I blogged a short time ago about the Navman iCN 310 satellite navigation device.
A iCN 510 (versionID 3.00.1008 BuildTime 2004-11-22, 12:38:48) has now been submitted and it is a bit more complicated to deal with. It still had a 128mb MMC card but it only had maps on. The .dat files I needed to find were stored within internal memory. The problem to overcome was how to access it. This navman is running a Windows CE NET 4.2 OS and in Windows XP Microsoft Active Sync is required to access it. The plan was to use Paraben's Device Seizure software to image the device. The plan went pear shaped when Active Sync wouldn't connect to the Navman - I am not sure why but I suspect a driver was missing somewhere. In desperation I connected the device to a Vista box and suprisingly detected the Navman immediately as a mobile device and allowed me to copy off the aformentioned .dat files. In Vista Active Sync has been replaced with a free download - Windows Mobile Device Center. I instaled this software and it then identified the Navman as a Windows CE device. Within the device there appeared to be two volumes: \ and My Flash Disk.
Within My Flash Disk there are four notable files:
RECENT.DAT stores up to thirty of the recently navigated to destinations. These destinations are stored in records of 520 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 507. These are decoded by bookmarking in Encase as a 32 bit integer. In the UK Latitude will begin in the range 49-59 and is decimally notated. Longitude is in the range -5 to +1.6 ish. When bookmarking as a 32 bit integer Longitude is shown first and will often be a negative value (i.e. anywhere west of Greenwich).
FAVVER3.DAT possibly stores up to 200 user entered favourite destinations. These favourite destinations are stored in records of 1508 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 352. These are also decoded by bookmarking in Encase as a 32 bit integer.
ROUTE.DAT I speculate is used to store the origin of the last navigated journey. Coordinates can be found at record offset 507.
TRIPPLAN.DAT contains destinations set by a user when planning a trip with multiple destinations (via Trip Planner in the main menu or via pop up menus in the Map Screen). These destinations are stored in records of 532 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 504. These are also decoded by bookmarking in Encase as a 32 bit integer.
Where I can I try and download manuals for these devices because it helps in mapping the features to the files containing user generated data. I found that the manual for the iCN 510 did not reflect the menu screen I found. The manual for the iCN 600 however did mirror what I saw on this device. I guess the software was upgraded.
GREP search expression for Encase to find coordinates ......[\x4f-\x55]\x00
Another issue I am encountering with sat navs is flat batteries and no chargers. Not all of them can be charged via USB however I have found that mobile phone chargers are a good stand in. Motorola have a charger that happily charged this Navman.
A iCN 510 (versionID 3.00.1008 BuildTime 2004-11-22, 12:38:48) has now been submitted and it is a bit more complicated to deal with. It still had a 128mb MMC card but it only had maps on. The .dat files I needed to find were stored within internal memory. The problem to overcome was how to access it. This navman is running a Windows CE NET 4.2 OS and in Windows XP Microsoft Active Sync is required to access it. The plan was to use Paraben's Device Seizure software to image the device. The plan went pear shaped when Active Sync wouldn't connect to the Navman - I am not sure why but I suspect a driver was missing somewhere. In desperation I connected the device to a Vista box and suprisingly detected the Navman immediately as a mobile device and allowed me to copy off the aformentioned .dat files. In Vista Active Sync has been replaced with a free download - Windows Mobile Device Center. I instaled this software and it then identified the Navman as a Windows CE device. Within the device there appeared to be two volumes: \ and My Flash Disk.
Within My Flash Disk there are four notable files:
- Recent.dat
- FavVer3.dat
- route.dat
- tripPlan.dat
RECENT.DAT stores up to thirty of the recently navigated to destinations. These destinations are stored in records of 520 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 507. These are decoded by bookmarking in Encase as a 32 bit integer. In the UK Latitude will begin in the range 49-59 and is decimally notated. Longitude is in the range -5 to +1.6 ish. When bookmarking as a 32 bit integer Longitude is shown first and will often be a negative value (i.e. anywhere west of Greenwich).
FAVVER3.DAT possibly stores up to 200 user entered favourite destinations. These favourite destinations are stored in records of 1508 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 352. These are also decoded by bookmarking in Encase as a 32 bit integer.
ROUTE.DAT I speculate is used to store the origin of the last navigated journey. Coordinates can be found at record offset 507.
TRIPPLAN.DAT contains destinations set by a user when planning a trip with multiple destinations (via Trip Planner in the main menu or via pop up menus in the Map Screen). These destinations are stored in records of 532 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 504. These are also decoded by bookmarking in Encase as a 32 bit integer.
Where I can I try and download manuals for these devices because it helps in mapping the features to the files containing user generated data. I found that the manual for the iCN 510 did not reflect the menu screen I found. The manual for the iCN 600 however did mirror what I saw on this device. I guess the software was upgraded.
GREP search expression for Encase to find coordinates ......[\x4f-\x55]\x00
Another issue I am encountering with sat navs is flat batteries and no chargers. Not all of them can be charged via USB however I have found that mobile phone chargers are a good stand in. Motorola have a charger that happily charged this Navman.
Posts
2 comments:
I have a NAVMAN ICN 530 GPS to analyse et your post was very usefull.
Thank you.
Did you manage to make a forensic copy via the Vista Media Centre? I have a iCN520 here and although I can get to the .dat file as you describe... what I really want to do is data-carve the little fella. So I'd need to make a forensic copy (dd or FTK imager or Xways open disk). But it doesn't show up as a drive with active synch (usb writeblock on thanks)
Thanks in advance for you reply :p
ASH
Post a Comment