As previously discussed, location artifacts are everywhere on iOS devices. A sample list is provided in this slide. We recommend use of your tools to triage locations and gain an idea on where the user was when an event or crime occurred. From there, refer to your cheat sheet to dive into the paths that track user locations. Do not forget to leverage the Location Cheat Sheet available in Day/Section 3 of your course Dropbox.

Here is the sample list of other places to consider finding location data. This does not even scratch the surface of all of the location artifacts that will exist on iOS devices when we think of third-party application data. Think of everything you learned up until this point. Even concepts from Android apply here. Go forth and enjoy the hunt.

  •  /Library/Preferences/com.apple.weather.plist

  •  /Library/Maps/Bookmarks.plist

  •  /com.apple.Maps/Maps

  •  /com.apple.Maps.plist

  •  /group.com.apple.Maps.plist

  •  /private/var/mobile/Library/Caches/com.apple.findmy.fmipcore/Devices.data

  •  /private/var/mobile/Library/Caches/com.apple.findmy.fmipcore/Items.data

  •  iCloud and Google cloud

Make sure you verify locations as the device may appear
to be somewhere it wasn’t. A great blog on the accuracy
of locations by Ian Whiffin can be found at:
https://doubleblak.com/blogPosts.php?id=14.