IT Forensics · macOS
Forensic analysis of location services – technical assessment of a Mac’s location data
Location Services enables apps and websites on macOS to use location information. Apple explains that a Mac estimates its position using, amongst other things, local Wi-Fi networks. Users can specify whether location access is permitted for individual apps and system services.
For forensic purposes, location services are therefore relevant both as a context for authorisation and as a potential source of location-based evidence. However, an activated location service does not prove that a specific location was determined or used by a particular application at a specific point in time.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.
Our services
We examine the available settings and artefacts of Location Services and categorise app and system service permissions. Where specific location-based data is present in applications or other system artefacts, this is analysed separately and correlated over time.
This assessment takes into account the fact that, without built-in GPS, the Mac typically estimates its location using environmental or network data. The accuracy and reliability of a location determination are therefore not presented beyond the scope of the data actually available.
Typical areas of application
This is how the forensic investigation is carried out
Once the evidence has been securely preserved, the location services configuration and available authorisation information are checked. Relevant apps and system services are identified and cross-referenced with other existing artefacts.
Where specific location data exists, its source, time reference and technical accuracy are assessed separately. Mere access authorisation is not equated with an actually recorded position.
Why is this area of investigation relevant to forensics?
In appropriate cases, location data can provide important spatial context for other digital events. However, Apple expressly points out that a Mac can estimate its position using local Wi-Fi information.
From a forensic perspective, a distinction must therefore be made between location authorisation, location queries and the location information actually stored. Only the latter can – depending on the source and quality – provide a more precise location reference.
Frequently Asked Questions
🔗 Related topics
LanCologne – macOS Forensics in Cologne
Do you need a professional analysis of location-based data on a Mac? LanCologne can assist you with the collection of evidence that stands up in court and a technically verifiable assessment.
Related to this topic
- Forensic analysis of significant locations – Properly categorising significant locations on macOS
- Forensic analysis of macOS Wi-Fi networks – reconstructing a Mac’s network connections
- Forensic analysis of macOS Bluetooth – technical classification of paired and detected devices
- Forensic analysis of macOS Network Extensions