This database doesn’t seem to be parsed by the tools and may need to be examined manually in Hex. All files found in the apps directory should be examined to avoid missing data. You will find that BLOBs may cause issues when looking at a database, and these locations are stored in BLOBs. More to come on BLOBs in the course in Sections 4 and 5. In addition to the searched locations, turn-by-tun directions are stored in the BLOBs.

Location information and mapping can be found in several locations on the Android device. Applications use and store location information in various locations and normally can be found within the application folder. The version of the Android device affects the location information and where it is stored. The example for USERDATA/data/com.google.android.apps.maps/databases should be found on all Android devices. However, the databases may vary based on use and the one below hasn’t been seen since Android 5 but may exist. It is important that you examine all databases associated to Google Maps, not just the ones shown in the next few slides.

The main database of interest for location maps includes the da_destination_history. The table of interest is destination_history. The fields of interest in this table include:

Time = Stored in UNIX Epoch

dest_lat = Destination latitude

dest_lng = Destination longitude

dest_title = Business name, street name, point of interest

dest_address = Mapped address

For the search_history.db file in USERDATA/data/com.google.android.apps.maps, location history and suggestions based on searches and locations can be recovered. The tables of interest are history and suggestions. The fields of interest in this table include:

display query = suggested location

data1 = suggested location

Make sure you realize that suggestions are not searches typed by the user, but those provided as a suggestion by the device.