hi
i have a case with locations in the UFED. These locations are very usefull for my case and point right where the thieft was done. but i have 3 and 4 locations at the same date and time but not a the same place.
So how i can explain this ?
Do you know if the geohistory.mapsdata is the history of search from apple maps? or exactly where the phone was ?
thnks!
stefspvq,
It is possible that Geolocation evidence found on a phone or computer could have been generated by a user other than the phone or computer owner.
For example, if I take a photo with my iPhone in which location based information is embedded and then send you that photo to your iPhone, Cellebrite will extract the EXIF metadata from the photo I created but now residing on your phone.
So, please take a closer look at each piece of evidence to determine the evidences' provenance (meaning who actually created the original evidence).