Blog >> Apple Maps

Apple Maps

20/02/2026 Friday

Apple Maps is a mapping and navigation service developed by Apple Inc. It is one of several GPS-based navigation applications, offering core functions similar to Google Maps, Waze, and HERE WeGo. The provided features include turn-by-turn directions for driving, walking, cycling, and public transit, along with real-time traffic updates, 3D city views, and detailed satellite imagery. It is integrated across Apple devices, including iPhone, iPad, Mac, and Apple Watch.

Digital Forensics Values of Apple Maps

Being able to extract places saved by a user, their guided routes, and their search history can provide a valuable source of information for digital investigators. This extracted information enables investigators to reconstruct timelines and develop a clearer understanding of a user’s movements. It can also be used to help prove the user’s presence at a specific location at a particular point in time.

Location of Apple Maps

Apple Maps artifact can be found at the following location:

private\var\mobile\Containers\Shared\AppGroup\group.com.apple.Maps\Maps\MapsSync_0.0.1

Analyzing Apple Maps Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Apple Maps artifacts from Apple machines’ files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Apple Maps artifact parser:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Apple Maps artifacts in ArtiFast.

Apple Maps Search History

• Query Date/Time: The date/time when this item has been added.
• Last Modified Date/Time: The last modified date/time of this record information.
• Current Location Latitude: The Latitude associated with the user location when performing this search query.
• Current Location Longitude: The Longitude associated with the user location when performing this search query.
• Suggested Location Latitude: The Latitude associated with the suggested location.
• Suggested Location Longitude: The Longitude associated with the suggested location.
• Search Query: The query written by the user to search about this location.
• Location City: The city of the suggested location.
• Record Updating Times: The number of times this record has been updated.

Apple Maps Places

• Creation Date/Time: The date and time when this record was created.
• Last Modified Date/Time: The last modified date/time of this record information.
• Latitude: The Latitude associated with this location.
• Longitude: The Longitude associated with this location.
• Address: The address (text description) of this location.
• Location Title: The title of this location.
• Record Updating Times: The number of times this record has been updated.

Apple Maps Routes

• Creation Date/Time: The date and time when this record was created.
• Last Modified Date/Time: The last modified date/time of this record information.
• Start Location Latitude: The Latitude associated with the start location of this route.
• Start Location Longitude: The Longitude associated with the start location of this route.
• Destination Location Latitude: The Latitude associated with the destination location of this route.
• Destination Location Longitude: The Longitude associated with the destination location of this route.
• Destination Address: The address (text description) of the destination location of this route.
• Destination Location Title: The title of the destination location of this route.
• Record Updating Times: The number of times this record has been updated.
• Is User at The Start Location: Indicates whether the user was at the start location or not when starting this route.

Apple Maps Sync

• Item Number: Item Number.
• Type: Type.
• Location Search: Location Search.
• Location City: Location City.
• Latitude: Latitude.
• Longitude: Longitude.
• Map Item Address: Map Item Address.
• Map Item Protobuf String: Map Item Protobuf String.
• Journey Data Address: Journey Data Address.
• Journey Protobuf String: Journey Protobuf String.
• Modified Date/Time: Modified Date/Time.
• Created Date/Time: Created Date/Time.

For more information or suggestions please contact: kalthoum.karkazan@forensafe.com