Pre-iOS 13-- these are artifacts that are consistently
stored on the iPhone.
So regardless of if it's in cloud,
if it's encrypted, where it exists,
this is something we could rely upon.
The last search typed into Apple Maps
was going to be stored in either comm.apple.Maps.plist
group.comm.apple.Maps.plist.
It is Base64 encoded, and it can be decoded.
At the top screen you see I just captured that.
You could use CyberChef.
You could use a free online tool,
anything you want to decode it.
At the bottom I'm showing you how
it looks in Oxygen, where we see maps activity,
and it's actually decoded.
Now, what's really strange is, on my iOS 15 testing,
when I look at group.comm.apple.Maps.plist,
it still shows this Indiantown Gap search.
I remember Indiantown Gap.
That was my grandmother's funeral.
So I know the exact day when I searched for this.
I have done many Apple map searches since then.
It's as if this file is no longer in use.
So do not assume, if you're looking in an iOS 15 device,
that this location is true at all.
It could be historical information.