CityMapper Android: A Navigation App with Forensic Artifacts

Citymapper is a popular navigation app that focuses on pedestrian and public transit navigation within city centers and urban areas. As part of my Digital Forensics Research (DFOR) project, I analyzed the forensic artifacts present in the Citymapper app for Android to understand the information it can provide about users' activities.

The Citymapper app stores various pieces of information that can be useful for forensic analysis. The main database contains tables describing favorited navigation trips, locations, searched histories, and recent trips taken with the app. These tables can help a forensic examiner determine basic user information, including their work and home addresses, as well as their location history over time.

Additionally, ADB backups of the app contain preference files that include fields such as the user's first name, last name, email address, phone number, and device location when the app was first opened. This means that a logical extraction is all that's required to obtain configuration files and the main database, without needing to root the device.

Configuration Files and Main Database

Citymapper's configuration files contain information about user preferences and settings. The main database stores trip history, favorited locations, and searched queries. By analyzing these files and databases, forensic examiners can gain insights into users' navigation habits, travel patterns, and interests.

Citymapper is a navigation app that provides valuable information about its users through various forensic artifacts. By understanding the types of data stored in the app's configuration files and main database, forensic examiners can better analyze user activity and provide valuable evidence in investigations. This project aims to raise awareness about the potential for digital forensics in Android apps like Citymapper and highlight the importance of considering these artifacts when conducting investigations.

City mapper android