Android Here WeGo

Investigating Android Here WeGo

16/08/2024 Friday

Here WeGo is a web-based mapping and satellite navigation software operated by HERE Technologies, accessible on both web and mobile platforms. It utilizes HERE's location data platform, offering local data that includes satellite views, traffic information, and various location services.

Digital Forensics Value of Android Here WeGo

In the realm of mobile forensics, GPS and location artifacts are critical components of an investigation. Consequently, the Here WeGo application possesses substantial forensic value. Artifacts related to the user’s favorite and recent places can be extracted from Here WeGo data on an Android device. The application also logs shared locations and events, providing valuable insights into user activity.

Location of Android Here WeGo Artifacts

Android Here WeGo artifacts can be found at the following location:
data//com.here.app.maps/databases/scbeEncrypted.EMBEDDED/scbeEncrypted.decrypted

Analyzing Android Here WeGo Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Android Here WeGo artifact from Android devices' files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Here WeGo artifact parsers:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Here WeGo artifact in ArtiFast.

Android Here WeGo Collection Places

Date/Time: The date/time when this place was added to the collection.
Name: The name of the place.
Latitude: The geolocation latitude.
Longitude: The geolocation longitude.
Quota Size: The size of the file.
Last Update Date/Time: The date and time when the location last updated.
Creator ID: The ID of the creator.
Address: The place’s full address.
Collection ID: The place collection ID.
Is Deleted: Indicates whether the record is deleted or not.

Android Here WeGo Collections

Date/Time: The date/time when the collection was created (UTC).
Last Updated Date/Time: The date and time when this collection was last updated.
Name: The name of the collection.
Creator ID: The ID of the creator.
Collection ID: The place collection ID.
Is Deleted: Indicates whether the collection is deleted or not.