An iPhone Knows Your Significant Locations

Keep in mind that iPhones use a particular method to track the smartphone's location known as 'significant locations'. This function can be accessed under Privacy and Security in Location Services.

. . . after the list of app specific settings in Location Services you'll find 'System Services' [note the color coded flag of a gray arrow showing that an app has tracked the phone's location in the last 24 hours and a purple arrow when an app has tracked the location very recently.]

Scroll down and you'll see the 'Significant Locations' option.

Apple states that the location data is encrypted, and that it cannot access it itself - (unless it is subpoenaed to produce it??).

The Apple policy linked to under 'Significant Locations' states that it uses the data to track the movements of groups of people and automobile traffic. Note that Apple also reserves the ability to estimate your location based on your IP address.

Hash values of files sent via MMS can vary

Multimedia Messaging Service is used by cell phones to send video, audio and multiple images. It contrasts with Short Message Service that can only send text up to 160 characters in a message. Unlike other files collected from a mobile device, images sent on separate occasions via MMS can have different hash values. A study conducted by researchers at Purdue University concluded that, " While the results for the majority of tests were uniform, the hash values reported for data objects transferred via Multimedia Messaging Service (MMS) were variable." Shira Danker, Rick Ayers, and Richard P. Mislan, Hashing Techniques for Mobile Device Forensics, 3 Small Scale Digital Device Forensics J. No. 1 (June 2009).

The study shows that the same JPEG file sent via MMS on different devices at different times would have an entirely different hash value.

Whatsapp photos inadvertently saved on iPhone

When you’re collecting digital evidence from an iPhone keep in mind that WhatsApp may save photos to the phone by default- any

photos any group decides to forward to the phone’s owner. So the photos on the camera roll are not necessarily ones that the user saved.

Check under settings for WhatsApp, and under Chats . . .see if the option for ‘Save to Camera Roll’ is checked off.

It’s a good idea to keep this deactivated not only to save storage space but also to avoid any confusion about where suspect photos on a cell phone came from.