Here we are looking at the Journal.sqlite, which stores the journal entries for the Day One application. The database appears to look normal, but if you look closely, you will see a binary plist and zlocation column. This binary plist contains all of the “thoughts” your phone had when it asked if you wanted to include your location information. In the screenshot above, we can see the binary plist from the zlocation in Hex. Notice that we see time zone, creation date, UUID, latitude, longitude, Place Name (home address for this user), and more! Even the weather is documented even though I said “no” to including location artifacts.

This only happened because location services was enabled on the device. If location services for the device was not enabled, this would not have happened, as the user would have to turn on the settings.

Screen Shot 2016-02-26 at 4.19.21 PM.png