iOS Locations

Hello y'all,

I am conducting an analysis of an Apple iPhone with Cellebrite PA 7.34 via a UFDR file (trying to obtain UFED Dump). The phone was extracted via GrayKey. I am analyzing the Device Locations primarily to attempt and locate where the device was at any given point in time (case involves numerous break-ins). When conducting my analysis, I am mainly focusing on "Native" locations. The iOS locations specifically state that they are UTC-4 or UTC-5 that would be the local timezone. When reviewing Native, they do not detail the timezone. When reviewing them coordinated with the iOS locations, at first, it looked as though it made sense that they were in UTC -0. So I converted them to local time. When analyzing the Native locations (time converted or not) I came across numerous locations that are miles apart with the same exact time stamp. Looking closer into the differences in locations, it appears the data is coming from, primarily, two databases: (1) cache_encryptedB.db and (2) cache.sqlite. Looking at the locations within Cellebrite the encrypted database locations state "GpsFix" and the sqlite locations just state "Location" with a number and Origin blank.

I should say, the locations in the cache.sqlite database appears to match locations relevant to the case, but I am obviously looking for more insight into the differences in the locations pulled from a GrayKey extraction of an iPhone. 

Any insight is welcome! Thank you.

Steve