Maps Visited Places & Search History
iOSLocation DataDevice Extraction
Location
Maps app data in HomeDomain/Library/Maps/ and related location history stores such as GeoHistory.mapsdataCommon Names
GeoHistory.mapsdataMaps recentsVisited PlacesMapsSync
Description
Apple Maps local state and history covering searched destinations, visited places, parked-car markers, recents, and other map-related user activity synchronized through the Maps application and location services.
Forensic Value
Maps history is valuable for proving route planning, location intent, and revisited places even before actual travel occurs. It can show searched addresses, categories of visited locations, and context around why a device was in a certain area. In incident response cases, these artifacts help correlate user movement with travel to an office, data-drop, safe house, or meeting location, and can complement system-level significant-location caches with more user-driven intent.
Tools Required
Cellebrite UFEDiLEAPPAPOLLOMagnet AXIOMDB Browser for SQLite
Collection Commands
Cellebrite UFED
Perform a full filesystem or advanced logical extraction and review Apple Maps application data.
APOLLO
python3 apollo.py -o /forensics/output/ -k ios -v maps /path/to/extraction/
iLEAPP
python3 ileapp.py -t tar -i /path/to/ios_extraction -o /forensics/output/
Collection Constraints
- •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
- •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.
- •Maps history depends on location permissions, iOS release, and whether specific features like Visited Places or parked-car markers were enabled. Storage paths and schema vary between versions.
MITRE ATT&CK Techniques
T1430T1421T1426