Individuals familiar with iPhone forensic analysis will be quite familiar. As far as my research has taken me, I am able to gather previous locations of the iPhone from the database, all contained in the ‘CellLocationLocal’ table. But the database has more tables…interesting…
So I’ve been looking at the ‘WifiLocation’ and ‘CellLocation’ table, and discovered a few interesting things. Some of the results gave me locations in countries such as Turkey, which I haven’t actually ever been to. It’s common knowledge with this database that the time stamps are generated as some kind of batch method in these tables, because the time stamp value can be the same for multiple geolocations. I find this very very interesting.
To further matters, tables such as ‘CellLocationBoxes_node’ appear to store some kind of data as a hex string. Further research is needed!
My theory is, for the moment, that these values are not locations of the phone, but instead locations looked at by the device, via the Google maps app or other applications. Looks like I’ve got my second piece of research for my summer break! I’ll post my findings and see if I can finally get to the bottom of all the data stored in this database.