Blog >> Android Life360

Investigating Android Life360

18/10/2024 Friday

Life360 is a widely used family safety app, having over 25 million members, that allows users to share location data within trusted groups called "Circles." It allows users to share private location data exclusively with trusted individuals within a designated "Circle." The app was developed following Hurricane Katrina to assist in locating and helping loved ones in times of need.

Digital Forensics Value of Android Life360

Android Life360 In forensic investigations can provide valuable data, such as location history, check-ins, and communication logs within the Circle. Since Life360 was designed for real-time tracking and location sharing, its data can be crucial in reconstructing movements or verifying locations during specific timeframes. Investigators can access this information to assist in cases involving missing persons or other safety-related incidents.

Location of Android Life360 Artifacts

Android Life360 artifacts can be found at the following location:
/data/data/com.life360.android.safetymapd/databases/messaging.db

Analyzing Android Life360 Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Android Life360 artifacts from Android devices and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Life360 artifact parsers:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Life360 artifact in ArtiFast.

Android Life360 Messages

• Created Date/Time: The date and time when the message was created.
• Thread ID: The Thread ID.
• Has Location: Indicates whether the message has a location or not.
• Location Place Type: The type of the place in the location.
• Activity Action: The name of the application as seen by the device.
• Sender ID: The unique ID of the sender.
• Client ID: The ID(s) of the recipient(s).
• Type: The type of the message.
• Content: The message content.
• Read: The read status of the message.
• Latitude: The latitude of the location, if the message is a map location.
• Longitude: The longitude of the location, if the message is a map location.
• Location Name: The name of the location if the message is a map location.

For more information or suggestions please contact: ekrma.elnour@forensafe.com