Forensic Analysis of Geodata in Android Smartphones

Smartphones provide a lot of interesting data for a forensic investigator. As many apps make use of location information to provide or enhance their services, the log files of smartphones can contain valuable geodata. Based on geodata it is possible to reconstruct the whereabouts of the phone and its user at certain points in time. The functionality to analyse geodata based on GPS coordinates is standard for many mobile forensics tools. Unfortunately, many smartphone apps log their geodata in human readable format only, which makes it harder for investigators to get and analyse this important information. This paper proposes a simple but comprehensive approach to the analysis of all geodata on a smartphone. The approach uses simple app-specific descriptions of the geodata information stored in smartphones and thus enables an automatic extraction and presentation of all relevant geodata. The approach is currently being implemented for Android smartphones.