Page 1
ANDROIDLOCATION · A GUIDE FOR UK LAWYERS Android Location: Fused Location, Wi-Fi and Cell Data How an Android Phone Works Out Where It Is, What It Keeps, and Why the Source of a Fix Governs Its Weight COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM SOURCE, ACCURACY & CONVERGENCE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a fix is only as good as its source 03 How Android derives location: the fused model 04 Where Android keeps location 05 Accuracy by source: point, locality, area 06 Attribution, convergence and honest limits 07 Deployment: placing a phone in time and place 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an Android phone fuses satellite, Wi-Fi, cell and sensor signals into a single location whose accuracy depends entirely on which signals fed it, and keeps that location in Google's Location History, the phone's caches, app databases, photo metadata and cell and Wi-Fi records, so the source of every fix must be established because it governs the fix's accuracy and weight, and a placement rests on sources converging.
§ 02 · FIRST PRINCIPLES The problem in plain English: a fix is only as good as its source
§ 03 · THE F USED MODEL How Android derives location: the fused model GNSS WI-FI CELL SENSORS FUSED + ACCURACY
Page 2
§ 04 · WHEREITLIVES Where Android keeps location
§ 05 · ACCURACY BY SOURCE Accuracy by source: point, locality, area
§ 06 · ATTRIBUTIONANDCONVERGENCE Attribution, convergence and honest limits
§ 07 · DEPLOYMENT Deployment: placing a phone in time and place
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LOCATION RECORDS CELL- GOOGLE CELL / WI-FI CARRIER HISTORY (DEVICE) SITE PHONE CACHES / WEARABLE / INDEPENDENT APPS / COUNTERPART (CCTV / ANPR) PHOTOS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEFUSEDFIXTHATWASREALLYACELLFIX EXAMPLE2 · THECONVERGENCETHATPLACEDTHEPHONE EXAMPLE3 · THEPAUSEDHISTORYANDTHECACHESTHATREMAINED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROIDLOC AT IONANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android location checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How does an Android phone know where it is? Where does an Android phone keep its location? A location record shows an exact coordinate. Isn't that precise? Google Location History is empty. Does that prove the person didn't travel? How do you make an Android location finding reliable? Does location prove where a person was?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 or CrimPR Part 19. This guide continues the Android block. Conflicts checks, confidential scoping discussions Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Location Fused Location WiFi And Cell Data, Computer Forensics Lab, https://e-discovery.uk/library/android-location-fused-location-wifi-and-cell-data/pdf.