What we can actually do with that Google Maps is we can grab
data from that gmm_storage.db and decode it.
There is a presentation that I reference
in the notes of the book.
It's the same one I talked about earlier where
Ian Whiffin, Jared Barnhart, and I put together a presentation.
And I show you how to decode additional artifacts.
I want to actually take a second right now
and switch to your Dropbox and show you a few things.
As a reminder, your Dropbox should
be an exact match of the version of the class you're taking.
So I am taking, right now, h01.
So I'm going to type in for585.com, lowercase h01,
and it is going to take me out to a dropbox.
In here, we are going to fine Day 2.
If we scroll down, we see this Location Artifacts.
This is your cheat sheet.
Now, you have to be careful because it's iOS and Android.
As we look, you want to skip the iOS.
We'll get to that on Section 3.
But for Android, it tells you this is an Android device.
This is what is going to be stored there.
This is where the file exists.
This is what it's going to include.
So you can see the location artifact, like,
what actually is it.
And is it reliable?
If it's green, it means you can trust
the location and the timestamp.
If it's yellow, one of them is unreliable.
So here, you can see, for this one, dme,db--
which we have not talked about yet-- has unreliable location,
but the timestamp is accurate.
And you'll see, on some of the others,
it's most likely unreliable timestamp.
If it's red, it is completely unreliable location.
Now, the reason I'm pointing this out right now--
gmm_storage.db, unreliable location,
the only reason is because we cannot prove the user went
to that location.
We can say, someone typed the search.
So that's very important that you realize that.
I hope you leverage this cheat sheet.
There's also a one-hour presentation
that's available on Cellebrite's website.
It's called I Beg to DFIR.
It's a lunch show that my friends and at Cellebrite run.
Jared, Ian, and I presented the entire presentation
that we did at ICAP Northwest.
If you're coming to the conference circuit in 2022,
you'll probably see it again because people are really
requesting it because it's so much information.
And all of these things are not being
parsed by any of the commercial tools, which
is kind of frightening.
So please leverage that.
It's the bonus in your section.
For Android 10, 11, and 12, think about this.
You search for something in maps.
If you actually start driving, you
get those text files, those audio files
that speak to you, where she says, in 500 feet, turn right.
At the next light, turn left.
These are transactional logs.
And you can see, they're tts, and then
they have a timestamp associated with it.
That's a Unix Epoch timestamp on when the user searched for it,
not when they listened to it.
Because what if I--
let's say, for this recording studio right now,
I can be driving here every day-- every single day,
back and forth.
It would be the first time I searched for it if I'm just
going to keep referencing it.
But you can actually tell how far a person got if you read
or hear you've reached your final destination.
Keep in mind, it's transactional,
so it's only going to be the last search
with turn-by-turn audio.
So unfortunately, it's not going to have everything,
but it's good indication that the user actually went there.
So it's taking it a step further from just that gmm_storage.db.