MOBILE FORENSICS

Forensic analysis of Android location data

Location data is among the most important pieces of evidence in a mobile IT forensic investigation. It can provide clues as to where a person has been, their movements and how an Android device has been used. However, a reliable assessment always requires a comprehensive technical analysis of all available data sources.

GPS location data
WLAN-based location information
Mobile phone base stations
Google Location History (where available)
Fused Location Provider
App-specific location data
Timestamps and metadata
SQLite databases
Cache and configuration files

TECHNICAL BACKGROUND

Technical Fundamentals

Android can determine and store location information from various sources.

Forensically relevant artefacts include, amongst others:

  • •GPS location data
  • •WLAN-based location information
  • •Mobile phone base stations
  • •Google Location History (where available)
  • •Fused Location Provider
  • •App-specific location data
  • •Timestamps and metadata
  • •SQLite databases
  • •Cache and configuration files

The data that is available depends on the device settings, permissions, app versions and synchronisation with your Google Account.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, location artefacts are analysed using recognised IT forensic tools and manual analysis. GPS, WLAN and mobile network data are correlated with timestamps, app artefacts and other technical findings. All stages of the investigation are documented in a reproducible manner and assessed solely on the basis of objective technical findings.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which sites can be verified technically?
  • ✔Which movement sequences can be reconstructed?
  • ✔Which apps have stored location data?
  • ✔Do the figures from different sources for the same location match?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Location data may be incomplete, disabled or deleted. GPS and network-based location data have different levels of accuracy. Individual location data should therefore not be assessed in isolation, but must always be interpreted within the overall technical context.

The analysis of Android location data can provide valuable insights into movement patterns. Only by combining various data sources is it possible to carry out a transparent and reliable IT forensic assessment.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have location data from an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Is only GPS data analysed?
No. Depending on the data source, WLAN, mobile network and app-specific location information may also be taken into account.
Is location data always accurate?
No. The accuracy depends on the specific source and the environmental conditions.
Is it possible to create a movement profile?
Provided there are sufficient technical artefacts, movement patterns can be reconstructed.
What role do timestamps play?
They enable the chronological ordering and correlation of various site-related data.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.