Mobile Forensics · Where the Evidence Lives · Lesson 4 of 5

Location Artifacts

See where a phone records the places it's been, and how far to trust each one.

Three ways to know where you are

A phone works out its position in several ways, and each leaves a different kind of record with a different level of precision. Apple's privacy page says Location Services uses GPS and Bluetooth where available, along with crowd-sourced Wi-Fi hotspot and cell tower locations. Android works in a similar way.

• GPS. You saw in Mobile Fundamentals that GPS is receive-only: the phone listens to satellites and calculates its own position. Outdoors with a clear sky, it's often accurate to a few meters. Indoors, between tall buildings or underground, it gets worse or fails.
• Wi-Fi positioning. The phone notices which Wi-Fi networks are nearby and compares them with a large database of where those networks are. It works well indoors and in cities, often to tens of meters.
• Cell towers. Knowing which towers the phone can hear gives a rough area, sometimes hundreds of meters, sometimes several kilometers in the countryside. Remember from Mobile Fundamentals that a cell only places a phone somewhere inside its coverage area, which can be large.

Phones usually blend these sources. So a stored location is an estimate, and good records say how good the estimate is. On Android, each location carries an accuracy radius, which the developer documentation defines as a radius in meters at the 68th percentile confidence level. In plain words, draw a circle of that size around the point, and there's roughly a two in three chance the phone was really inside it. iPhone apps get a similar horizontal accuracy value.

This changes how an examiner reports results. A point with a 10 meter radius might put a phone at one shop. A point with a 2,000 meter radius only puts it somewhere in a neighborhood. Plotting the point without its circle makes the evidence look far more precise than it is, and that can mislead a court or an employer.

Time matters as much as position. A location record is a snapshot, so the gaps between snapshots are unknown.

Location history on Android and iPhone

Beyond one-off fixes, phones can keep a running history of places visited. Where that history lives has changed a lot, and it affects where an examiner looks.

Google Timeline. Google Maps used to keep its Location History, the feature behind Timeline, on Google's servers, where it could be exported or requested from Google. In December 2023, Google announced that Timeline would move onto the user's device instead, rolling out through 2024. Google's help pages now say Timeline is off by default, saves visits and routes on each signed-in device, and isn't available in Maps on a computer. Users can choose an optional cloud backup, which Google says is encrypted. Google also lowered the default auto-delete for newly enabled Location History from 18 months to 3 months. For investigators, this means the phone itself has become the main place to find this history.

iPhone Significant Locations. iOS learns places you visit often, such as home and work, for features like traffic predictions and Photos Memories. Apple says Significant Locations are synced between your devices using end-to-end encryption and can't be read by Apple. So they're found on the device, not requested from Apple.

Other sources fill in the picture:

• Photos with GPS in EXIF, from the last module.
• App data: ride-share, fitness, delivery and map apps often store places, routes and times in their own databases.
• Wi-Fi history: networks the phone joined can hint at places it has been.

Location history is among the most revealing data a phone holds, so legal limits matter here. In the US, the Supreme Court held in Carpenter v. United States (2018) that the government generally needs a warrant to get historical cell-site location records from a carrier. Rules differ by country, and an examiner sticks to the dates and data the authority covers.