Location information is saved to the iOS device via multiple channels. The iOS device tracks cell towers and Wi-Fi networks that come into close proximity with the device, as well as those to which the iOS device connects. Location information is also recovered from media files, maps, internet searches, Apple Maps, Google Maps, and third-party applications. The examiner must know the difference between locations that the user connects to versus those that were simply in close proximity to the device. However, even the latter can be helpful if we can put the device in a region when activities occurred. Make sure you look at Installed Applications and consider that browsers may even keep Google searches for locations directly inside of its database! You really need to look everywhere, which is why searching for terms like “position” and “location” in a tool that can search within all content is super helpful.

One thing that we can do is leverage what the tool detects and then dig for artifacts we know we can trust. Later in this section, we will look closely at what we can rely on and what we cannot trust.

Frequent locations/Significant Locations: This is not always consistent, and we cannot state why something is saved here versus other locations. Essentially, we do not understand Apple’s algorithm. For this data to be tracked, the user must enable the settings in Settings > Privacy > Location Services > System Services >Significant Locations. This is shown in the next slide. More information on location data and how the artifacts exist can be found on Sarah Edwards' blog: https://for585.com/518. There are tons of files that store location information available on your iOS cheat sheet.

Reference:

[1] https://for585.com/518