cache.cell /cache.w...
 
Notifications
Clear all

cache.cell /cache.wifi

3 Posts
3 Users
0 Likes
429 Views
(@dra52091)
Posts: 5
Active Member
Topic starter
 

Greetings,
I am relatively new to mobile forensics, and I am currently doing some testing with AccessData's Mobile Phone Examiner Plus (MPE+).I am interested in finding location information from my test a GSM Samsung Galaxy S III (SCH-R30C running android 4.3). The test phone had previously been factory reset and I personally brought phone around the area to connect it to open Wi-Fi hotspots. I connected to 5 Wi-Fi networks total. During my little trip around town I had GPS enabled on the phone and all location services enabled.

After my little trip I used MPE+ to perform a physical extraction on the phone. Using MPE+ to browse through the extracted data I was able to locate the "wpa_supplicant.conf" file. This file had listed the 5 networks that I connected to on my little trip.

This is where my trouble starts. After locating the Wi-Fi networks I had connected I shifted my focus to finding other location artifacts on the test phone. After conducting extensive research the consensus was that the cache.cell/cache.wifi files would contain the information I was looking for. After browsing to the file path where those files should be located (data/com.google.android.locations/files), it was found that the files did not exist. This confused me but I chalked this up to the fact that the phone had recently been factory reset and may not have generated enough info to require the creation of those files. I also examined CachedGeoposition.db/GelocationPermissions.db under com.android.browser\app_geolocation. Both of these files were 0KB in size and contained no data.

So next I examined physically extracted data from a Droid 3. This Droid 3 was my personal phone that I had been using for over 2 years so I was confident I would find location information on there. Well it turns out, after browsing to the expected location (data/com.google.android.locations/files) of the files, that they are not there. This really puzzled me as I know the phone has generated a mass amount of location information over the few years I had it.

My questions are (in no order)
1. Is there something else I need to do to ensure that location data is logged on the phone? (i.e perform a certain action on the phone/ use an app that triggers a location request)
2. Are there other locations where this data is stored?

Any advice is much appreciated.
Dan

 
Posted : 09/04/2014 9:47 pm
(@biachriste)
Posts: 1
New Member
 

I am facing the same challenges, with the same phone. Please let me know if you guys found out any info about how location is stored on Android phones, and where to find the files.

Thank you!

D

 
Posted : 28/08/2014 6:54 pm
Bendroid
(@bendroid)
Posts: 35
Eminent Member
 

App location data can be in any apps database, check them wit SQL carver. Standard Google geo data should be in designated folders.
If you don't find anything you could image the entire phone and scalpel through that image on your PC. Or you could use Oxygen Forensics, they extract geo data if I'm not mistaken.

 
Posted : 31/08/2014 5:11 am
Share: