I am currently researching geographic data from Apple handheld digital devices. This may be geographic evidence generated by certain apps or processes etc. I am trying to collate a list of as many examples as possible to research, so if anyone has any ideas or experiences of this then I'd be really grateful. ?
iPhones primarily use.longitude and latitude I have.developed a tool to.read this information and plot it on a map based on the co-ordinates the data is stored on sqlite3 databases and contains things like picture locations,wifi networks the iPhone detected, and also cell tower locations and coordinates. I can provide more info if you.like feel free to.send.specific questions to ryan.manley@wiseforensics.com
I am trying to collate a list of as many examples as possible to research
Have you emailed the Apple store to see how many Apps on their database are described as obtaining or using geographic data?
Pictures taken by iPhones have the GPS coordinates in their EXIF data.
You can download 'exiftool' from the internet and use this 'start.cmd' file I created
@echo off
CLS
echo This tool creates an output.kml file from images suitable to map
echo in Google Earth.
echo Starting path will be %~p0
echo and processing recursive directories.
echo If not correct press CTRL + C otherwise
pause
exiftool -r -k -if "$gpslatitude" -p kml.fmt -d %Y-%m-%dT%H%M%SZ %~p0 > output.kml
Pictures taken by iPhones have the GPS coordinates in their EXIF data.
Assuming that 'Location Services' is turned on )
(I believe 'on' is the default setting in OS 3.0+)
Really helpful so far guys, thanks. iPhone Apps that leave a latitude/longitude footprint after use are particularly interesting to me also )
IOS4 devices now contain the consolidated.db file, which is a gold mine for this data.
Within the consolodated.db there are also records which come from the use of apps using iAds.
Within the consolodated.db there are also records which come from the use of apps using iAds.
The location informations found (wifi location table) in the file "consolidated.db" come from applications use "IADs? But why do we find the same timestamp over distances of several kilometers ?
Thanks