Examining MapTiles from iOS

Examining MapTiles from iOS

(update 8/2/2020): I have just realized the iOS version used below was 7.1 release in 2014. Apple apparently changed the storage of these times directly to geo vector files around version 8 or 9.

During my last class at Champlain College Online, I ran across something that was interesting during an examination of GPS artifacts on iOS.

I noticed a cache for MapTiles located Data\mobile\Library\Caches\MapTiles\MapTiles.sqlitedb.

SQL database contains an images table

If you export the "data" column, you get a set of images:

Map Tiles from SQLite DB

These images are squares caches by the iOS map application. These maybe cached when viewing the map or using the directions.

If these are placed together, they create a map as shown on Google Maps. I used PowerPoint to combine these images.

MapTiles stitched together

Now, you can take this on Google Maps and find this location. Using the location information already found within the iPhone, we can find this location (See below showing Google Maps screenshot of Burlington VT at I-89 and 2A).

Google Maps screenshot of Burlington VT at I-89 and 2A

Matching maptiles can be extremely difficult if someone does not have more information. I had other information from the device showing it might have been in the Burlington, VT area which is where I started the search.