2

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The interesting thing is that you can get the Access Point ID (SSID/Cell ID) to which the phone was connected in different moments. The Cell ID field, however, is encoded and I have not found any documentation on how to obtain the relevant data that would allow me to get the location of the Cell. So far I have only been able to recover the MCC and MNC by base64-decoding the string contained in the field, but I cannot find the Area Code and Cell ID that would allow me to geolocate the cell (by using https://location.services.mozilla.com/, for example).

I'm wondering if any people around here has gone through this and knows how to do it.

3
  • Are you trying to real time analyse where a phone is or try and analyse where a phone has been when you have physical access. I've just run this android package through drozer, it exposes multiple content providers, it may be worth looking at these a little closer to see if one could be exploited. If you haven't already might be worth pulling the apk and reversing it, see if it gives up anything interesting.
    – iainpb
    Mar 5 '18 at 10:38
  • The second one. I took an old phone for a trip for a few days, used it in many ways, extracted a forensic image and now I'm looking at the traces that my activity left on the device. I'm trying to "know" where the device has been. Reverse engineering the app that writes to this database is an option, but maybe someone has done it before and saves me and the community the time to do it :)
    – Charlie4n6
    Mar 5 '18 at 11:00
  • If it's any use you can get current lac and cid id by putting the device into engineer mode and going to location based services > misc. If you know the current ones, it might help you to spot them in the db.
    – iainpb
    Mar 5 '18 at 14:04
0

You have to input the herrevad.fb file to a online site like cellid and they will return to you decoded entry with the exact location shown on a satellite map and you will be able to track the android location history.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.