Wednesday, October 23, 2019

Examining Maptiles from iOS

Examining Maptiles from iOS

(update 8/2/2020): I have just realized the iOS version used below was 7.1 release in 2014. Apple apparently changed the storage of these times directly to geo vector files around version 8 or 9.


During my last class at Champlain College Online, I ran across something that was interesting during an examination of GPS artifacts on iOS.

I noticed a cache for MapTiles located Data\mobile\Library\Caches\MapTiles\MapTiles.sqlitedb. SQL database contains an images tables as seen below:

If you export the "data" column, you get a set of images:
These images are squares caches by the iOS map application. These maybe cached when viewing the map or using the directions.

If these are placed together, they create a map as shown on Google Maps. I used PowerPoint to combine these images.

Now, you can take this on Google Maps and find this location. Using the location information already found within the iPhone, we can find this location (See below showing Google Maps screenshot of Burlington VT at I-89 and 2A)

Matching maptiles can be extremely difficult if someone does not have more information. I had other information from the device showing it might have been in the Burlington, VT area which is where I started the search.

No comments:

Post a Comment