A phone may contain several records associated with place, but they do not all describe the same event. Some are device sensor estimates. Others are cached searches, application defaults, cell-sector associations, photo metadata, paired-device records, or account activity. Accuracy values may describe an estimated uncertainty radius rather than a tested error for that individual observation. The examiner should identify how each record was created before placing it on a map.
Name the location source precisely
Potential sources include device location databases, application records, Wi-Fi observations, cell-site or sector records, navigation history, photographs, health activity, vehicle systems, cloud account data, carrier records, and third-party business systems. Each has different retention, precision, clock behavior, collection limits, and meaning. A cell-sector association is not GPS. A geotag may describe the media or an edit rather than the device at capture. An account event may reflect remote access. A coordinate without its source context is not a complete finding.
Normalize time before drawing a route
Mobile databases may store UTC, local time, offset values, Apple or Unix epochs, server time, device time, or application-specific formats. Daylight-saving transitions and travel can create apparent reversals. The analysis retains the original value and conversion rule, then compares it with known events and independent records.
- Preserve original coordinates, timestamps, and accuracy fields
- Identify whether the record reflects device, account, network, or content location
- Test for sync, cache, import, edit, or platform-processing effects
- Compare independent sources before attributing a person to a place
- State the precision and gaps on the map and in the report
Device association is not personal identity
A device or account can be shared, left behind, remotely accessed, or carried by someone else. Location evidence may establish that a device generated or stored a record. Attribution to a particular person normally requires corroborating facts supplied by the record or established elsewhere.