
iOS Forensics for Investigators
By :

In the first part of this chapter, we introduced the Location Services API and learned how iOS uses different technologies to assess its position. Now, we'll take an in-depth look at the SQLite databases where geolocation data is stored.
The following is a list of files of interest that can only be found in a full filesystem extraction:
/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite
This is the primary storage means for iOS location data. The ZRTCLLOCATIONMO
table contains several useful records, such as GPS coordinates, timestamps, and a horizontal accuracy value, which is an indicator of how accurate the device believes the GPS coordinates to be. The ZRTWIFIACCESSPOINTMO
table stores a list of Wi-Fi networks that the device has scanned. Generally speaking, data contained in this database should be considered up to date and accurate.
/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite
Change the font size
Change margin width
Change background colour