You
may also be able to gain insight into device location from the many available
ride sharing and transportation applications that have flooded the application
stores. While these applications seem to contain a lot of historical data, to
include details of past trips that go back in time several years as you scroll
through the user interface, locating this data in the application itself is many
times difficult.
iOS devices do make one particular database that tracks location information
available in an iTunes backup, the database.db file located at:
Private/var/mobile/Containers/Data/Application/com.ubercab.UberClient/Documents/database.db
Even though the locations listed in this file are legitimate, they appear to be
associated with search history and not necessarily always indicative of trips
the user took.
Investigation of a rooted Android device provided many more files for review, although the results were not much more fruitful than what was recovered from the iTunes backup.
There
does seem to be some historical information related to actual rides take
located in: User
details related to payment information are stored in: Approximate
last cached location: Potential
historical trip data: Consider
investigating Notifications as well as SMS or Email messages that could provide
additional insight related to trips and locations if the user has opted to send
this data via those messaging platforms.
USERDATA/data/com.ubercab/files/base-key-value-store/ShortcutsCache_CACHED_SHORTCUTS_MAP_KEY
USERDATA/data/com.ubercab/files/base-key-value-store/payments_KEY_PROFILES
USERDATA/data/com.ubercab/files/base-key-value-store/keyvaluestore-location-cache_CACHED_UBER_LOCATION
USERDATA/data/com.ubercab/files/presidio-ndk-crash/userlog