Continuing on in the evidentiary locations-- what we want to do
is now put more pieces of the puzzle
together, identify additional databases and files that
will assist you so that you can do part B successfully
of Lab 2.1.
The first thing we're going to look at-- location settings.
Now, we are going to briefly touch on location now.
Later in this section, we're going
to dive deep and look at wearables,
and digital wellbeing, and all the things that
happen on your Android that track additional artifacts.
So here, we are looking at googlesettings.db.
This should be one of the first places
you go when you're examining an Android if you
care about location artifacts.
It is going to show you if it's currently turned on or off.
So when you see use_location_for_services,
a value of 1 or the word true, that
means it's currently enabled.
Now, the issue is you don't know when
that toggling happened, when did they turn it on,
when did they turn it off.
You could look at the metadata for these files.
But be careful because, remember,
garbage collection could go through
and touch the entire device and change all those timestamps.
But really, it's just showing you the present setting
on what exists.