Investigating iOS Google Maps
30/05/2025 Friday
Google Maps is the official navigation app developed by Google, designed
to help users explore and navigate the world. As a cross-platform
application, it is available on a wide range of operating systems,
including Android, iOS, and through web browsers on desktop computers.
The app offers many features, such as turn-by-turn voice-guided
navigation, real-time traffic updates, and Street View.
Digital Forensics Values of iOS Google Maps
The digital forensics value of the iOS Google Maps app lies in the
wealth of location-based data it collects and stores, which can provide
critical evidence in investigations. This includes historical location
data, search history, navigation routes, timestamps, and user
interactions with specific places (e.g., stared and saved locations).
These collected information can offer valuable insights into user
behavior and movement patterns over time.
Location of iOS Google Maps
iOS Google Maps artifacts can be found at the following locations:
private\var\mobile\Containers\Data\Application\<App-GUID>\Library\Application
Support\GMSCacheStorage-Objects\Objects.sqlite
private\var\mobile\Containers\Data\Application\<App-GUID>\Library\Application
Support\GMSCacheStorage-Tiles\Tiles.sqlite
private\var\mobile\Containers\Data\Application\<App-GUID>\Library\LocalSuggestions
Analyzing iOS Google Maps Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Google Maps
artifacts from iOS machines’ files and what kind of digital forensics
insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select iOS
Google Maps artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Google Maps artifacts in ArtiFast.
iOS Google Maps Saved Locations
- Latitude: Location Latitude.
- Longitude: Location Longitude.
- Location Title: The text description of this location.
- URL: The URL that shows the Location on Map.
- Saved Date/Time: The date/time when this location has been saved to Google Maps App.
iOS Google Maps Stared Locations
- Latitude: Location Latitude.
- Longitude: Location Longitude.
- Location Title: The title of this location.
- Address: The address of this location.
- URL: The URL that shows the Location on Map.
- Last Updated Date/Time: The date/time when this location information has been modified.
- Creation Date/Time: The date and time when this location information was saved.
iOS Google Maps Coordinates
- Latitude: Location Latitude.
- Longitude: Location Longitude.
- Last Touched Date/Time: The date and time when this coordinate information was last touched.
- Zoom Level: The zoom level used when this coordinate information was recorded.
- Tile X Coordinate: The internal horizontal position of the coordinate within this tile.
- Tile Y Coordinate: The internal vertical position of the coordinate within this tile.
iOS Google Maps Search History
- Query Date/Time: The date/time when this item has been added.
- Latitude: The Latitude associated with this location.
- Longitude: The Longitude associated with this location.
- URL: The URL that shows the Location on Map.
- Address: The address (text description) of this location.
- Search Query: The query written by the user to search about this location.
- Location Title: The title of this location.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
