Life360

SELECT * FROM life360 WHERE alibi = FALSE;

A Forensic Analysis of the Life360 Application in Android

Life360 is one of the most widely used family safety and location-sharing applications available on Android. It allows family members to share real-time locations, receive alerts when members arrive at or leave designated places, communicate through in-app messaging, and review historical location information. For digital forensic examiners, it can also become an unexpectedly rich source of evidence. After all, "I wasn't there" becomes a much harder argument when an app has been enthusiastically documenting your day.

According to the Google Play Store, Life360 includes features such as:

  • Real-time location sharing

  • Location history

  • Place alerts

  • Crash detection

  • SOS alerts

  • Emergency dispatch services

  • Roadside assistance

  • Identity theft protection

  • Tile tracker integration

Life360 offers Free, Silver, Gold, and Platinum subscription plans that unlock additional safety and security features. While optional permissions, including location, camera, microphone, and physical activity, enhance functionality, the application remains usable with limited capabilities when some permissions are denied or the plan is free.

For forensic practitioners, applications like Life360 present both opportunities and challenges. New versions of the app may introduce changes to database schemas, data structures, and storage formats. One day your favorite forensic tool parses every artifact perfectly. The next day it politely informs you that the database is "unsupported," which is examiner-speak for, "Looks like we're opening DB Browser today."

When automated parsing falls behind application updates, the investigation does not stop. It simply shifts from tool-driven analysis to manual examination. Understanding SQLite databases, WAL files, JSON structures, and application storage becomes an essential skill rather than an optional one. Commercial forensic tools are excellent assistants, but they are not a substitute for understanding how the data is actually stored.

As every examiner eventually learns, apps evolve much faster than parser updates. The artifacts are usually still there. They are just waiting for someone willing to dig a little deeper.

Forensic Artifacts

Life360 stores a significant amount of information locally that can provide valuable evidence during a forensic examination. The following sections describe the primary databases and the artifacts they contain. If your forensic tool parses everything, congratulations. If it does not, welcome to the exciting world of manual artifact analysis.

Life360 application version tested: 26.22.0 and 26.24.0

Life360 User Account Information

The database:

\data\data\com.life360.android.safetymapd\databases\com.amplitude.api

This database contains identifiers associated with the installed application and the logged-in account, including:

  • User ID

  • Device ID

These identifiers can be useful when correlating application data with cloud records or other devices.

Life360 Members and Circles

The database:

\data\data\com.life360.android.safetymapd\databases\MembersEngineRoomDatabase

This database contains information about members connected to the user's Life360 Circles.

A Member is an individual person who has joined Life360 and is part of one or more Circles. Each member has their own account and can choose what information they share (subject to the Circle's settings and app permissions).

A Circle is a private group of members. It’s the space where people share location, receive notifications, and communicate with one another.

Artifacts include:

  • Created timestamp

  • Updated timestamp

  • Member ID

  • First and last name

  • Email address

  • Phone number

  • Avatar URL

  • Admin Status

  • Role

  • Circle membership

These records help identify relationships between users and establish membership history.

Life360 Circle Settings

The database:

\data\data\com.life360.android.safetymapd\databases\L360LocalStoreRoomDatabase

This database stores configuration information for each Circle.

Artifacts include:

  • Circle ID

  • Subscription tier (Free/Paid)

  • Enabled alerts

  • Driver report settings

  • Location history configuration

These settings help determine what data the application was configured to collect. If the Circle owner has a paid plan, settings for premium features (such as driving reports, crash detection, or emergency assistance) may also appear.

Life360 Pet Profile

Database

\data\data\com.life360.android.safetymapd\databases\PetProfileRoomDatabase

Life360 allows pets equipped with compatible trackers to be added as Circle members.

Artifacts include:

  • Created timestamp

  • Updated timestamp

  • Pet type

  • Breed

  • Color

  • Weight – in kilograms

  • Gender

  • Birthday – stored in the database as days since 1/1/1970

  • Pet name

  • Tracker ID

  • Circle ID

  • Avatar

These records can associate a tracker with a specific pet and Circle. Your favorite family member can be part of your Life360 Circle! Life360 provides the capability to add little Fido to your app, add a photo and link the pet to a Life360 tracker. Inside of the PetProfileRoomDatabase you will find created and updated timestamps, pet type, breed, color, weight, gender, birthday, name tracker ID, Circle ID and the pet avatar.

Life360 Places

Life360 Places are saved locations in the Life360 app that help family members know when someone arrives at or leaves a location. They're one of the app's core features for coordinating with family or trusted contacts.

When you save a Place, you can:

  • Receive arrival and departure notifications (for example, "Alexis arrived at Work at 8:00 AM.")

  • View Place history, showing when Circle members entered and exited that location.

  • See who is currently at the Place if they have location sharing enabled.

Each Place has a geofence, which is a virtual boundary around the address. You can adjust the size of this boundary if needed. A larger radius can make arrival and departure detection more reliable, while a smaller radius can provide notifications that are more precise.

Database

\data\data\com.life360.android.safetymapd\databases\L360LocalStoreRoomDatabase

Artifacts include:

  • Place

  • Latitude

  • Longitude

  • Radius

  • Source

  • Owner

Life360 Place Alerts

In Life360, Place Alerts are notifications that let Circle members know when someone arrives at or leaves a saved Place.

Database

\data\data\com.life360.android.safetymapd\databases\L360LocalStoreRoomDatabase

Artifacts include:

  • Member ID

  • Name

  • Arrivals and Departures

Life360 No Show Alert

A Life360 No Show Alert is a notification that tells you when a member of your Circle does not arrive at an expected place by a specific time. Unlike a regular Place Alert, which notifies you when someone arrives or leaves, a No Show Alert only notifies you if the expected arrival does not happen.

Database

\data\data\com.life360.android.safetymapd\databases\NoShowAlertRoomDatabase

Artifacts include:

  • Last Updated Time

  • Run At Time

  • Trigger Condition

  • Type

  • Place ID

  • User ID

  • Creator ID

  • Source

The No Show Alerts for my test data were recovered from the WAL file.

Life360 Drives, Drive Events and Waypoints

In Life360, Drives, Drive Events, and Drive Waypoints are all related to tracking trips by car, but they refer to different things.

A Drive is a complete recorded trip from the time a person starts driving until they stop. Drive Events are notable actions or incidents that occurred during a Drive. Drive Events may include: Speeding, Hard Braking, Rapid Acceleration, Distracted Events and Crash Events. They help summarize driving behavior. Drive Waypoints are points along the route that show where the driver traveled during a Drive.

Artifacts include:

  • Timestamps (Start and End)

  • Speeds – stored in the database as meters per second

  • Distance

  • Duration

  • Drive Events

Database

\data\data\com.life360.android.safetymapd\databases\DriveBladeDB

Life360 Locations

Locations and waypoints found in the L360EventStore_service.db encompass all of the location and waypoint data recorded by the Life360 application.

Database

\data\data\com.life360.android.safetymapd\databases\L360EventStore_service.db

Artifacts include:

  • Timestamp

  • Latitude

  • Longitude

  • Horizontal Accuracy – stored in meters

  • Speed -- stored in meters per second (converted to MPH for ALEAPP report)

  • Speed Accuracy

Life360 Waypoints

Database

\data\data\com.life360.android.safetymapd\databases\L360EventStore_service.db

Artifacts include:

  • Trip ID

  • Timestamp

  • Latitude

  • Longitude

  • Accuracy

  • Speeds

Life360 Battery Level

Life360 also stores the battery level of devices within the circles.

Database

\data\data\com.life360.android.safetymapd\databases\L360EventStore_service.db

Artifacts include:

  • Timestamp

  • Battery Level

  • Charging State

  • Power Mode

Messaging

The messaging capability in the Life360 application appears to rely on the native messaging application in Android as opposed to the messaging.db seen in previous versions.

Lava

Testing

Drives

  • On 6/20/2026, part of a drive is recorded on my device.

  • The trip starts at 14:50:54 and ends at 15:08:57. (Unsure what triggered the drive to be so short as I was travelling 2 and ½ hours home from Connecticut. Further testing to follow)

  • The duration of my trip is logged into the database as 1083 seconds which converts to 18 minutes and 3 seconds, the exact duration of my recorded trip.

  • The distance travelled is 14292.6 meters which converts to 8.88 miles.

  • The average speed for this trip is 34 MPH (stored in the database as meters per second)

  • The trip shows 6 distracted driving events (EventStore Drive Events) that correspond with phone usage (DriveBladeDB Drive Events)

Drive Waypoints displayed in Google Earth:

The entirety of my trip can be seen in Locations and Waypoints data (not the drive related waypoints). Locations in Red and Waypoints in Yellow:

Summary

Applications like Life360 update frequently, and those updates can change database schemas, storage formats, and file structures without notice. When that happens, established forensic tools and parsers can fall behind, leaving examiners to rely on manual analysis of the app's underlying data. This research was undertaken to document the current state of Life360's local data storage on Android (versions 26.22.0 and 26.24.0) and to confirm what artifacts are actually recoverable when parsing keeps pace with the app.

Life360 was found to retain a substantial amount of data locally on the device. This includes account and identity information tied to the user and installed app; details about Circle members and their roles; Circle configuration and subscription settings; saved Places and the alerts tied to them; pet profiles linked to trackers; and detailed driving data, including trip timestamps, speed, distance, duration, and individual driving events such as hard braking or distracted driving. The app also logs ongoing location history, waypoints, and device battery status over time.

Testing against a real-world drive showed that the values Life360 recorded for duration, distance and speed matched the actual trip, and that logged waypoints lined up with the real route when mapped.

Best part is it is now supported in ALEAPP!!!

Look for a future blog where I plan to do a more precise analysis of the accuracy of each recorded artifact including locations, waypoints, speeds and stored accuracies.

Popular posts from this blog

Snapchat Artifacts

Image
iOS Snapchat -user.plist- - fs-full.zip/private/var/mobile/Containers/Data/Application/****Snapchat application ID**** /Documents/user.plist -holds data about the local user such as username and user id. -primary.docobjects database- - fs-full.zip/private/var/mobile/Containers/Data/Application/****Snapchat application ID**** /Documents/user_scoped/9ea0aafe276d670e1a5155f78ee18485aca8b9040982e579eef26be6bb39 ad94/DocObjects/primary.docobjects -Snapchat contacts can be found in this database -Arroyo.db -fs-full.zip/private/var/mobile/Containers/Data/Application//****Snapchat application ID**** /Documents/user_scoped/9ea0aafe276d670e1a5155f78ee18485aca8b9040982e579eef26be6bb39 ad94/arroyo/arroyo.db          - The message content is stored in the conversation_message table.          - Each conversation has a client_conversation_id.          - The message is located in the message_content column.      ...
Read more

Glow & Behold

Image
Glow & Behold Flashlight Artifacts in Apple’s Unified Logs This blog is the work of my sister, Holly Charpentier, who did all the flashlight testing and artifact hunting 🔦. She’s the one who scrolled through endless Unified Logs, captured all the brightness level changes, and got way too excited about AVFlashlight entries. Basically, if there were a forensic merit badge for nerdy persistence, she’d earn it twice. Proud to share her work here — certified DFIR nerd and log whisperer! Flashlight toggles may seem minor at first glance, but they can provide valuable context when reconstructing user behavior or validating key moments in a timeline. Whether you’re checking device usage during a critical timeframe or comparing activity to a statement, flashlight events can serve as corroborative details. Examples include: Was the phone actively in use at a specific time? Was the flashlight turned on at a location or time relevant to the case? Did device interactio...
Read more

LogTimeWarp

Image
LogTimeWarp Tracking Date & Time Changes in Apple’s Unified Logs From suspicious user activity to malware behavior or post-event tampering, a sudden change to a device’s system time can be a red flag. It may signal attempts to obscure file timestamps, alter log coherence, or reset application timers. Forensic validation often hinges on accurate time interpretation. When the system time is altered, even legitimate logs may appear misleading. That’s where the Unified Logs come in. Date & time changes can be made by a device user by navigating to Settings > General > Date & Time. By toggling off Set Automatically, the date and time can be changed manually by the user. The first step is extracting the Unified Logs. See Alexis Brignoni’s post on Extraction, Processing, & Querying Apple Unified Logs from an iOS Device here: https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html Once the Unified Logs are obtained the hu...
Read more