Abstract

The iOS core system has two locations that we know of where speed values are logged. We found that these loggings are produced when any application requests positional data. If a map application is active, whether navigating or not, these loggings are updated at 1 Hz. Both sources have their advantages over the other. One of the sources - the ZRTCLLOCATIONMO-table – has positional data as well as speed data. The other – the Unified Logging – specifies an uncertainty for each speed value.

The Dutch police often harvests these loggings from iPhones of persons involved in a crash. NFI has taken efforts to validate these loggings. In analyzing loggings from real accidents we often encounter a specific phenomenon: the logged locations suggest movement for several seconds beyond the final position of the vehicle. We performed experiments to find whether the logged speed values are prone to this as well.

We found that speed values in the ZRTCLLOCATIONMO -table are prone to this phenomenon. The other source – the unified logging – is largely unaffected. Also, the uncertainty specification in the unified logging appears to be meaningful and valid.

Experiments were mainly aimed at the models iPhone 11 and iPhone SE(2020) – which are very similar – for several iOS-versions. We warn that results may not be valid for other combinations of phone model and iOS-version.