Google Location Dat...
 
Notifications
Clear all

Google Location Data

laura4458
(@laura4458)
New Member

We've done a lot of work with forensics on Apple devices, and we've done some work with Android devices. Everyone has heard the claims that "Google tracks everything you do all the time", but we know from our experience doing digital forensics that that's simply just not always the case. What I'm unclear about is the when and why.

I'm hoping with our combined expertise can reach some definitive assertions/conclusions when and why does Google not collect location data? (or, to be more precise regarding what we as digital forensic examiners can know) When can we not get Google location data from Android devices and why is that data either not accessible, stored, tracked, etc.?

Thanks for your help!

Quote
Topic starter Posted : 21/02/2018 5:43 pm
RolfGutmann
(@rolfgutmann)
Community Legend

Your question is clear, but there is no answer in general. Android developped by Google is named stock Android. But all manufacturers modify these stock version to their own Android version often modifying the User Interface UI.

So the question would be about stock Android I guess.

The key to follow is called Google Play services location API. There the time interval Google collects the location just for the OS and all native Apps running on the device (no 3rd party apps) the answer is different by Android stock versions.

By your specification which Android stock version you want to know this narrow question could be answered by focusing on actual devices like Pixel 2 from Google which runs stock Android.

It all depends on what you really want. Its worthless having a time interval of one specific device almost nobody has.

And its a clear fault to after propose that this time interval is on every Android device.

Do you recognize the dilemma? You search for a general question, but there is NOT.

Open to help -)

ReplyQuote
Posted : 21/02/2018 7:41 pm
einstein9
(@einstein9)
Member

I think that he means this

http//video.foxnews.com/v/5728540115001/?#sp=show-clips

if its true or not?

ReplyQuote
Posted : 22/02/2018 10:27 am
RolfGutmann
(@rolfgutmann)
Community Legend

Technically first forget about WiFi and Cell connectivity. The GPS-receiver and gyroscope work in combination. A unclear position may fits in many location first but measuring the speed and time of movement of the gyroscope brings accuracy by the complete non-geospatial (relative in space, just differencies) space profile.

One thing remains clearly a pre-fault. If you set up an Android phone newborn, it already has geographical accuracy inside by the sales process as UPC/EAN-codes differ. So before unboxing the device already knows the country sold-in.

Resetting an Android-device in a faraday-cage and moving to another continent (CHE to SGP) showed that the device still knew it was sold to CHE, after wipping. Then it got sunlight outside a SGP building the GPS-receiver immediately took the position and paged towards WiFi and Cell. We did run this test in Oct '17 with an S8 plus.

Conclusion With batteries inside no hidding. The timeline interval is negligible it just makes the profile more angular but perpetual.

ReplyQuote
Posted : 24/02/2018 4:14 pm
crazyrudy
(@crazyrudy)
Junior Member

The answer depends on the source you are pointing at for Location Data. If you are focused on a Google Cloud Location File, you will get position information whenever an application on the phone has reported a location. That location could be fixed by GPS module, WiFi, Tower Location, etc., regardless of the application that is requesting access to those instruments. As I have noted in another post, the Cloud Location JSON file contains instrument reports that are without location. If you were to receive the Location File from Google pursuant to a search warrant, or other legal process, in Excel format, those instrument reports without location data would simply not be reported. An example of this would be the accelerometer reporting tilting, but not reporting a LAT/LON. Google will report nothing about this activity as if it did not exist, even though it does exist in the original JSON file. Another source of location data is the phone dump. This can vary widely depending on the applications that are installed on the phone. UFED extractions of YouTube requests and views contain location data, but strictly anchored to Tower Locations, not the location of the phone.

The other posters are correct that no general rule can be established on when Google captures location data. It depends on the user and the version of the OS. If I give permissions for a variety of apps to access the GPS module in the phone, then there will be a robust location history. If I have refused those permissions on installation, then the location reporting will be more anemic. If I use Google Maps liberally, then the database will be robust.

My experience with location data from Android devices is that it is highly dependent on user authorization, variety of application installed and authorized, and user patterns and habits. To be sure, there are typically a reasonably robust amount of background location data being stored in the cloud and on the device. But that is still dependent on the factors above.

Rudiger

ReplyQuote
Posted : 17/03/2018 1:34 pm
droopy
(@droopy)
Active Member

Google could track you always. Even if you disable ALL features of android.

They have added inside Google Play Store app the feature. Also on each product Google Maps, etc.

Even if you turn OFF the location, in few days you have it ON again )

ReplyQuote
Posted : 18/03/2018 1:21 pm
jaclaz
(@jaclaz)
Community Legend

… meanwhile in North Carolina …
https://gizmodo.com/north-carolina-police-issued-sweeping-warrants-to-searc-1823845667

😯

jaclaz

ReplyQuote
Posted : 18/03/2018 5:01 pm
crazyrudy
(@crazyrudy)
Junior Member

Droopy is correct, after you have accepted the terms of the Play Store and connected the phone to a network.

ReplyQuote
Posted : 21/03/2018 1:59 pm
Share:
Share to...