Now that we looked at location artifacts,
and we looked at application usage,
things that are killing the battery,
let's try to place the user at the scene of a crime.
Placing a user at a scene of a crime
could be looked at in two different perspectives.
It could be used to show if an alibi is true.
It could also be used to prove that someone was in a location
when something occurred.
The first thing we want to do is consider location files.
If you get lucky--
and depending on your acquisition
level in the Android version you're looking at,
you may find cache.cell and cache.wifi.
If you do, I strongly recommend that you
look at that GitHub that's listed here
for that tool, that android-locdump, that
will assist you in your investigation.
Googlesettings.db-- remember, we want to go
and we want to look and see, is it
turned on or off for location services, true or false?
It's only going to track the most recent setting, though.
So that is unfortunate in our situation.
Browser history-- look at this screenshot right here. .
If you look at this, you can see it's
prompting for last name, which is Mahalik, and room number,
which is 226.
What do you think this is?
So it's from Chrome.
We could see last name, room number.
If you ever travel and you connect the hotel Wi-Fi,
these are the items that are often requested.
What I would do is look at 11/16/2016,
did I have any flights?
Di I connect to Wi-Fi?
And put the user in that location.
There's also the wifigeofence.db.
This is for Samsung-only devices,
but what it's going to do is track Wi-Fi
within regions of that device.
Now, think about when we did the dumpsys on my Samsung device
at the beginning of Section 2, we saw the Wi-Fi surrounding
me--
all the Wi-Fis that I didn't connect to.
Files like this would be tracked in wifigeofence.