Android Forensics: Autopsy Module for Extracting Mapping Applications Data

Abstract

The use of mobile devices in crime has become increasingly prevalent. Mapping applications play a major role in that criminals can use these applications' features to plan criminal activities. In this project, add-on modules were developed to extract location data from Android devices. The modules were created using the open-source forensic software Autopsy. It was found that extracted data such as users' navigations history, longitude and latitude GPS coordinates, and timestamps were stored in devices in an unencrypted format. As a result, five pieces of software present location data from Google Maps, MapQuest, Waze, Karta GPS, and Maps.Me in a human-readable table view.