Jared Barnhart, Heather Mahalik, and Ian Whiffin dove into researching location artifacts on iOS and Android and rating them on what you can trust based upon timestamp and location accuracy. The full webinar is available on Cellebrite’s website. https://cellebrite.com/en/episode-15-ibeg-to-dfir-location-data-on-ios-and-android-devices/. Some of these files require a jailbreak to obtain full file system access.

The Location cheat sheet for this webinar is available in your Dropbox under Day/Section 3. Some of these databases are parsed by the commercial tools, iLEAPP and APOLLO. Always make sure you verify that they are being parsed for all relevant information when your investigation involved location artifacts.

/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite

Tables of Interest:

ZRTCLLOCATIONMO

ZRTCLLOCATIONMO

ZRTVISITMO

ZRTLEARNEDLOCATIONOFINTERESTVISITMO

/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite

Table of Interest:

ZRTVEHICLEEVENTMO

/private/var/mobile/Library/Caches/com.apple.routined/Cloud-V2.sqlite

Tables of Interest:

ZRTLEARNEDVISTIMO

ZRTLEARNEDPLACEMO

ZRTMAPITEMMO

/private/var/mobile/Media/PhotoData/Photos.sqlite

Tables of Interest:

ZASSET

ZADDITIONALASSETATTRIBUTES

ZCLOUDMASTERMEDIAMETADATA

/private/var/mobile/Media/PhotoData/Caches/GraphService/CLSPublicEventCache.sqlite

/var/mobile/Media/PhotoData/Caches/GraphService/PhotosGraph/photosgraph.kgdb

Table of Interest:

EDGEVALUE