This device has two memory chips hard wired onto the internal pcb, therefore the only regular means of accessing this memory is via the USB port. These sat nav devices will act as mass storage devices when connected via USB. I imaged one whilst connected to a Tableau USB write blocker. Please note that the time the device is switched on is recorded within current.gpx referred to below.
There are few human readable files most notably current.gpx. This file contains the users home location and user selected favourites along with the location of a number of Garmin offices. If a user saves a favourite from a location on a map the favourite will be entitled 001, 002 and so on.
There are a number of ways to investigate the contents of current.gpx. Effectively it is an xml formatted file which I use Microsoft XML Notepad 2007 to review. You can also use a utility such as EasyGPS or open the file with Google Earth.
To report the contents of current.gpx I use Microsoft Excel 2007. In order to do this successfully change the file extension to xml and use the xml data import facility (Data/ From Other Sources/ From XML Data Import) allowing Excel to create the schema. You will end up with a nicely formatted table.
Recently Found locations unfortunately do not appear to be saved within the user accessible memory.
The hidden service menu of the device can be accessed by turning on and then holding a finger on battery symbol on screen for 10 seconds. It is possible once in this menu to interface with the device via USB without it behaving as a mass storage device. Garmin USB drivers are required to do this. I am not sure whether this will be useful forensically at any stage.
UPDATE
A later post relating to a StreetPilot C510 may be some help.
References
http://en.wikipedia.org/wiki/GPS_eXchange_Format
Download nuvi 200 manual
http://www.techonline.com/showArticle.jhtml?articleID=210601020
Posts
7 comments:
I'm the author of the EasyGPS software (freeware) mentioned in the article above. With the rising popularity of GPS receivers, I'm getting more and more requests from forensic investigators wanting to retrieve data from Garmin, Magellan, and other GPS receivers. EasyGPS (and its big brother, ExpertGPS) allow you to extract saved addresses (waypoints, POIs) from just about every GPS receiver on the market, and can display the stored GPS track log over a variety of maps, or in Google Earth.
I'm always happy to discuss GPS data extraction, so if I can ever assist, please feel free to contact me.
Hi Richard,
I've just received one of these devices for examination. Other than the Home and Favourite locations selected by the user have you subsequently recovered any journey data?
Jim
In short - no!
The problem is that there is a memory chip in the device that does not seem to be accessible via normal means.
Richard, To quote one of your other posts "You wait all day for a bus then two come along at once...".
I've just been on a warrant this morning and seized another one of these.
Copy current.gpx file open it with g7towin (freeware). Then click on tracks and list. you will see the track log for the device.
I am also currently awaiting on a warrant on a Nuvi. Any suggestions on how to verify copied file info. Checksum will change after every restart of device since the file is being written each time by device it's self.
Hi friends
i'm a forensic tech from Italy
I'm using your software and your tips for a garmin nuvi 1350-
All works fine !
Many thanks and greetings from Italy
Hi,
My name is Ben and I am currently in my final year studying maths and computing at the University of Derby.
For my dissertation I have written a piece of software to recover GPS information from Garmin Satnavs. My utility displays the Device information, Home Location, Saved Favourites, recent trips as well as older journeys. All these can be viewed on Googlemaps. Important records can be bookmarked, and then a HMTL report produced.
I am now expanding the software to include the Navman and TomTom makes.
Please feel free to email me at: bmc.micky@gmail.com if you would like to be keep updated with this project.
Thanks :)
Post a Comment