Oxygen Forensic® Detective can ingest and parse Google Takeout which consists of 47 various categories, which include “Location” data.
Android devices record a large amount of location information, typically without the user’s knowledge.
This is why parsing location data from Google Takeout can provide investigators with a good amount of evidence.
Table of contents
- Parsing Semantic Location History in Google Takeout with Oxygen Forensic® Detective
- Semantic Location History
- Signs of Manipulated Data
Parsing Semantic Location History in Google Takeout with Oxygen Forensic® Detective
There are two sources of location data in Google Takeout:
- Location History.json
- Semantic Location History JSON file
Location History.json
The first source is the ‘Location History.json’ file that contains raw coordinates and time stamps. This file has been already parsed by Oxygen Forensic® Detective.
Semantic Location History JSON files
The second source of location data is Semantic Location History JSON files that are saved per month. They contain detailed information about users’ visited locations and journeys. These important files are now parsed in Oxygen Forensic® Detective v.15.0.
There are two categories within Semantic Location History data:
- Visited Places
- Journeys
Visited Places
The first category of the Semantic Location History data is Visited Places. It contains the following data:
- Time and duration of visit
- Location information (geo coordinates, address, name, placeID)
- Confidence of information that includes the information about location edits by a user
Journeys
The second Activities category contains detailed information about journeys:
- Time and duration of a journey
- Start and end geo coordinates of a journey
- Information about a journey (walking, cycling, in train, in passenger vehicle, etc.)
- Confidence of information that includes the information about location edits
- Waypoints information
Signals of Manipulated Data
Confidence in the information contained in Semantic Location History files may help investigators to understand if location data was manipulated by a user. There are several signs of it:
- Edited entries are set to 100.0 or they have ‘USER_CONFIRMED’ status.
- Moreover, the Last Edited column will have a time stamp if an entry has been manipulated.
Get more from Oxygen Forensic® Detective
At Oxygen Forensics our solution is updated multiple times every year. We offer training courses and webinars that will help you learn the ins and outs of Oxygen Forensic® Detective and stay up to date on new features and tools needed for your investigation. Returning customer? Sign up for our newsletter to stay in the loop.
Don’t have Oxygen Forensic® Detective and want to try it out? Request a free trial.