Google Play Services Location History

androidLocation DataDevice ExtractionCloud Admin Portal

Location

/data/data/com.google.android.gms/databases/ (various location-related .db files)

Description

SQLite databases within the Google Play Services (GMS) data directory that store location history, geofence events, and location request logs. Multiple database files may contain location data including herrevad.db, gservices.db, and phenotype.db, with precise GPS coordinates, accuracy estimates, altitude, speed, and bearing information.

Forensic Value

Google Play Services acts as a centralized location provider for all apps on the device, making its databases a comprehensive record of location data that spans all application requests. Location entries include accuracy radii and provider types (GPS, network, fused) that indicate how the position was determined. Geofence trigger events reveal when the device entered or exited predefined geographic boundaries, which is relevant for investigating proximity to crime scenes or restricted areas. The data often persists longer than app-specific location caches.

Tools Required

Cellebrite UFEDALEAPPMagnet AXIOMOxygen Forensic DetectiveDB Browser for SQLite