Even before we released Elcomsoft Cloud Explorer, you’ve been able to download users’ location data from Google. What you would get then was a JSON file containing timestamped geolocation coordinates. While this is an industry-standard open data format, it provides little insight on which places the user actually visits. A full JSON journal filled with location data hardly provides anything more than timestamped geographic coordinates. Even if you pin those coordinates to a map, you’ll still have to scrutinize the history to find out which place the user has actually gone to.

Google has changed that by introducing several mapping services running on top of location history. With its multi-million user base and an extremely comprehensive set of POI, Google can easily make educated guesses on which place the user has actually visited. Google knows (or makes a very good guess) when you eat or drink, stay at a hotel, go shopping or do other activities based on your exact location and the time you spent there. This extra information is also stored in your Google account – at least if you use an Android handset and have Location History turned on.

Elcomsoft Cloud Explorer 1.30 can now process Google’s enhanced location data, which means we can now correctly identify, extract and process user’s routes and display places they visited (based on Google’s POI). This significantly improves readability of location data, providing a list of places (such as restaurants, landmarks or shops) instead of plain numbers representing geolocation coordinates. In this article, we’ll figure out how to obtain that data and how to analyze it.

Who Is This Feature For

Places and Routes support allows experts to see users’ trips the way Google sees them, complete with the type of transport, stopovers and places visited during the trip. The ability to process users’ places and routes and places significantly improves readability of location data, providing experts a concise list of places instead of numerical geolocation coordinates.

Downloading Location Data with Elcomsoft Cloud Explorer

Elcomsoft Cloud Explorer 1.30 or newer is required to download enhanced location data from the Google Account. In order to download location history, do the following:

1. Launch Elcomsoft Cloud Explorer 1.30 (or newer)
2. Click File – Add Google Snapshot
3. Authenticate into the Google Account by providing the user name and password
4. If Two-Factor Authentication is enabled, you will be prompted for a secondary authentication code.
   Note: Elcomsoft Cloud Explorer 1.30 has a known issue authenticating with 6-digit authentication codes generated by the Authenticator app if Google Prompt is enabled. If Google Prompt is activated as a 2FA method of choice on a given Google Account, you will have to manually generate a set of backup codes for that Google Account. You will have to then use one of those 8-digit codes to complete authentication.
5. Once the authentication is completed, select Locations.
   
6. Elcomsoft Cloud Explorer will download location history from the Google Account. This may take quite some time depending on how long and how extensive the user’s location history is. On some of our test accounts, location history goes back to 2010, and takes 5-6 minutes to download.
7. Once the download is finished, you’ll be able to access the user’s location history.
8. To view Places, click on the first icon dubbed “Places”. You will see the date and time of the visit (start to end), the name of the place, category (Home, Work, Hotel, Restaurant, Other), street address and coordinates. Clicking on the coordinates’ link opens a map in your Web browser.
9. To view user routes, click on the second icon dubbed “Routes”. You will see the start and finish points of the route (time, coordinates), route type (Driving, Walking, or taking public transportation).
10. Custom filters are available on the right navigation panel. You can view routes travelled on a certain day or within a certain period of time, display only certain types of routes etc.
    
11. You can access the full track as shown on the screen shot by clicking the “Show track” button.
12. Individual routes can be accessed by clicking on the “eye” icon under the “Show track” label.
    
13. Individual trips are displayed as follows: