iOS Waze
31/01/2025 Friday
Waze is a widely used mapping and navigation application. It is a community-driven navigation app that provides real-time road alerts and an up-to-the-moment map. The tools have features that provide users with instant updates about traffic, crashes, police, and more.
Digital Forensics Value of iOS Waze
In mobile forensics, GPS and location artifacts are crucial parts of the investigation. Therefore, the Waze application holds significant forensic value. Artifacts related to the user’s favorite places and recent places can be parsed from Waze application data on the iOS device. The application also records shared places and events, which can give valuable insight into user activity.
Location of iOS Waze Artifacts
iOS Waze artifacts are found in the following location:
/private/var/mobile/Containers/Data/Application/<App-GUID>/Documents/user.db
Analyzing iOS Waze Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Waze artifacts from iOS devices and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Waze artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Waze artifacts in ArtiFast.
iOS Waze Account
- User Name: The user name of the Waze account.
- First Name: The first name of the Waze account.
- Last Name: The last name of the Waze account.
- Nick Name: The nickname of the Waze account.
iOS Waze Places
- Name: The Place Name.
- Coordinates: The longitude and the latitude of the place.
- Created Date: The date and time the place was created.
- Last Access Date: The date and time the place was last accessed.
- Modified Date: The date and time the place was last modified.
iOS Waze Favorite Locations
- Name: The Place Name.
- Coordinates: The longitude and the latitude of the place.
- Created Date: The date and time the place was created.
- Last Access Date: The date and time the place was last accessed.
- Modified Date: The date and time the place was last modified.
iOS Waze Recent Locations
- Name: The Place Name.
- Coordinates: The longitude and the latitude of the place.
- Created Date: The date and time the place was created.
- Last Access Date: The date and time the place was last accessed.
iOS Waze Searched Locations
- Name: The place name.
- Street: The street name of the place.
- City: The city of the place.
- State: The state of the place.
- Country: The country name of the place.
- House: The house number of the place.
- Longitude: The longitude of the place.
- Latitude: The latitude of the place.
- Rank: The rank number of the place.
- Created Date: The date and time the place was created.
iOS Waze Session Info
- Last Position: The last known location.
- Street: The street name of the place.
- City: The city of the place.
- State: The state of the place.
- Country: The country name of the place.
- House: The house number of the place.
- Last Navigation Coordinates: The longitude and the latitude of the place.
- Last Synchronization Date: The date and time the session was last synchronized.
iOS Waze Text To Speech Navigation
- Text: The spoken text of the navigation system.
- Update Date: The date and time the entry was updated.
- Location: The location reference in the database.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
