Page 1
IOSLOCATIONSERVICES · A GUIDE FOR UK LAWYERS iOS Location Services, Significant Locations and Frequent Locations The Places a Phone Remembers, and Why It Matters Where the Location Came From COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACCURACY & CONVERGENCE ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone remembers where it has been 03 Where iOS keeps location 04 Significant Locations and its protection 05 Accuracy: not all location is equal 06 Attribution, convergence and honest limits 07 Deployment: placing a phone in time and place 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: iOS keeps location in several places, the encrypted Significant Locations record, app location, cached network and system location, and photo geotags, which together can place a phone in time and place with force, provided location is attributed and its accuracy read honestly, and Significant Locations is reached law full y.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone remembers where it has been
§ 03 · WHEREIOSKEEPSLOCATION Where iOS keeps location SIGNIFICANT APP LOCATION NETWORK / CELL PHOTO GEOTAGS CONVERGE LOCATIONS
Page 2
§ 04 · SIGNIFICANTLOCATIONS Significant Locations and its protection
§ 05 · ACCURACY Accuracy: not all location is equal
§ 06 · ATTRIBUTIONANDHONESTLIMITS Attribution, convergence and honest limits
§ 07 · DEPLOYMENT Deployment: placing a phone in time and place
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BACKUP / SIGNIFICANT APP / PHOTO NETWORK / CARRIER INDEPENDENT LOCATIONS LOCATION CELL (DEVICE) CELL-SITE (CCTV/ANPR) ICLOUD / PAIRED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECONVERGENCETHATPLACEDTHEPHONE EXAMPLE2 · THECELLFIXTHATWASONLYANAREA EXAMPLE3 · SIGNIFICANTLOCATIONSREACHEDLAWFULLY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOSLOC AT IONANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iOS location checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What is Significant Locations? Does location prove where a person was? Is all location data equally accurate? How do you make a location finding reliable? Can you get Significant Locations off a locked phone? Is location data sensitive in data-protection terms?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Location Services Significant And Frequent Locations, Computer Forensics Lab, https://e-discovery.uk/library/ios-location-services-significant-and-frequent-locations/pdf.