Google Maps Timeline and Location History

What it is

Google Location History was, for more than a decade, the richest location source tied to an Android phone: the device reported positions to Google, which stored them in the account and rendered them as the Maps Timeline. Because the data lived in the cloud, investigators obtained it through Google Takeout or legal process rather than from the handset.

That changed in 2024 and 2025. Google renamed the setting Timeline, moved storage to the device, and asked users to migrate their history before deadlines that ran into 2025; unmigrated cloud history was then deleted. Users can opt into an end-to-end encrypted cloud backup of their on-device Timeline. For current cases the handset is now the primary source, and the phone must be extracted to reach it.

Where it lives

Public research on the on-device store is still maturing. Identify the files on your own extraction by searching both sandboxes for recently modified databases and for known place names, and validate against a test device on the same app versions.

What it proves

• The device's position at specific times, with an accuracy radius per point, from GPS, Wi-Fi or cell sources.
• Inferred visits to places (with Google's place ID and sometimes name and address), with start and end times and a confidence value.
• Travel between places with an inferred activity (walking, cycling, in a vehicle, on a train) and distance.
• In legacy data, which device reported each point (deviceTag), useful when an account had several phones.

It does not prove who carried the phone. Inferred visits and activities are model outputs, not measurements: cite the raw points and their accuracy when location matters.

Key fields

Timestamps

Current exports use ISO 8601 strings with an explicit offset (2026-09-14T17:43:12.000+02:00): convert to UTC before merging. Older Records.json exports used timestampMs, Unix milliseconds as a string.

# Legacy Records.json: points on one day, UTC, degrees
jq -r '.locations[] | select(.timestamp | startswith("2023-06-14"))
  | [.timestamp, (.latitudeE7/1e7), (.longitudeE7/1e7), .accuracy, .source] | @csv' Records.json
# Timeline.json: place visits with start and end
jq -r '.semanticSegments[] | select(.visit) | [.startTime, .endTime, .visit.topCandidate.placeId] | @csv' Timeline.json

Retention

The user chooses auto-delete after 3, 18 or 36 months, or keeps everything, and can delete days or ranges manually. On-device Timeline disappears with the device or a factory reset unless the encrypted backup was on and the user restores it. Legacy cloud history that was not migrated has been deleted by Google; old Takeout archives held by the user or by a previous case may be the only remaining copy.

Collection

• Full file system extraction (AFU) of both the Maps and Play services sandboxes.
• Export from the phone with the user's cooperation, documented on video if possible.
• Takeout or legal process for historic cloud data, noting that Google may no longer hold it.

Parsing

• ALEAPP parses several on-device Google location artifacts; check its module list against your app versions.
• RLEAPP parses Google Takeout and legal-process returns, including Location History.
• jq handles both JSON formats for quick filtering and CSV export.
• Commercial suites parse Takeout JSON and some on-device stores.

Investigator tips

• Corroborate a visit with independent sources: Wi-Fi networks joined at the place, photo EXIF GPS, and Bluetooth pairings such as a car head unit.
• Check that the Google account holding the history is the one on the device in the accounts databases.
• Large accuracy radii (hundreds of metres) usually mean cell-based fixes; do not place someone in a specific building from them.
• The location forensics guide explains how to weigh these sources together.