Cellebrite Location...
 
Notifications
Clear all

Cellebrite Location information

3 Posts
3 Users
0 Reactions
1,406 Views
(@streetforensics)
Estimable Member
Joined: 11 years ago
Posts: 55
Topic starter  

Just trying to understand the data I am seeing. Not important to this case, just interesting and may be important in the future.

Phone iPhone 4. iOS 7.1.2
Physical Extraction

In the "device locations" tab I began looking at the data in the category 'Cell Towers'. Plotting a few of these clearly shows they are NOT actual cell tower locations, but probably represent some sort of RTT type data giving a general location of the phone. I can live with that, but the confusing thing is the dates and times for each entry are broken into two times, all on the same day. There are 221 cell tower location entries. They are time stamped either on 53947PM or 92603 PM.

Filtering these to show either one of those times also gives an interesting finding. The items that fall into the 53947PM time are on the east side of the town, the others are on the west side of the town. There is some mixing near the center of the town, but generally speaking it seems to be broken up into these two times and separated by these locations.

My thought on the times are that the data is stored in a database and the cellebrite is reading the last time that database was written, since the phone could not have possibly been at all these locations at once. If this is true then there are two databases being read for cell tower location information… and no way for me to know what time the phone was at these locations…

I hope I gave enough information for someone to give me an answer or some other ideas.

Thanks in advance.


   
Quote
ForensicMeteor
(@forensicmeteor)
Trusted Member
Joined: 11 years ago
Posts: 60
 

I really wish Cellebrite would tell you which database data was parsed from. This would solve so many issues.


   
ReplyQuote
(@twjolson)
Honorable Member
Joined: 17 years ago
Posts: 417
 

I really wish Cellebrite would tell you which database data was parsed from. This would solve so many issues.

Ron Serber said such a feature is coming later this year…fingers crossed.

He did share a tip with me though. If you highlight the record of interest, and then switch to a tab that has the image open, showing the hex, the relevant location will be highlighted. Mousing over the highlighted hex / ascii should show a floating window with the file path.

It doesn't work everytime, but it is worth trying.


   
ReplyQuote
Share: