GPS forensic analysis

Damir DelijaInsig2 2012

What we will talk about• GPS

– how to acquire evidence– where we can find GPS (device or just functionality)

• What we can find on a GPS – What tools and procedures to use ?

• Examples in EnCase: Magellan, TomTom, Exif data ..– examples slides are here as help/idea for practitioners

Page 2

GPS Device Acquisition and Examination

Sources• Materials are compilation of various sources

– Celebrite “Portable GPS Forensic”http://www.cellebrite.com/gps.html

– “GPS Device Acquisition and Examination”, CEIC 2012 by Nathen Langfeldt, Guidance Software, Inc

– “Forenzika GPS uređaja”, Filip Baričević, DATAFOCUS 2012

Page 3

GPS• GPS -Global Positioning System• http://en.wikipedia.org/wiki/Global_Positioni

ng_System• Not only GPS, but other systems Russia, China,

India, EU ..

Page 4

GPS embedded in another device• Mobiles / smartphones• Tablets – PC’s • car, robots (?) • Usually direct connection to Internet and live

map access

Page 5

GPS standalone devices• Garmin• Magellan• MIO• TomTom

• Maps are prepared and sold by vendor • Maybe small vendors will go extinct

Forensic tools and GPS• Today all commercial tool have support GPS data

extraction, level can vary, depends on model, encryption...

• Idea is to get out geolocation data and put in on the map, also and all other available data from device– location data can be obtained from other sources too

• There is a BIG difference among mobile device forensic tools and general purpose forensic tools

Page 7

Forensic Tool Examples• EnCase - general purpose forensic tool

– support for geolocation data extracted from evidence as part of smartphone support module– support for standalone device as disk image and enscripts to extract data

• UFED ultimate / UFED physical analyzer - mobile device forensic tool– support only for geolocation data extracted from evidence as part of smartphone support

(some magic can be done too)– support for standalone device but in a way as mobile phones or smartphones– support for encrypted logs and data on some standalone devices (tom-tom)– python scripts for additional processing

• It is almost impossible to mix results of both tools .... – it takes a lot of effort – there is no standardization (like E01 format in traditional digital forensic)

Page 8

GPS information

1. travel path2. trackpoints (coordinates)3. waypoints (coordinates and names)4. route (list of waypoint)5. saved locations6. video, pictures7. all other available data from device related to locations

/ positionsPage 9

Example Tom-Tom data

• *.cfg – locations.• ttgo.bif, ttnavigator.bif –

general info on device, S/N, model ...

• password (encrypted)• settings.dat – IDs, user

data ... • triplog files – encrypted files

– user route data

Page 10

• Device seizure is the first step and can be difficult

• These devices send and receive signals when powered on – precautions need to be taken

• How do you stop a GPS from updating its location?

− If possible, a Faraday bag

• What if a Faraday bag is not available???

• Once the device is protected, what next?

Page 11

GPS seizure

• Page 11

• Once the device has been seized, the next logical step is to acquire the device.

• The following is a list of tools that could be important:

• USB cable to connect the device to an acquisition machine/tool

• Faraday bag (as mentioned previously) • write blocker (either software or hardware will

be acceptable)• Card reader (optional)

Page 12

What is needed for acquisition

Page 12

Master Title

• ENCase details in CEIC 2012 “GPS Device Acquisition and Examination”– EnCase and Garmin– EnCase and TomTom– Encase and Magellan– Encase and Exif data

Examples

Page 13Page 13

• Encase can acquire Garmin and TomTom GPS devices trough the use of a write-block device

Note: • If a media card is in use by the

GPS device, the card must be removed and imaged separately. If it is not removed, the media card may be the only thing that shows up during a preview

Page 14

EnCase and TomTom/Garmin

Page 14

• Similarly to Garmin or TomTom, acquisition of a Magellan GPS device can be accomplished by using a write-block device and a forensic acquisition tool (EnCase)

• Some Magellan's may not be imaged in this fashion

• The only solution may be to use a backup of the device on a media card supported by the device

• Or to use another tool like UFED .

Page 15

EnCase and Magellan

Page 15

• Aside from viewing the .gpx file within EnCase or an XML browser, the file can be viewed in Google Earth.

• This can be accomplished one of two ways:

− Bring the .gpx file out of EnCase and use a website to convert the file to KML

− This site is used for the conversion: http://www.gpsvisualizer.com/map_input?form=googleearth

More can be done for Garmin .gpx...

Page 16

Garmin device examination through EnCase

Page 16

• Once at this site, the settings can be observed.

EnCase Garmin examination

Page 17Page 17

• Click the “create KML” button

• A new page will be loaded • The KML file can then be

downloaded

Page 18

EnCase Garmin examination

Page 18

• With the KML file brought into Google Earth, we can begin the examination.

• When it is brought in, the data will show up under Temporary Places.

Page 19

EnCase Garmin examination

Page 19

• The data is broken down into two main pieces:

− Waypoints

− Tracks• Waypoints contains data like address book entries

• Tracks can contain data from recent routes that were traveled

Page 20

EnCase Garmin examination

Page 20

• An example of a Waypoint

Page 21

EnCase Garmin examination

Page 21

• The other option is to bring the KML file straight into Google Earth

• If this option is used, you will be presented with three options.

• “Create KML LineStrings” is unchecked by default

− It is recommended that this be checked

Page 22

EnCase Garmin examination

Page 22

• In summary, Garmin GPS devices are super easy to examine and can be the most fruitful

• The data is easy to access and should not be overlooked

• Some upcoming challenges:− Who uses a portable GPS device?− Garmin now has multiple apps

available for download

Page 23

EnCase Garmin examination

Page 23

• TomTom GPS devices have been around for some time and are widely used

• The examination of these devices is a bit different

• TomTom GPS devices can in some ways store more info than Garmin

Page 24

EnCase TomTom examination

Page 24

• With TomTom GPS devices, a few files will be of interest to us

• To start, we can look at the CurrentMap.dat

• In this example the file is sitting at the root of the device

• This will give the name of the map that is currently in use

• As you can see in the example, “North_America_2GB” is the name of the map being used

Page 25

EnCase TomTom examination

Page 25

• In summary, TomTom GPS can be examined through the use of an EnScript module or third-party tools

• If trip logs are present, a request could be made to TomTom in an attempt to get the logs decrypted (or trough UFED tools)

• Some upcoming challenges:

− Who uses a portable GPS device?

− TomTom now has multiple apps available for download

Page 26

EnCase TomTom examination

Page 26

• Magellan devices can be more difficult in part because of the the acquisition process

• Some Magellan devices may not be able to be acquired at the physical level

• In those cases it might be possible to create a backup through the device directly to an SD card

• The SD card containing the backup can then be acquired

Page 27

EnCase Magellan examination

Page 27

• In summary, Magellan GPS devices are the most difficult to examine due to the limited information available

• Though third-party tools are available, their ability to parse data may be limited by the actual models supported

• Some upcoming challenges:

− Who uses a portable GPS device?

− Magellan now has multiple apps available for download

Page 28

EnCase Magellan examination

Page 28

• The examination of EXIF GPS can be made simple

• This data can be extracted and made invaluable through the use of various third-party tools or an EnScript program

• The “Exif GPS Information Reader” EnScript module will be used here

Examination of EXIF GPS Data

Page 29

The images used here were taken with a BlackBerry

Page 29

• The exported KML file can be viewed in Google Earth

Page 30

Examination of EXIF GPS Data

Page 30

Master Title

• It is wild area • in developement, new models, new features,

encryption, applications od devices • legal issuses • a lot to learn

Conclusion ?

Page 31Page 31

Master Title

damir.delija@insig2.hr

Questions ?

Page 32Page 32