Inside Apple's routined Databases, Part 1: Cache.sqlite — The Raw Feed

This is the first post in a five-part series on the SQLite databases behind routined, the daemon quietly learning your habits in the background of every iPhone. We'll work from the rawest data (Cache.sqlite) up through the processed, cross-device layer (Local.sqlite and Cloud-V2.sqlite), then close with a post on how this evidence actually holds up in court.

Why This Database Exists

Buried in

/private/var/mobile/Library/Caches/com.apple.routined/ is a small file called Cache.sqlite that quietly does one of the most consequential jobs on an iPhone: it remembers, in raw form, everywhere the device has recently been. routined is the process behind Apple's on-device "routine learning". The successor to what was originally built as part of the CoreDuet framework. Its job is to notice patterns in how you use your phone and where you carry it, so the system can anticipate what you're about to do next. Siri Suggestions guessing you want to open your parking app the moment you get out of the car, Maps offering a route home before you've typed anything, widgets rearranging themselves based on time and place. All of that starts with routined watching, and Cache.sqlite is where the watching first gets written to disk.

It exists for a simple engineering reason: raw GPS fixes are expensive and noisy. The phone can't run full-accuracy GPS constantly without destroying battery life, and a single coordinate means nothing on its own. Instead you need a history of coordinates to detect a pattern like "this person is at this building every weekday morning." Cache.sqlite is the scratch pad where that history accumulates before the system decides which of it is meaningful enough to promote.

In other words, Cache.sqlite represents the active workspace of routined. It is the most dynamic of the three databases as records are regularly updated, replaced, and removed as Apple's algorithms learn more about a user's movement patterns. It can contain:

• incoming location observations

• environmental observations

• movement events

• visit candidates (inferred visits)

• map items

• trip segments

• predictive information

• machine-learning intermediate results

This database should generally be viewed as:

"What the device has recently observed."

not

"Where the user intentionally went."

This distinction is perhaps the most important forensic concept associated with Cache.sqlite.

---

How It's Used By the Device

The central table is ZRTCLLOCATIONMO, and it is dense. Researchers analyzing their own devices have found tens of thousands of location records in this single table, covering roughly the past week or so of activity. The database behaves like a rolling buffer rather than a permanent store. Each row typically carries:

• ZTIMESTAMP 

  • when the fix was captured, stored in Apple/Mac absolute time (seconds since January 1, 2001, UTC)

• ZLATITUDE / ZLONGITUDE 

  • the coordinate pair

• ZALTITUDE 

  • elevation in meters

• ZSPEED 

  • in meters per second

• ZCOURSE 

  • heading, in degrees

• ZHORIZONTALACCURACY / ZVERTICALACCURACY 

  • the device's own confidence in the fix, in meters

A companion table, ZRTWIFIACCESSPOINTMO, logs Wi-Fi access points the device has scanned nearby. This can be useful for indoor or GPS-denied positioning, and forensically useful in its own right for corroborating presence near a specific network.

routined uses this raw feed to power several device features simultaneously:

• Frequent/Significant Locations 

  • the mechanism that lets the phone eventually say "you're often at this address" without you ever telling it so

• Proactive suggestions 

  • travel-time notifications, commute predictions, Siri Suggestions for apps and shortcuts tied to place and time of day

• Power-efficient location for other apps 

  • many apps that request location don't need the radio to fire a fresh GPS fix; iOS can hand them a recent cached fix instead, saving battery

None of this is exposed through a settings toggle labeled "Cache.sqlite." It sits underneath Settings → Privacy & Security → Location Services → System Services → Significant Locations, which is the nearest thing to a user-facing acknowledgment that this pipeline exists at all.

Primary Entities Identified

The following entities are particularly significant:

ZRTCLLOCATIONMO

• Purpose

  • This entity represents Core Location observations. This is the closest equivalent to a raw location event within routined.

• Potential fields include:

  • latitude

  • longitude

  • altitude

  • horizontal accuracy

  • vertical accuracy

  • timestamp

  • speed

  • course

  • source information

• Forensic Interpretation

  • A record in ZRTCLLOCATIONMO provides evidence that:

    • Apple's Core Location framework generated a location estimate associated with this device.

  • The strength of that conclusion depends on:

    • accuracy value

    • timestamp

    • source

    • corroborating artifacts

• Confidence Assessment:

Finding	Confidence
Device obtained a location estimate	Very High
Device was within accuracy radius	High
User was physically present	High (device presence only)
User intentionally visited	Low

• Example Interpretation

  • Incorrect:

    • "The suspect visited the residence at 123 Main Street."

  • Correct:

    • "The device generated a Core Location observation within the reported accuracy radius of the identified coordinates."

• Courtroom Consideration

  • A common question:

    • "Does this prove the person was there?"

  • The technically accurate answer:

    • "It demonstrates the device was associated with that location estimate. Additional evidence is required to determine whether the user intentionally visited that location or whether the device was merely passing through the area."

ZRTHINTMO

• Purpose

  • ZRTHINTMO represents contextual location hints. These records are particularly interesting because they demonstrate that routined is not simply recording locations, it is attempting to predict and interpret behavior.

• A hint may represent:

  • possible destinations

  • likely locations

  • contextual associations

  • predictive routing information

• Forensic Value

  • Hints should generally receive lower evidentiary weight than direct observations.

  • A hint may represent:

    • "Apple believes this location may be relevant."

  • It does not necessarily mean:

    • "The device was there."

• Confidence Assessment

Finding	Confidence
Apple generated a location inference	High
Device was physically there	Unknown
User intended to travel there	Low

ZRTVISITMO

• Purpose

  • This entity represents Apple's interpretation that the device likely stopped at a location. This is where routined moves beyond observation into inference.

  • A visit generally requires Apple to determine:

    • the device arrived

    • remained in an area

    • stopped moving

    • departed

  • Why This Matters

    • A visit is not the same as a coordinate.

    • Compare:

      • Observation

        • 15:42:13

        • Latitude: 32.9001

        • Accuracy: 25 meters

        • Meaning: "The device was observed here."

      • Visit

        • Arrival: 15:42

        • Departure: 16:05

        • Meaning: "Apple believes the device remained at this location for approximately 23 minutes."

  • Forensic Confidence:

Finding	Confidence
Device stopped in area	High
User was present	Moderate to High
User intentionally visited	Moderate
User entered specific building	Low

• Important Distinction

  • Even a visit record does not automatically establish intent.

  • Example:

    • A device stops in a Coffee Shop Parking Lot

    • Possible explanations:

      • User entered coffee shop.

      • User waited in vehicle.

      • User met someone outside.

      • User parked nearby.

      • Passenger had the device.

  • The database cannot answer those questions.

ZRTTRIPSEGMENTMO

• Purpose

  • Trip segments model movement between locations.

  • They can provide:

    • origin

    • destination

    • travel duration

    • transportation mode

    • route information

  • Forensic Importance

    • Trip segments are valuable because they provide context.

    • A location by itself is limited:

      • 09:00

      • Location A

    • A trip segment provides behavioral context:

      • 08:45 (Home)

      • ↓

      • Driving

      • ↓

      • 09:15 (Work)

---

How It Syncs Across the Apple Ecosystem

This is the detail that trips people up: Cache.sqlite itself does not sync. It is deliberately local and ephemeral. Think of it as a working buffer for a single device's routined process, rotated out after roughly a week. Syncing only happens after promotion. When the on-device algorithm decides a cluster of cached points represents a genuine "significant location", i.e. home, work, a gym you visit three times a week. That distilled result graduates out of Cache.sqlite and into a second local database, Local.sqlite, which we'll cover in the next post. From there, if the device and iCloud account are configured to share this data (which is the default once Significant Locations and iCloud are both enabled), the significant-location record is end-to-end encrypted and synchronized to a third database, Cloud-V2.sqlite (sometimes still seen as Cloud.sqlite on older iOS versions), so that your iPad and Mac can also anticipate your routine without each device needing its own week of raw GPS history to relearn it from scratch.

So the sync boundary sits precisely at the line between "raw sensor noise" (Cache.sqlite, local only) and "distilled pattern" (Local / Cloud-V2, synced). That distinction matters enormously for forensic work, which is where we turn next.

---

Forensic Value

Cache.sqlite is, by a wide margin, one of the richest location artifacts on iOS and one of the most fragile.

Why it's valuable:

• It's raw. Unlike Significant Locations, which only surfaces places the algorithm decided mattered, Cache.sqlite can show a device's position at short, regular intervals throughout an entire day. A much finer-grained trail than most other iOS artifacts provide.

• Speed and heading are preserved. Because ZSPEED and ZCOURSE are recorded alongside each fix, examiners have used this table to reconstruct a vehicle's approximate speed at a specific moment. This is work that has directly informed accident-reconstruction and traffic-related casework, provided the horizontal accuracy for that record is tight enough (practitioner research generally treats accuracy readings of roughly 65 meters or better as a reasonable threshold for trusting the speed value).

• It corroborates or contradicts testimony with precision. A location trail sampled every few seconds or minutes is very hard to argue around compared to a single cell-tower-derived location.

Why it's fragile, and what it takes to get:

• Its ephemeral, rolling nature means the window of opportunity is short, roughly a week of history at any given time, meaning delayed seizure or delayed extraction can mean the data is simply gone.

• It lives in the device's cache directory, not in an iTunes/Finder or iCloud backup. Standard logical backups will not contain it.

• Getting to it generally requires a full file system (FFS) extraction. Historically via jailbreak-based physical acquisition, and on modern devices via agent-based or Local Privilege Escalation (LPE) techniques, since true physical/checkm8-style extraction has become increasingly unavailable on current hardware. LPE-based extractions have a wrinkle worth remembering: because they require the OS to be running and unlocked, the device is "alive" during acquisition, which means the examiner can't be fully certain what iOS may have already pruned from the cache before or during that window.

• Timestamps require conversion. ZTIMESTAMP is Mac absolute time, not Unix epoch.

What Can Be Concluded?

If a record exists within Cache.sqlite, an examiner can generally conclude:

• The device obtained a location estimate.

• The observation was retained by Apple's location intelligence system.

• The device was likely within the reported accuracy radius of the recorded coordinates.

  
  

However, the database does not establish:

• why the device was there,

• whether the user intentionally visited the location,

• whether the user entered a business,

• or how long the user remained.

  
  

A recorded coordinate near a restaurant may simply indicate that the user drove past on an adjacent roadway.

Cache.sqlite should be considered the foundational observation layer of Apple's location intelligence system. It contains both direct observations and increasingly sophisticated interpretations derived from those observations.

Investigative Confidence (Overall Recap)

Conclusion	Confidence
Device was near recorded coordinates	High
Device traveled through area	High
User intentionally visited location	Low
User entered specific building	Very Low

The examiner must separate:

• Observed data

• Inferred events

• Learned behavior

Failure to distinguish these categories is the primary source of misinterpretation.

---

What Questions Does It Answer

When Cache.sqlite is intact and successfully extracted, it can help answer:

• Where was this device at a specific date and time, down to a tight radius?

• What was the device's approximate speed and direction of travel at that moment?

• Was the device near a specific address, building, or Wi-Fi network in the hours before or after an incident?

• Does the device's movement pattern support or contradict a stated timeline? An alibi, a claimed route, a claimed period of being stationary?

• How dense was location tracking during a given window? Was Location Services and Significant Locations actually enabled and functioning at the relevant time?

What it generally cannot answer on its own: long-term patterns of life. That's not its job. The raw cache doesn't know what's "significant," it just remembers. For the question of where someone habitually goes, week over week, we need to look at what the phone chooses to keep permanently and sync across every device it owns, which is exactly where Part 2 picks up, with Local.sqlite.

Next in the series: Local.sqlite: How routined decides a place is "significant," and why that decision, once made, is much harder to make disappear.

---

⚠️ Disclaimer: This information is provided as-is, for educational and lawful forensic use, with no warranty of accuracy or fitness for purpose. Always independently verify results against source data before relying on them for investigative or legal purposes. Not legal advice. Use at your own risk.