Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Consolidated GPS cache
Geolocation history of cell towers and Wi-Fi on the device is stored in a database that is located at /private/var/root/Caches/locationd/consolidated.db. The database is a member of RootDomain. It contains location information for cell towers that the device came into close proximity with, as well as Wi-Fi networks that were available for the device to connect to. This database is often used to place a person near a specific location, as this data is cached to the database file without the user's consent.
The CompassCalibration table in the consolidated.db file contains the location information along with the timestamps. The file, when opened with the DB Browser for SQLite, displays the data, as shown in the following ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access