Start with your tools.
Let your tools tell you what it thinks it knows
about where the user has been.
So here, we can see, in Axiom, we see Wi-Fi Profiles.
Start there.
Location and travel, it's telling us information.
Here, we can see Waze Events, Waze Places.
It says 2.
When we go down in Physical Analyzer, same thing.
Start with what the tool is telling you.
Remember, if it's Apple Maps, what is the iOS version?
It could be stored in a different file.
It can be stored in cloud.
You want to make sure you're uncovering the most location
artifacts from these devices.
Also, do a hex search.
And I know I mentioned this before, but hex search
for location and position to make
sure you're getting the best information from these devices.
And just in case you missed it, I'm
going to show you how to do this again in the VM.
I'm going to go to File System, and then
look at the hex, click on the magnifying glass,
and, in ASCII, search for a location, and press Enter.
Change that keyword to position, press Enter,
review your results.