| || |
Galaxy S3 GPS/WIFI Cache
I am relatively new to mobile forensics, and I am currently doing some testing with AccessData's Mobile Phone Examiner Plus (MPE+).I am interested in finding location information from my test a Samsung Galaxy S3 (SCH-R30C running android 4.3). The test phone had previously been factory reset and I personally brought phone around the area to connect it to open Wi-Fi hotspots. I connected to 5 Wi-Fi networks total. During my little trip around town I had GPS enabled on the phone and all location services enabled.
After my little trip I used MPE+ to perform a physical extraction on the phone. Using MPE+ to browse through the extracted data I was able to locate the "wpa_supplicant.conf" file. This file had listed the 5 networks that I connected to on my little trip.
This is where my trouble starts. After locating the Wi-Fi networks I had connected I shifted my focus to finding other location artifacts on the test phone. After conducting extensive research the consensus was that the cache.cell/cache.wifi files would contain the information I was looking for. After browsing to the file path where those files should be located (data/com.google.android.locations/files), it was found that the files did not exist. This confused me but I chalked this up to the fact that the phone had recently been factory reset and may not have generated enough info to require the creation of those files. I also examined CachedGeoposition.db/GelocationPermissions.db under com.android.browser\app_geolocation. Both of these files were 0KB in size and contained no data.
So next I examined physically extracted data from a Droid 3. This Droid 3 was my personal phone that I had been using for over 2 years so I was confident I would find location information on there. Well it turns out, after browsing to the expected location (data/com.google.android.locations/files) of the files, that they are not there. This really puzzled me as I know the phone has generated a mass amount of location information over the few years I had it.
My questions are (in no order):
1. Is there something else I need to do to ensure that location data is logged on the phone? (i.e perform a certain action on the phone/ use an app that triggers a location request)
2. Are there other locations where this data is stored?
Any advice is much appreciated.