningful aggregate drift.

**Archive-backed export:** Export data from HealthProbe's local archive even when a current HealthKit query no longer exposes the same record-level detail.

**Context correlation:** Place local changes near iOS/app/permission/iCloud-state events while avoiding causal claims.

## 7. Recovery-Compatible Export Boundary

External tools may use HealthProbe exports to:
- inspect what HealthProbe observed at a point in time;
- compare exported records with backup/XML/database evidence;
- build salvage workflows outside the app;
- re-publish values into another system with explicit user consent.

HealthProbe exports should therefore preserve:
- values, dates, units, and type identifiers;
- stable hashes and payload version hashes;
- source/provenance hashes where available;
- relationships where available and in scope;
- observation history and manifest/item hashes.

HealthProbe exports cannot guarantee:
- original Apple/private database primary keys;
- original HealthKit metadata that was never exposed to the app;
- proof that a disappeared record was deleted by Apple;
- lossless re-publication into HealthKit with original provenance.

The iOS app remains read-only. Any backup transplant, HealthKit re-publication, or disaster-recovery procedure is external tooling, not an in-app feature.

## 8. Recommended Usage

### Individual Users

1. Enable the data types that matter most.
2. Let HealthProbe build an initial archive.
3. Capture manually before/after OS updates, restores, migrations, or major app changes.
4. Use the timeline to inspect old observations.
5. Export selected views when a detail set matters.

### Researchers And Support

1. Work from scoped exports, not raw device databases.
2. Treat HealthProbe evidence as local observation history.
3. Avoid claiming root cause without additional Apple/system evidence.
4. Prefer aggregate-neutral language: changed, appeared, disappeared, consolidated, uncertain.

## 9. Future Enhancements

- richer point-in-time query tools
- improved consolidation heuristics
- archive integrity audits and repair workflows
- optional encrypted archive copy chosen by the user
- macOS analysis of explicit HealthProbe exports
- recovery-compatible archive/export manifests that external tools can use as input, without adding restore or re-publication features to the app

## 10. Troubleshooting

| Issue | Cause | Fix |
|-------|-------|-----|
| **No recent observations** | Background refresh disabled or app not opened | Open app and run manual capture |
| **Some types missing** | HealthKit permission not granted or type unavailable | Review permissions and selected types |
| **Large count drop shown** | Possible consolidation or query/permission change | Inspect diff and aggregate evidence before interpreting |
| **Old detail unavailable** | HealthProbe did not observe it before aggregation | Only future observations can be preserved |
| **Export too large** | High-frequency type selected over long interval | Narrow date/type filter |

## 11. References

- Apple HealthKit Framework: https://developer.apple.com/documentation/healthkit/
- HKAnchoredObjectQuery: https://developer.apple.com/documentation/healthkit/hkanchoredobjectquery
- Core Data: https://developer.apple.com/documentation/coredata
- DearApple Issue #001: historical context for reported Apple Health data anomalies

---

*HealthProbe - A local time machine for HealthKit-accessible data.*
