Area 05
Location evidence on Android is scattered: saved and recently joined Wi-Fi networks, Google Maps Timeline (which moved from the cloud to on-device storage in 2024 and 2025), cell and network records in system dumps, and GPS coordinates in photos. This area explains each source, how precise it is, and how to avoid over-reading a single point.
Key artifacts
Saved Wi-Fi networks on Android: WifiConfigStore.xml paths per version, SSIDs, keys, creator app, per-network randomized MAC, connection status and caveats.
Android 8-16
Google Location History and Maps Timeline: the legacy cloud Records.json, the 2024 to 2025 move to on-device storage, Timeline.json exports and what remains.
Android 8-16
Android photos and videos as evidence: DCIM naming, EXIF time and GPS, the MediaStore external.db index, owner package, trash and thumbnail caches.
Android 8-16
Android Bluetooth evidence: paired devices in bt_config.conf with names, classes and pairing times, dumpsys bluetooth_manager and HCI snoop logs.
Android 8-16
Place an Android phone in space and time: Google Maps Timeline after the on-device move, Wi-Fi and Bluetooth, cell data, photo EXIF, and how to weigh them.