A map can make inconsistent data look authoritative. Before connecting coordinates into a route, build a source table that explains what each point represents. A navigation search, an image geotag and a device-generated position estimate can share a latitude and longitude while describing different events.
Keep the original observation beside the interpreted value
Each row should retain its source file or database, record identifier, raw timestamp, coordinate values and available accuracy fields. Add the examiner's interpretation in separate columns. That separation lets a reviewer distinguish the data actually collected from the conversion or inference used in the report.
Identify whether the record concerns a device measurement, application content, account activity or network association. A saved destination does not establish a visit. A cell-sector record is not a GPS fix. An account's access location may reflect an intermediary service or remote activity. Explain the mechanism before assigning evidentiary weight.
Reconcile clocks across platforms
Record the epoch, unit, time zone and conversion method for each timestamp. Check travel, daylight-saving transitions, device clock changes and server-generated times. Preserve the original values so the chronology can be reconstructed if a conversion is challenged.
- Compare known events against both raw and converted times.
- Check whether nearby points are independent observations or synchronized copies.
- Retain gaps instead of drawing an apparently continuous journey.
- Label uncertainty rather than displaying every coordinate with the same precision.
Test alternative explanations before attributing a person
A phone can be borrowed or left behind. A media file can be imported. An application can retain old data. Compare the proposed account with relevant communications, device use, other systems and independently established facts. Explain where those sources agree and where they do not.
The deliverable should include the source table, conversion notes and a map keyed to those records. State whether the conclusion concerns a device, an account or a particular person's presence. Those are different propositions and may require different supporting evidence.
See mobile-device forensics for acquisition and analysis, and preparing the expert's technical file for reporting discipline.
Technical background
NIST SP 800-101 Revision 1 describes mobile forensic preservation, acquisition, examination and reporting. Source-specific interpretation still requires testing the actual device, application and version involved.