Location Data: Parsing Semantic Location History in Google Takeout

Oxygen Forensic® Detective can ingest and parse Google Takeout which consists of 47 various categories, which include “Location” data.

Android devices record a large amount of location information, typically without the user’s knowledge.

This is why parsing location data from Google Takeout can provide investigators with a good amount of evidence.

Table of contents

 

Parsing Semantic Location History in Google Takeout with Oxygen Forensic® Detective

There are two sources of location data in Google Takeout:

    1. Location History.json
    2. Semantic Location History JSON file

 

Location History.json

The first source is the ‘Location History.json’ file that contains raw coordinates and time stamps. This file has been already parsed by Oxygen Forensic® Detective.

Semantic Location History JSON files

The second source of location data is Semantic Location History JSON files that are saved per month. They contain detailed information about users’ visited locations and journeys. These important files are now parsed in Oxygen Forensic® Detective v.15.0.

There are two categories within Semantic Location History data:

      1. Visited Places
      2. Journeys

 

Visited Places

The first category of the Semantic Location History data is Visited Places. It contains the following data:

    • Time and duration of visit
    • Location information (geo coordinates, address, name, placeID)
    • Confidence of information that includes the information about location edits by a user

    Screenshot of Semantic History data from Google Takeout

    Journeys

    The second Activities category contains detailed information about journeys:

      • Time and duration of a journey
      • Start and end geo coordinates of a journey
      • Information about a journey (walking, cycling, in train, in passenger vehicle, etc.)
      • Confidence of information that includes the information about location edits
      • Waypoints information

     

    Signals of Manipulated Data

    Confidence in information contained in Semantic Location History files may help investigators to understand if location data was manipulated by a user. There are several signs of it:

      • Edited entries are set to 100.0 or they have ‘USER_CONFIRMED’ status.
      • Moreover, the Last Edited column will have a time stamp if an entry has been manipulated.

     

    Related Articles

     

    Get more from Oxygen Forensic® Detective

    At Oxygen Forensics our solution is updated multiple times every year. We offer training courses and webinars that will help you learn the ins and outs of Oxygen Forensic® Detective and stay up to date on new features and tools needed for your investigation. Returning customer? Sign up for our newsletter to stay in the loop.

    Don’t have Oxygen Forensic® Detective and want to try it out? Request a free trial.

Leave a Reply

Your email address will not be published. Required fields are marked *