Locating location artifacts
In the first part of this chapter, we introduced the Location Services API and learned how iOS uses different technologies to assess its position. Now, we'll take an in-depth look at the SQLite databases where geolocation data is stored.
The following is a list of files of interest that can only be found in a full filesystem extraction:
/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite
This is the primary storage means for iOS location data. The ZRTCLLOCATIONMO table contains several useful records, such as GPS coordinates, timestamps, and a horizontal accuracy value, which is an indicator of how accurate the device believes the GPS coordinates to be. The ZRTWIFIACCESSPOINTMO table stores a list of Wi-Fi networks that the device has scanned. Generally speaking, data contained in this database should be considered up to date and accurate.
/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite
...
