Mobile Forensics: Extracting Geo-Location Data From Photos On Android Smartphones
Mobile Forensics: Extracting Geo-Location Data From Photos On Android Smartphones
Abstract:- With the rapid advancement of technology and Other mobile operating systems make up only a fraction
communication, smartphones have become ubiquitous, of the total market share, standing at 0.2%. This dominance
offering functionalities such as geo-location-based photo makes Android smartphones a critical platform for studying
capturing through GPS and navigation applications. and implementing geolocation technologies, especially
Digital forensic examiners can retrieve location data from within the field of mobile forensics.
Exchangeable Image File Format (EXIF) metadata
embedded in photos, commonly referred to as Modern Android smartphones and digital cameras (see
“geolocation,” which is crucial in criminal investigations. Fig 1) have the capability to save GPS coordinates within the
Modern Android smartphones and digital cameras store metadata of every photo taken. This metadata, embedded
GPS coordinates in every captured photo, allowing within the Exchangeable Image File Format (EXIF), includes
forensic analysts to leverage this information to solve critical information such as the device's location, date, and
cases. This paper demonstrates the process of manually time when the photo was captured. Forensic investigators can
extracting geographical identification data (latitude, analyze this data to trace the physical movements of
longitude, altitude) from raw image files using Hex editor individuals or objects, making it invaluable in criminal
tools and validating the results with Google Maps. These investigations. The process of identifying the geographical
methods aid forensic investigators and law enforcement origin of an item through its properties is referred to as
agencies by providing evidence that can be presented in forensic geolocation [3], [4], [5].
court.
EXIF, which was developed by the Japan Electronic
Keywords:- Geo-Location, GPS, Android, EXIF Meta- Data, Industries Development Association (JEIDA), is now an
Mobile Forensics, Longitude-Latitude – Height international standard supported by both the Tagged Image
File Format (TIFF) and JPEG formats [6], [7], [8]. The EXIF
I. INTRODUCTION metadata contains not only geotagging information but also
various other technical details such as camera settings (ISO
The ability to determine our precise location on Earth speed, focal length, shutter speed), date and time, image
has fascinated humankind for centuries. Ancient Greeks were orientation, and copyright information. The inclusion of
among the first to triangulate their geographical position geographic information (Geo-Tags) such as latitude,
using the stars over 2,000 years ago [1]. This early curiosity longitude, and altitude within an image is what transforms a
has evolved into modern geolocation technologies that now regular photo into a geotagged image.
allow us to pinpoint locations with extraordinary accuracy.
Geolocation, in its current form, refers to the process of A geotagged image is a powerful resource in digital
determining the physical geographic location (latitude, forensics, as it contains geographical identification data that
longitude, and altitude) of a device, such as a computer or can be used to track the location of where the image was
smartphone, using various technological systems. In this taken. While numerous mobile forensic tools are available to
digital age, where mobile devices play a central role in extract geotag data from photos, understanding the
communication, navigation, and information sharing, underlying mechanisms of these tools is essential for forensic
geolocation has become an integral part of daily life. analysts. The ability to manually extract geolocation data
from images provides a deeper understanding of how these
With the widespread use of smartphones, particularly tools function, and in some cases, can prove crucial when
Android devices, the implementation of geolocation automated tools fail to perform. This paper explores the
technology has grown exponentially. Android, being the manual extraction of geotag data from images on Android
market leader with a global market share of 87.7%, is the smartphones by examining the byte-level information stored
operating system of choice for millions of users, followed by in the EXIF metadata using Hex editor tools.
iOS, which holds 12.1% of the market [2].
C. Related Work
Several research efforts have focused on the extraction
and analysis of geolocation data for forensic purposes [24],
[25], [26], [27], [28], [29], [30], [31], [32], [33]. In 2013,
Stefan Sack, Knut Kröger, and Reiner Creutzburg conducted
research on location tracking forensics using mobile devices. Fig. 2. Android System Architecture System [6]
They explored three different procedures for extracting
positional data from various devices and analyzed how these Table 1: List of Mobile Forensic Tools
methods could be applied to different classes of devices.
Another significant study, conducted in 2008 by Hsiang-
Cheh, Yueh-Hong, and Shin-Chang, examined how EXIF
data can be used as a binary watermark in images, further
contributing to the understanding of geotagging in digital
forensics [22].
A. Research Tools
The following tools were used in this experiment:
Mi 9T Pro Smartphone
Model: M1903F11G
Android version: 10 (QKQ1.190825.002)
MIUI version: Global 12.0.3 Stable
Kernel version: 4.14.117-perf-g7428a5b
Original Type-C Cable for Xiaomi Mi 9T Pro IV. DATA ANALYSIS AND FINDINGS
Used for fast charging and data transfer between the
mobile device and the investigation workstation. To verify the geolocation data embedded in an image on
a Windows operating system, a simple method is to right-
Workstation click on the image, choose “Properties,” and navigate to the
Asus Computer (i7, 6th generation) “Details” tab, where the EXIF metadata, including
Operating System: Windows 10 Pro geotagging information, can be viewed (as shown in Fig 3).
Image Capture
After enabling the geolocation service, an image was
captured using the Mi 9T Pro’s native camera application.
This image was automatically tagged with geolocation data
as part of the EXIF metadata embedded in the file.
Data Transfer
The captured image was transferred from the Mi 9T Pro
smartphone to the workstation via th …….e original Type-C
cable. The cable ensured fast and secure data transfer,
necessary for preserving the integrity of the image file and its
metadata. Fig. 3. Image Properties in Windows OS
Hexadecimal Analysis Alternatively, several tools can extract geotag and other
Once the image was successfully transferred to the relevant information from images, such as ExifTool GUI,
workstation, the HxD Hex Editor tool was used to open the Metadata++, or various free online services [24]. For this
image file. By examining the hexadecimal representation of study, we opted to manually extract the geolocation data
the image, we manually extracted the geotagging embedded in an image using the HxD Hex Editor tool. The
information. This involves identifying specific patterns manual extraction process ensures a deeper understanding of
within the EXIF metadata that correspond to geographical the underlying structure of EXIF metadata and helps in cases
data such as latitude, longitude, and altitude, as outlined in where automated tools might fail.
the Data Analysis and Findings section.
To achieve this, the following steps were followed:
Fig 4 illustrates a hexadecimal view of the image file as Capture a geo-tagged image using a Mi 9T smartphone.
displayed by the HxD Hex Editor. Use the HxD Hex Editor tool to examine the image and
locate direction letters (N, S, E, W).
Identify the patterns in the hexadecimal values, such as
"0x00 00 00 01" and "0x00 00 27 10."
Perform calculations on the extracted values to convert
them into meaningful geographic coordinates.
Longitude Calculation:
Fig. 4. Hexadecimal View of an Image from Mi 9T Degrees: The four bytes following "00 00 27 10" are "00
Smartphone using the HxD Hex Editor Tool 00 00 23" (offset: 3090–3093), which equals 35 in
decimal. Therefore:
Value of degrees: 35 / 1 = 35
C. Identification and Calculations Altitude = 112,140 / 1,000 = 112.14 meters above sea level
REFERENCES
[10]. N. Rahimi, J. Nolen, and B. Gupta, “Android Security [27]. E. Y. Daraghmi, C. H. Hsiao, and S. M. Yuan, “A New
and Its Rooting—A Possible Improvement of Its Cloud Storage Support and Facebook Enabled Moodle
Security Architecture,” J. Inf. Secur., vol. 10, no. 02, pp. Module,” in 2014 7th International Conference on Ubi-
91–102, 2019, doi: 10.4236/jis.2019.102005. Media Computing and Workshops, Ulaanbaatar,
[11]. S. Sack, K. Kröger, and R. Creutzburg, “Location Mongolia: IEEE, Jul. 2014, pp. 78–83. doi: 10.1109/u-
tracking forensics on mobile devices,” in Multimedia media.2014.12.
Content and Mobile Devices, 2013, p. 866712. doi: [28]. E. Y. Daraghmi, C.-F. Lin, and S. M. Yuan, “Mobile
10.1117/12.2003952. Phone Enabled Barcode Recognition for Preferences
[12]. W. Sturdevant, “NAVSTAR, the Global Positioning Monitoring,” in Advances in Computer Science and
System: A Sampling of Its Military, Civil, and Education Applications, vol. 202, M. Zhou and H. Tan,
Commercial Impact,” Hist. Backgr., vol. 5, no. Eds., in Communications in Computer and Information
September, pp. 32–45, 1994. Science, vol. 202. , Berlin, Heidelberg: Springer Berlin
[13]. “Google Maps’ biggest moments.” [Online]. Available: Heidelberg, 2011, pp. 297–302. doi: 10.1007/978-3-642-
https://blog.google/products/maps/look-back-15-years- 22456-0_43.
mapping-world/ [29]. E. Y. Daraghmi and Y. S. Ming, “Using graph theory to
[14]. “Naval Radar Systems.” [Online]. Available: re-verify the small world theory in an online social
https://www.nrl.navy.mil/accomplishments/systems/nav network word,” in Proceedings of the 14th International
al-radar-systems/ Conference on Information Integration and Web-based
[15]. “SOS in Computer Science and Applications Jiwaji Applications & Services, Bali Indonesia: ACM, Dec.
University (II) Advantages, features, API levels.” 2012, pp. 407–410. doi: 10.1145/2428736.2428811.
[16]. “Sputnik.” [Online]. Available: [30]. E. Daraghmi, C.-P. Zhang, and S.-M. Yuan, “Enhancing
https://history.nasa.gov/sputnik.html Saga Pattern for Distributed Transactions within a
[17]. “What is Galileo?” [Online]. Available: Microservices Architecture,” Appl. Sci., vol. 12, no. 12,
http://www.esa.int/Applications/Navigation/Galileo/Wha p. 6242, Jun. 2022, doi: 10.3390/app12126242.
t_is_Galileo [31]. E.-Y. Daraghmi, M.-C. Wu, and S.-M. Yuan, “A
[18]. “Celebrating 10 years of GPS for the masses.” [Online]. Multilayer Data Processing and Aggregating Fog-Based
Available: Framework for Latency-Sensitive IoT Services,” Appl.
https://www.cnet.com/tech/mobile/celebrating-10-years- Sci., vol. 11, no. 4, p. 1374, Feb. 2021, doi:
of-gps-for-the-masses/ 10.3390/app11041374.
[19]. “A brief history of GPS.” [Online]. Available: [32]. E.-Y. Daraghmi and A. Hamoudi, “THE
https://www.pcworld.com/article/2000276/a-brief- DEVELOPMENT OF A BLOCKCHAIN-BASED
history-of-gps.html SYSTEM FOR ELECTRONIC VOTING,” . Vol., no.
[20]. “Magellan NAV 1000 GPS Receiver, 1988.” [Online]. 17.
Available: https://timeandnavigation.si.edu/multimedia- [33]. Y. Salem and E.-Y. Daraghmi, “GDPR-BLOCKCHAIN
asset/magellan-nav-1000-gps-receiver-1988 COMPLIANCE FOR PERSONAL DATA: REVIEW
[21]. “Facebook And Factual Expand Global Geo-Data PAPER,” . Vol., no. 23, 2021.
Alliance.” [Online]. Available:
https://geomarketing.com/facebook-and-factual-expand-
global-geo-data-alliance
[22]. “Navstar: GPS Satellite Network.” [Online]. Available:
https://www.space.com/19794-navstar.html
[23]. “Best Exif viewers and editors.” [Online]. Available:
https://www.techgenyz.com/2020/02/25/best-exif-
viewers-to-scan-photo-details/
[24]. Z. Alsaed et al., “Role of Blockchain Technology in
Combating COVID-19 Crisis,” Appl. Sci., vol. 11, no.
24, p. 12063, Dec. 2021, doi: 10.3390/app112412063.
[25]. E. Daraghmi, “Augmented Reality Based Mobile App
for a University Campus,” 2017, doi:
10.13140/RG.2.2.36356.24962.
[26]. E. Daraghmi, Z. Qaroush, M. Hamdi, and O.
Cheikhrouhou, “Forensic Operations for Recognizing
SQLite Content (FORC): An Automated Forensic Tool
for Efficient SQLite Evidence Extraction on Android .
Devices,” Appl. Sci., vol. 13, no. 19, p. 10736, Sep.
2023, doi: 10.3390/app131910736.