> %APPDATALOCAL%\Microsoft\Terminal Server Client\Cache\
I've seen all kinds of weird and interesting stuff in these RDP sessions. You never know, you might find pieces of info that will really help with the investigation.
Tracked by IoS:
> When you arrived
> When you left
> Long/Lat
😝Photo is a parsed local.sqlite file
2\ In your iPhone the local.sqlite will render like this - as you can see I went to a grocery store 13 times. I was in lockdown don’t judge me.
3\ You can parse these using DB browser for sqlite - there are field names including longitude, latitude and also tracks when you arrived / left so it understands your dwell time. There are also fields pertaining to vehicle events i.e. you parked your car.