GPS and Location Forensics

What it is and why it matters

A device learns where it is in several ways and each way has its own accuracy. Satellite positioning from GPS, GLONASS, Galileo, BeiDou and India's NavIC can give a fix within a few metres under an open sky and much worse between tall buildings. A phone also estimates position from the cell tower it is registered to, which can place it within a few hundred metres in a city and several kilometres in the countryside, and from the Wi-Fi networks and Bluetooth beacons it can hear, which can be very precise or badly wrong when a router has moved.

These estimates are recorded in more places than most people realise. Photos carry coordinates in their metadata. Map, ride, delivery and fitness apps keep histories. The operating system keeps caches of recent fixes and significant places. Vehicles, trackers and smartwatches keep logs of their own. Operators keep call detail records with the cell used for every call and message. Providers keep account-level timelines, though some have moved that storage onto the device itself in recent years.

The examiner's job is less about finding a dot on a map than about saying what the dot means. Every fix has a source, a time basis and an error. A tower record places the phone within a sector, not at the tower. A photo's coordinates come from the phone, not the camera lens. Presenting these distinctions clearly is what separates location evidence that holds up from location evidence that collapses under one good question.

Types of digital evidence

Coordinates in Photos and Video
EXIF latitude, longitude, altitude and GPS time written when a photo was taken, usually from the phone's last fix rather than a fresh one.
App Location Histories
Routes and places stored by map, navigation, ride hailing, food delivery, fitness and dating apps, each with its own format and precision.
System Location Caches
The operating system's records of recent fixes, frequently visited places and the method used, kept in protected databases on iOS and Android.
Cell Records
Call detail records and tower dumps from the operator showing the cell and sector used for each call, message or data session.
Wi-Fi and Bluetooth History
Networks joined and seen, with names, hardware addresses and times, which can be matched to known locations.
Vehicle and Tracker Logs
Tracklogs from navigation units, telematics, AIS 140 devices and aftermarket trackers.
Dedicated GPS Devices
Handheld receivers, running watches and tracking units with waypoints, tracks and routes stored in their own formats.
Account Timelines
Location history kept under a provider account, obtainable through the account holder or by lawful request, subject to the provider's current storage model.

Devices and data sources

Smartphones and tablets, both the system caches and individual apps
Photos and videos wherever they are stored, including shared copies that may have lost their metadata
Smartwatches and fitness bands with their own GPS receivers
Vehicle navigation and telematics units
GPS trackers fitted to vehicles, goods and people
Handheld GPS receivers and sports devices
Mobile operator records obtained by lawful requisition
Provider accounts for maps, photos and fitness services
Wi-Fi routers and access points with their connection logs

How an examination runs

The order matters. Each step protects the one after it.

01
Define the Question
Write down what the case needs to know, which may be one moment or a route over days. The scope decides which sources are worth pursuing.
02
Collect Each Source Lawfully
Device extractions, operator records, provider data and vehicle logs each need their own authority. Record what was requested, from whom and what was received.
03
Normalise
Convert every record to one coordinate system (WGS 84 in decimal degrees) and one time basis, usually UTC, keeping the originals. Watch for epoch formats, local time stored as UTC and daylight saving in foreign data.
04
Grade Each Record
Note the positioning method, the horizontal accuracy the device reported and the known behaviour of the source. A cell record, a Wi-Fi estimate and a satellite fix are not interchangeable.
05
Map and Compare
Plot the records with their error radii and look for agreement and conflict between sources. Agreement between independent sources is strong. A single source is a lead.
06
Check for Artefact Traps
Stale fixes copied into photos, a router that moved, a tower sector drawn as a circle, a phone left in a car. Each has fooled an examiner before.
07
Report With Limits
Present the findings with the error of each record, the gaps in time and the alternatives that the data cannot exclude.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

GNSS: Global Navigation Satellite System, the general term for GPS, GLONASS, Galileo, BeiDou and NavIC together. Modern receivers use several at once.
NavIC: India's regional satellite navigation system run by ISRO, covering India and the surrounding region. Newer phones sold in India include NavIC support.
Cell ID: The identifier of the cell and sector a phone was using. It appears in operator records and places the phone within that sector's coverage, not at a point.
Tower Dump: An operator record of every device that used a given cell in a window of time, obtained by lawful request and used to find devices near a scene.
Wi-Fi Positioning: Estimating location from the identities of nearby Wi-Fi networks matched against a database of where those networks have been seen.
Horizontal Accuracy: The radius, in metres, within which the device believes the true position lies. It is stored with many fixes and should be reported with them.
WGS 84: The reference datum used by GPS and by most mapping. Coordinates in another datum must be converted before comparison.
Assisted GPS: Using network data to speed up a satellite fix. The first fixes after power-on can still be coarse, which matters when reading the start of a track.
Epoch Timestamp: A count of seconds or milliseconds since a reference date such as 1 January 1970 or 1 January 2001. Different apps use different references, and misreading one shifts every event by years.

Challenges and limits

What makes it hard

A single location record can be metres or kilometres off depending on how it was obtained, and tools do not always show which
Tower records place a phone in a sector that can cover a large area, and drawing it as a point misleads
Phones write the last known fix into photos, so a picture can carry a position from minutes earlier
Providers change what they store and where, so account timelines may be shorter or absent compared with a few years ago
Location data is deeply personal and belongs to more people than the suspect, which raises consent and proportionality questions
Time zones, daylight saving in foreign data and mixed epoch formats cause errors that look like real movement
Spoofed GPS and mock location apps exist, so device-side fixes should be checked against independent sources

Keeping the evidence intact

Keep the original records in their native format and perform conversions on copies, with the conversion method written down
Record the positioning method and accuracy figure for each fix used in a finding
Document the time basis of every source and the offset applied
Use two independent sources before stating that a device was at a place at a time
Hash operator and provider files on receipt and keep the request and response correspondence with them

Standards and legal considerations

NIST SP 800-101 Rev. 1
Guidelines on Mobile Device Forensics, which covers the acquisition of the handset where most location records are found.
Read the guide
SWGDE Best Practices for Portable GPS Device Examinations
SWGDE's 2018 document on acquiring and analysing dedicated GPS units, their handling, documentation and reporting.
Read the guide
ISO/IEC 27042:2015
Guidelines for the analysis and interpretation of digital evidence, which frame how an examiner separates a recorded fix from the inference drawn about a person.
Read the guide
Bharatiya Nagarik Suraksha Sanhita, 2023
The procedural law under which investigating officers requisition call detail records, tower dumps and other operator data.
Read the guide
Bharatiya Sakshya Adhiniyam, 2023
The evidence law governing how electronic location records are admitted, including the certificate requirement and the room for expert opinion.
Read the guide

In practice

An Alibi and Three Sources
A suspect says they were at a relative's house across town. The phone's system cache shows satellite fixes with ten-metre accuracy near the scene, the operator's record shows the phone on a cell sector covering the scene and a food delivery app logged a drop at an address two streets away. Three independent sources agree, and the examiner reports each with its accuracy.
The Photo That Moved
A photo offered as proof of a meeting carries coordinates at a hotel. The phone's location cache shows the fix was obtained forty minutes earlier and the camera database shows the photo was taken after the phone had lost satellite signal indoors. The examiner reports that the coordinates are a stale fix, not the place of capture.
A Tracker Under a Car
A complainant finds a small device under her car. The examiner identifies the tracker model, reads its stored tracks and identifies the vendor portal that received its reports. The investigating officer uses that to request the account holder's details from the vendor.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsIntermediateDCMFE

MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone casesIntermediateDCMFE

VideoSurveillance & Image / Video ForensicsImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveBeginner

AdvancedAdvanced & Specialised ForensicsOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkIntermediate

Careers that use it

Mobile Forensic Analyst

Questions people ask

How accurate is a phone's location?

It depends on the method. A satellite fix under open sky is usually within a few metres. Wi-Fi estimates vary from a few metres to badly wrong. A cell record places the phone within a sector that can span hundreds of metres or several kilometres. Good reports state the method and the accuracy for every fix they rely on.

Can a tower record prove someone was at a scene?

On its own, no. It shows the phone used a cell whose coverage includes the scene and a good deal more. It becomes stronger when device-side records, other devices or witnesses agree.

Do photos always contain location?

Only if the camera app had location permission and a fix was available. Copies sent through most messaging apps have the metadata stripped. Even when present, the fix may be older than the photo.

Can location history be obtained from a provider?

Sometimes, through the account holder or a lawful request. What providers store changes, and some have moved location timelines onto the device, so the answer must be checked for each provider at the time of the case.

Is it possible to fake a location?

Yes. Mock location settings, GPS spoofing apps and edited metadata exist. That is why examiners look for agreement between independent sources rather than trusting one record.