Audio files can easily be overlooked in digital forensic investigations. The eco-system for automated analysis just doesn’t exist in the same way that it does for other artefacts such as images and videos. But audio can provide some insightful information.

Google Maps

Google Maps generates directions in audio form during a navigated journey. What’s more, the files are saved with an epoch time stamp within their file name. These files are saved in the below directory on Android.

/data/data/com.google.android.apps.maps/app_tts-cache/

Let’s take a look at Josh Hickman’s public Android 12 image – compare his notes to transcripts of the audio and researched directions from google.

Journey to Los Tres Magueyes

Date	Time	Action
04/12/2021	17:14	Searched for “Los Tres Magueyes”
	17:15	Started navigation to Los Tres Magueyes (325 North Main Street, Holly Springs, North Carolina 27540)

Date	Time	Transcript
04/12/2021	17:15:11	Head South West on Sweet Vista Lane towards Ancient Oaks Drive, then turn left onto Ancient Oaks Drive.
	17:15:32	Take the next left onto Ancient Oaks Drive, then turn left onto Holly Springs New Hill Road.
	17:15:34	Take the next left onto Holly Springs New Hill Road, New Hill Road.
	17:15:35	Continue on New Hill Road for one and a half miles.
	17:15:35	Use the left lane to turn slightly right onto North Carolina 55 Bypass East, then use the second from the left lane to make a U-turn.
	17:15:35	In 600 feet, use the left lane to turn slightly right onto North Carolina 55 Bypass East.
	17:15:36	– No content –
	17:15:36	Turn right onto West Holly Springs Road.
	17:15:36	Use the second from the left lane to make a U-turn.
	17:15:36	In a quarter mile, turn right onto West Holly Springs Road.
	17:15:37	Continue on West Holly Springs Road for three quarters of a mile.
	17:15:37	In a quarter mile, turn left.
	17:18:21	In a quarter mile, use the left lane to turn slightly right onto North Carolina 55 Bypass East.
	17:18:21	Take the second left.
	17:18:37	In 600 feet, turn right.
	17:19:45	Turn right, then sharp left.
	17:21:20	Sharp left, then your destination will be on the right.
	17:23:16	Turn left, then turn right.
	17:23:18	Take the next right, then your destination will be on the right.
	17:23:41	Your destination is on the right.
	17:23:49	You have arrived.

Evaluation

Hickman’s notes show a journey to Los Tres Magueyes was started at 17:15. Research suggests the journey should take around 9 minutes.

Voice guidance audio files start at 17:15, describe a journey lasting 8 minutes and 38 seconds which matches the researched route from Sweet Vista Lane to Los Tres Magueyes.

The voice guidance audio appears to provide some quite insightful and detailed location information. Clearly location data is available in more sources that merely latitude and longitude co-ordinates.

ALEAPP

I’ll soon be submitting a Pull Request to Alexis Brignoni’s brillaint ALEAPP to include this artefact.