Interpreting Location Data from Digital Devices Expert Article

In this article, the digital forensic experts at Robson Forensic provide an overview of location data from several types of digital devices. Location data can provide valuable, quantifiable facts regarding incidents involving motor vehicles, bicycles, watercraft, and pedestrians.

Overview

The advent of Global Navigation Satellite Systems (GNSS), such as the Global Positioning System (GPS), GLONASS, and Galileo, has created an extensive digital record of our locations, activities, and communications. The use of these data has potential far reaching implications toward the resolution of civil and criminal lawsuits, but must be approached cautiously to avoid misinterpretation of the myriad of available (and sometimes conflicting) datasets.

This article focuses on two main groups of digital devices, cellular phones and vehicle infotainment/telematics systems, however location data can be found on a multitude of devices including computers (laptop and desktop), installed and portable GPS navigation units, tablets, fitness trackers, and many other mobile devices.

Cellular Phones

Cellular phones have become an integral part of daily life, expanding well beyond phone calls into texting, emailing, Snapping, Messaging, Posting, Tweeting, Fitness Tracking, and of course, taking digital photos. Our phones process a phenomenal amount of information, but how much of that information is stored? And where is that information stored? The answer to both those questions is dependent on specific make/model/version of the device as well as running applications and user settings. In general, we can separate where the information is stored into three main areas: service providers, the physical device, and synched accounts.

Service Providers: Quantity and quality of data varies from provider to provider as do retention periods. It is imperative, therefore, to act as soon after an incident as possible to request the information for that device for the period in question. Most often, Call Detail Records (CDR) give times in detail to the minute and round duration times up to the nearest minute.

Some CDRs can also provide information on the activated antenna of a base transceiver station (aka. cell site) which can provide a sector of area in which the device was likely located when it connected to the network. Figure 1 below shows a representation of what this data can indicate. Case law has upheld that though it is difficult to pinpoint the location of the device within the sector, the information can be useful in showing where the device was not. In Figure 1, it can be stated with reasonable technical certainty that the handset was not located in Lititz or Manheim.

On the Physical Device: Quantity and quality of data will vary again from make/model/software version. The device can provide the contents of messages sent as well as timing information down to the second. The device can also provide saved destinations, favorite destinations, geo-tagged images, and some locally stored navigation information. An example of a geo-tagged image is shown in Figure2.

Synched Accounts (including “Cloud” accounts): Synched accounts are virtual treasure troves for location data. Available data is heavily dependent on the application, user settings, and the frequency of use on the device. A few of the most common synched accounts include: iCloud, Facebook (Figure 3), Google (Figure 4), and Yahoo.

Many cellular phones (and certain other mobile devices) use GPS, Wi-Fi, and mobile networks to provide more precise location services. GPS signals may provide more precise locations in rural areas while Wi-Fi networks may provide more precise locations in urban environments. If a device is running a navigation application, a Wi-Fi based position that can place the device within a block of a street is often accurate enough for the device to provide the next turn or event of the navigation. It is important therefore to keep this in mind when conducting an analysis of location data from devices that use both GPS and Wi-Fi to prevent location data from being misinterpreted and misrepresented.

Vehicle Infotainment/telematics Systems

Many of the new vehicles on the market today come equipped with sophisticated navigation, communication, and entertainment systems. These systems, in the process of performing their functions, monitor and record a tremendous amount of data that may be helpful toward investigating vehicle crash events and other incidents.

This data is often stored on the vehicle system and requires special training, equipment, and software to extract and analyze. Figure 5 shows select information extracted from several different systems as noted.

Images are good at showing spatial relationships of location data, but images can fall short of showing the temporal relationships of location data. One alternative to static images is animating the data on a base map. This can be particularly effective when there are multiple moving devices and parties. Figure 6 shows a simulated collision between a car and a bicycle. Is distracted driving a potential causative factor?

Figure 6: Video showing animated GPS track with overlaid text messages and infotainment event data.

GPS & Mobile Device Data Investigations

The experts at Robson Forensic have specialized training, education, and experience to extract data from a broad range of systems and devices and interpret that information within the context of a specific incident.

Submit an inquiry to discuss your case and determine how Robson Forensic can assist with your investigation.