Google Play Services Location History

Location

Description

SQLite databases within the Google Play Services (GMS) data directory that store location history, geofence events, and location request logs. Multiple database files may contain location data including herrevad.db, gservices.db, and phenotype.db, with precise GPS coordinates, accuracy estimates, altitude, speed, and bearing information.

Forensic Value

Google Play Services acts as a centralized location provider for all apps on the device, making its databases a comprehensive record of location data that spans all application requests. Location entries include accuracy radii and provider types (GPS, network, fused) that indicate how the position was determined. Geofence trigger events reveal when the device entered or exited predefined geographic boundaries, which is relevant for investigating proximity to crime scenes or restricted areas. The data often persists longer than app-specific location caches.

Tools Required

Collection Commands

adb pull /data/data/com.google.android.gms/databases/ /forensics/gms_dbs/

python3 aleapp.py -t tar -i /path/to/extraction -o /forensics/output/

adb shell dumpsys activity provider com.google.android.gms/.location > gms_location_dump.txt

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References