Navman S30 Satnav device

I have seen a number of different Navman models now. All of them have subtle variations on how to process them. Although the underlying OS is Microsoft WinCE.NET 5.0 Core Version I did not have to access this device via Mobile Device Centre. After applying some write blocking to my USB port this device was accessible as a mass storage device allowing me to image it with Encase. I ended up with 114,759 sectors being imaged.

The next step I took was to track down and consult a manual for the device in order to establish its capabilities. I expect all devices to have saved Home, Favourites and Recent destinations and this device was no exception.

In addition however this device can save trip logs, pre-planned itineraries, pictures and be paired with a mobile phone.

Almost all the relevant data is stored within xml formatted files. Microsoft Excel 2007 is an excellent tool for examining these files and subsequently reporting on them. I use the Get External Data / From Other Sources / From XML Data Import option via the data tab and allow Excel to sort out the formatting.

A good place to start is the file paths.xml stored at the root of the partition. This file details the location of some of the relevant files.

This is a more definitive list:

• MyFavouriteLocations.xml - used to store the home location and favourites
• MyRecentLocations.xml - used to store Recents and also Journey Starts
  
• MyMultiStopLocations.xml - used to store saved multi stop journeys
• MyRoute.xml - used to store the current journey which is in effect the last journey -on the device I examined this file was deleted but recoverable
  
• UserSettings.xml – used to store device settings including where the unit was turned off
  

When a user enters a new address the menu shows previously entered towns or cities, road names and postcodes. This data is stored in the following files:

• DWRecentPocode.xml – Previously entered postcodes, most recent first
  
• DWRecentRoad.xml – Previously entered road names, most recent first
  
• DWRecentPlace.xml – Previously entered towns or cities, most recent first
  

There are a number of presumably back up files also containing the same (as far as I could see) xml formatted data:

• MyFavouriteLocations_bak.xml
• MyRecentLocations_bak.xml
  
• MyMultiStopLocations_bak.xml
  

There are also two files that appear to be temporary files which were deleted but recoverable, containing xml formatted data:

• MyRecentLocations_New.xml
  
• MyMultiStopLocations_New.xml
  

All of the above mentioned xml files are parsed very tidily using Microsoft Excel 2007. I use the same program to create an html version of the worksheet after a little tidying up. The longitude and latitude values need to be divided by 100,000. I populate a new column using the formula:

=HYPERLINK("http://maps.google.co.uk/maps?q="&(K3/100000)&"+"&(L3/100000)&"","Click here to view in Google Maps")
The cell K3 contains the Latitude and L3 the Longitude. The formula creates a clickable hyperlink to the Lat/Long in google maps.

There are one or two other files of interest:

• destdata.dat - which contains the address used for the last navigated journey
  
• gpslog.ini - detailing the location of trip log data
  
• default_settings.xml -which in the FAVOURITES/ RECENTS/ MULTI-STOP section appears to detail the maximum number of favourites and recents
  
• .pcd - on the unit I examined I could not locate a .pcd file however I understand from Andy Sayers that this file if it exists contains the phonebook from a paired mobile phone
  
• Log001.log - again I did not see this file but if it exists it contains GPS track logs
  

Because we have physical access there is also a possibility of recovering relevant data from unallocated clusters. I located records in unallocated using the keyword <lat> .

References
Sat Nav Examination Guidance Notes (Andy Sayers)
Navman S-Series (S30, S50, S70 & S90i) User Manual

Navman F20 Sat Nav device

Yet another Navman sat nav has come my way - an F20 (versionID 4.10.1029 BuildTime 2007-02-12, 09:38:57) and once again a different approach is required to access the relevant data files. The last Navman I looked at was a Windows CE device that became accessible using Mobile Device Centre in Vista. I have not been able to access this device the same way and I believe the underlying OS is Linux based. This site also states that the F20 is not running Windows CE. The case markings also do not disclose the precise model within the F series range. There are hidden service menus that will provide model and firmware information that are accessible by holding down the power and menu buttons together when powering on.

There is an SD Card slot which on the device I examined was not populated. The data was stored internally. I was not able to access this device as a removable USB storage device despite tracking down a driver. The only option left to me was to identify the storage within the device - luckily I discovered that the device has a micro SD card that is accessible without resorting to a full disassembly. The following pictures show how to access the card.







The memory card was formatted FAT16 and within the Navman/System folder I identified three notable files:

• Recent.dat
• Favver4.dat
  
• Route.dat
  

RECENT.DAT stores up to thirty locations. The locations may be
-destinations that the user chose to navigate to
-they may be the location that the unit was at when it was turned on
-or the location the unit was at when the user chose to navigate to a new destination.
These locations are stored in records of 520 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 507. These are decoded by bookmarking in Encase as a 32 bit integer. The resulting values need to be divided by 100,000. In the UK Latitude will begin in the range 49-59 and is decimally notated. Longitude is in the range -5 to +1.6 ish. When bookmarking as a 32 bit integer Longitude is shown first and will often be a negative value (i.e. anywhere west of Greenwich).

FAVVER4.DAT possibly stores up to 200 user entered favourite destinations. These favourite destinations are stored in records of 1508 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 352. These are also decoded by bookmarking in Encase as a 32 bit integer and dividing each value by 100,000. I also established that the first location stored within this file was the User inputted Home location.

ROUTE.DAT I speculate is used to store the origin of the last navigated journey. Coordinates can be found at record offset 507 however in this particular device no data was found in this file.

I have an Enscript kindly coded by my friend Oliver Smith over at Cy4or to parse the recent.dat file. Please email me if you need it.

Along with the F20 I have also examined a Navman iCN 330. This unit is similar to the Navman iCN 310 I wrote about earlier. This device had it's notable files stored upon an SD card also. Notably all the flash media cards I have examined that originate from Navman devices did not contain any relevant data within unallocated clusters. This suggests that in some cases a manual examination (i.e. photograph display whilst device is turned on) may suffice.

Another issue I have encountered is how to test on these devices. On TomToms it is possible to clone the memory cards and use the cloned card for testing. This is not possible with the Navman devices I have seen. When you run the Navman with the cloned card you quickly receive an eror message No Map Data or similar. It appears that Navman has some anti copying features built in that utilise the flash card's CID number (which I believe is stored within a non host accessible area of the flash card). As each card has a unique CID number cloning is impared.

References
http://navmanunlocked.wikispaces.com/Unlock
http://www.sdcard.org/about/memory_card/pls/
http://duff.dk/navman/
http://www.gizmondoforums.com/forums/index.php?showtopic=5366

Navman iCN 510

I blogged a short time ago about the Navman iCN 310 satellite navigation device.

A iCN 510 (versionID 3.00.1008 BuildTime 2004-11-22, 12:38:48) has now been submitted and it is a bit more complicated to deal with. It still had a 128mb MMC card but it only had maps on. The .dat files I needed to find were stored within internal memory. The problem to overcome was how to access it. This navman is running a Windows CE NET 4.2 OS and in Windows XP Microsoft Active Sync is required to access it. The plan was to use Paraben's Device Seizure software to image the device. The plan went pear shaped when Active Sync wouldn't connect to the Navman - I am not sure why but I suspect a driver was missing somewhere. In desperation I connected the device to a Vista box and suprisingly detected the Navman immediately as a mobile device and allowed me to copy off the aformentioned .dat files. In Vista Active Sync has been replaced with a free download - Windows Mobile Device Center. I instaled this software and it then identified the Navman as a Windows CE device. Within the device there appeared to be two volumes: \ and My Flash Disk.

Within My Flash Disk there are four notable files:

• Recent.dat
• FavVer3.dat
  
• route.dat
• tripPlan.dat
  

RECENT.DAT stores up to thirty of the recently navigated to destinations. These destinations are stored in records of 520 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 507. These are decoded by bookmarking in Encase as a 32 bit integer. In the UK Latitude will begin in the range 49-59 and is decimally notated. Longitude is in the range -5 to +1.6 ish. When bookmarking as a 32 bit integer Longitude is shown first and will often be a negative value (i.e. anywhere west of Greenwich).

FAVVER3.DAT possibly stores up to 200 user entered favourite destinations. These favourite destinations are stored in records of 1508 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 352. These are also decoded by bookmarking in Encase as a 32 bit integer.

ROUTE.DAT I speculate is used to store the origin of the last navigated journey. Coordinates can be found at record offset 507.

TRIPPLAN.DAT contains destinations set by a user when planning a trip with multiple destinations (via Trip Planner in the main menu or via pop up menus in the Map Screen). These destinations are stored in records of 532 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 504. These are also decoded by bookmarking in Encase as a 32 bit integer.

Where I can I try and download manuals for these devices because it helps in mapping the features to the files containing user generated data. I found that the manual for the iCN 510 did not reflect the menu screen I found. The manual for the iCN 600 however did mirror what I saw on this device. I guess the software was upgraded.

GREP search expression for Encase to find coordinates ......[\x4f-\x55]\x00

Another issue I am encountering with sat navs is flat batteries and no chargers. Not all of them can be charged via USB however I have found that mobile phone chargers are a good stand in. Motorola have a charger that happily charged this Navman.

Navman iCN320 Sat Nav device

I have previously written elsewhere a guide to investigating TomToms and of course there is TomTology and the paper by Beverley Nutter of the MPS out there as well.

Today I had a Navman iCN320 sat nav come my way.

After a brief look it seems that the crucial three files are within the SYSTEM directory:

• RECENT.DAT
• FAVVER4.DAT
  
• ROUTE.DAT

They are stored on a 256mb MMC card formatted FAT16.

RECENT.DAT stores up to thirty of the recently navigated to destinations. These destinations are stored in records of 520 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 507. These are decoded by bookmarking in Encase as a 32 bit integer. In the UK Latitude will begin in the range 49-59 and is decimally notated. Longitude is in the range -5 to +1.6 ish. When bookmarking as a 32 bit integer Longitude is shown first and will often be a negative value (i.e. anywhere west of Greenwich).

FAVVER4.DAT possibly stores up to 200 user entered favourite destinations. These favourite destinations are stored in records of 1508 bytes in length. Each destination has its Lat/Long coordinates stored in 8 bytes starting at Record Offset 352. These are also decoded by bookmarking in Encase as a 32 bit integer.

ROUTE.DAT I speculate is used to store the origin of the last navigated journey. Coordinates can be found at record offset 507.

GREP search expression for Encase ......[\x4f-\x55]\x00

Looks like a bit of testing is in order!