The testing phase started with preparing the Android device for generating test data. From my research, I have not found any other articles about forensic data extraction from the Citymapper app on Android, so this is a good source of information for any forensic analysts that come across this app while investigating Android mobile devices. The Google Play store lists the app as having over 10 million installs, which makes it a plausible source for recovering forensic artifacts from a seized device 1. Citymapper is a navigation map centered around public transit through city centers and urban areas. Table of ContentsĪs part of my DFOR 762 project, I analyzed the forensic artifacts that can be found in the Citymapper app for Android. For an overview of the forensic artifacts present in this data, skip to the Key Forensic Artifacts section. These tables and fields can be used by a forensic examiner to determine basic information about the user, their work and home addresses, and their location history throughout time if the app was actively used to navigate.

Additionally, the main Citymapper SQLite database contains tables describing the user’s favorited navigation trips, favorited locations, history of locations searched for, and recent trips taken with the app. The ADB backups of this app contain preference files with fields that include the user’s first name, last name, email address, phone number, and device location when the app was first opened.

This means that the device does not need to be rooted to obtain a full file system image like may be required for other apps. Citymapper only requires a logical extraction to obtain its configuration files and main database.

Citymapper is a navigation app focused on pedestrian and public transit navigation in intracity areas. The goal of this project is to analyze the Citymapper app on Android and search for forensic artifacts present in its configuration and storage files.

City mapper android