Greetings,
I am relatively new to mobile forensics, and I am currently doing some testing with AccessData's Mobile Phone Examiner Plus (MPE+).I am interested in finding location information from my test a GSM Samsung Galaxy S III (SCH-R30C running android 4.3). The test phone had previously been factory reset and I personally brought phone around the area to connect it to open Wi-Fi hotspots. I connected to 5 Wi-Fi networks total. During my little trip around town I had GPS enabled on the phone and all location services enabled.
After my little trip I used MPE+ to perform a physical extraction on the phone. Using MPE+ to browse through the extracted data I was able to locate the "wpa_supplicant.conf" file. This file had listed the 5 networks that I connected to on my little trip.
This is where my trouble starts. After locating the Wi-Fi networks I had connected I shifted my focus to finding other location artifacts on the test phone. After conducting extensive research the consensus was that the
So next I examined physically extracted data from a Droid 3. This Droid 3 was my personal phone that I had been using for over 2 years so I was confident I would find location information on there. Well it turns out, after browsing to the expected location (data/com.google.android.locations/files) of the files, that they are not there. This really puzzled me as I know the phone has generated a mass amount of location information over the few years I had it.
My questions are (in no order)
1. Is there something else I need to do to ensure that location data is logged on the phone? (i.e perform a certain action on the phone/ use an app that triggers a location request)
2. Are there other locations where this data is stored?
Any advice is much appreciated.
Dan
I am facing the same challenges, with the same phone. Please let me know if you guys found out any info about how location is stored on Android phones, and where to find the files.
Thank you!
D
App location data can be in any apps database, check them wit SQL carver. Standard Google geo data should be in designated folders.
If you don't find anything you could image the entire phone and scalpel through that image on your PC. Or you could use Oxygen Forensics, they extract geo data if I'm not mistaken.