GPX and KML are the two common ways a recorded GPS track is saved - a run, a ride, a drive, or a phone's location history. Because a recording begins wherever the person was standing, the very first point is almost always their home, and because it runs until they stop, the whole trace maps out a routine. Fitness devices quietly add a second layer that no map app shows: heart rate, cadence and power recorded at every single point.
Scan a GPS Track fileA scan pulls out the track's first and last recorded points as separate high-risk findings, because the start point is typically a home or regular meeting place and the end point is wherever the recording stopped. Around them it reports the bounding box of the whole route, the number of points, and - for KML gx:Track recordings - the median sample interval, which tells a deliberate few-second activity recording apart from passive all-day background location logging.
The distinctive part of a GPS track is the biometric channel that rides alongside the coordinates. From a Garmin, Strava or Apple Watch TrackPointExtension the parser reads heart rate, cadence, cycling power, water depth, and air and water temperature, each shown as a range with a sample count. This is personal health data carried inside a location file, and no ordinary map viewer surfaces it.
The file also names the person and their gear. It surfaces the author's name and embedded email, the app that recorded it (Created By, e.g. Garmin Connect or Strava), the recording device itself (the GPX <src>), copyright and free-text keywords like "commute" that describe a routine rather than one outing, plus deliberately marked waypoints and placemarks whose names - "Home", "Work", a person's name - pinpoint a place far more directly than a coordinate. Fitness exports often also embed a link back to the activity page or the author's profile, and custom key/value fields that stash an account, device or serial identifier.
Two tamper checks are specific to these files. "Track Extends Beyond Its Points" fires when the bounding box declared in a GPX header covers noticeably more ground than the points the file still contains - the signature of a route whose start was trimmed off to hide a home address. "Header Predates The Track" fires when the file's creation time sits before its earliest point, which cannot happen in a genuine recording. KML files add viewpoints (a Camera or LookAt coordinate) that name the exact spot an author framed even when the file plots no route at all.
This is a selection. The full field manual documents the fields read from each format.
The first and last points of the track (the start is usually your home), the full route and bounding box, the times you started and stopped, the app and device that recorded it, and frequently your name and email. Fitness tracks also carry heart rate, cadence and power recorded at every point.
Yes. Garmin, Strava and Apple Watch write heart rate, cadence, cycling power, depth and temperature into a TrackPointExtension inside the GPX file. File X-Ray reads them and shows the range and sample count. A normal map viewer never displays this channel, so most people do not realise it is there.
Usually, yes - a recording starts the moment you begin moving, which is wherever you were standing. That is why File X-Ray flags Track Start as high risk. If a file's declared bounds cover more ground than its points, it can also mean someone tried to trim the start off to hide that address.
GPX usually comes from fitness watches and GPS units and carries biometric extensions, author details and a metadata header. KML usually comes from Google Earth and location history and adds placemarks with street addresses and phone numbers, gx:Track sample intervals, and Camera/LookAt viewpoints. File X-Ray handles both from one page.
GPX and KML are plain XML, so File X-Ray shows you exactly which points and fields carry your location, name and biometrics, and the track file is never uploaded. Be aware of the one exception, which matters most on this format: the first track point is sent to OpenStreetMap to draw the map and resolve the address, automatically, as soon as the results appear. To actually remove them you edit or re-export the file - the tool identifies what to strip rather than rewriting the file for you.
File X-Ray reads GPS Track files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.