Notifications
Clear all

GPS Analysis

9 Posts
4 Users
0 Likes
5,258 Views
Yawl
 Yawl
(@yawl)
Posts: 13
Active Member
Topic starter
 

Hello everyone

I need your guidance and advice. Please help

For learning purpose, i have just started working on 2 GPS devices (TomTom Go and Naveman S30) i bought them from Ebay. The Totom doesn't have USB connector, i have just the GPS, whereas for the Naveman i have a USB connector with it. A quick search brought me some technical details about the two devices.

The Tomtom has and internal hard drive1.8 inch with 20GB of storage.
The Naveman has an external SD card 2GB and 235MB internal memory.

I have Helix CD and FTK imager; demo version. wiebetech USB writeblocker and Ultra Dock v4 writeblocker.

My Questions are

1- How to image the Naveman withe the write-blocker (Hardware)?
I have wiebetech writeblocker usb and IDE/SATA. I connected the Naveman USB connector to my USB writeblocker, but my machine did not detect the GPS. Am i following the right steps? What shall i do?

2- For the Tomtom, i removed its hard drive and connected it to my computer through a 1.8inch adapter, i imaged it and used Registry write blocking trick. Which adapter i have to have to connect it to my wiebetech writeBlocker?

By removing the hard drive and image it the way i did , is it forensically sound?

I really appreciate your advice and help

 
Posted : 22/11/2012 8:10 am
Yawl
 Yawl
(@yawl)
Posts: 13
Active Member
Topic starter
 

Hi everyone

I really need your advice and guidance

 
Posted : 22/11/2012 5:39 pm
(@trewmte)
Posts: 1877
Noble Member
 

Yawl, there is some slight confusion because there is a Navman S30 but it maybe people are thinking you have identified a different product with 'Naveman' as you have used that spelling consistently.

I do not mean any offence by my comments, merely people maybe searching for details about 'Naveman' before they respond to you.

If you mean Navman S30 there is a dissertation called 'forensic-investigation-of-navman-devices.pdf' which was written in 2010 and is searchable on Google. I downloaded a copy just a few moments ago to see if it was still available. It is.

Regarding TomTom, have you seen Tomtology2 and have you visited www.forensicnavigation.com/. yet? Andy Sayers or Paul Weall might be able to give you a few tips.

I suggest the above so as not to rehearse what you may already know.

 
Posted : 22/11/2012 6:09 pm
(@andysayers)
Posts: 13
Active Member
 

For the TomTom, you can get an adaptor that clips into the bottom of it to give you a USB, you may also find the window mount provides you with a USB.
Yes removing the hard drive is forensically sound (as long as you can then reassemble it ) ).

The Navman 'should' appear as a mass storage device when connected by USB. I suspect maybe your wiebetech device may be the issue.
If it's not an actual case and it's only for playing with I suggest you try connecting it directly to your PC.

 
Posted : 22/11/2012 7:57 pm
(@trewmte)
Posts: 1877
Noble Member
 

Useful response Andy.

Did you find what you needed Yawl?

 
Posted : 23/11/2012 2:04 pm
Yawl
 Yawl
(@yawl)
Posts: 13
Active Member
Topic starter
 

trewmte

I thank you very much for correcting me. I believe in leraning from mistakes. Yes you are right, it's Navman S30. The PDF is useful. I am reading it.

''Regarding TomTom, have you seen Tomtology2 and have you visited www.forensicnavigation.com/. '' Yes trewmte, i know about it. As i am a student and myb resources are very limited, i would like to have access to free software to do more prtactioce.

Any help with that , will be apreciated.

andysayers

I am more than lucky having you the expert of the GPS, helping me in this very supportive place (Forensicfocus), which i visit eveyday. So thank you very much Andy.

Yes, i removed the Tomtom hard drive and by using an 1.8inch enclosur, i connected it to my Thinkpad and did image it using FTK imager. Writbloking, i used the windows trick. Reasembled it and now it is fully working.

'' The Navman 'should' appear as a mass storage device when connected by USB. I suspect maybe your wiebetech device may be the issue.''

When i connect the Navman via USB to my Thinkpad it apears as a mass strorage device and i did image it the same way i did with the Tomtom. In my write blocker i can not find a USB input to connect the device and image it. Therefore i was thinking to buy the Zif 1.8 inch adapter in order to connect the device to the writeBlocker.

Correct me if i am wrong.

As a student, i am working on these two devices just to learn some skills and delve deeper into the forensic field

trewmte and Andy, i aprecxiate your genuine advice

Any free tools you may suggest to use, in order to explore the image file and convert whatever in the folders into readable format?

 
Posted : 23/11/2012 7:31 pm
(@andysayers)
Posts: 13
Active Member
 

Well the Navman probably stores everything in xml files (myfavouritelocations.xml etc) so you'll be able to read everything.
The TomTom is a different beast altogether. You should find what you want in the mapsettings.cfg file.
You can try POIEdit but it won't differentiate different types of location, but then it's free.

 
Posted : 26/11/2012 7:49 pm
Yawl
 Yawl
(@yawl)
Posts: 13
Active Member
Topic starter
 

Andy

I am deeply sorry for the delay in replying upon your last reply on my question. Thanks you, much appreciated.

 
Posted : 06/12/2012 11:18 pm
(@ashishsingh)
Posts: 29
Eminent Member
 

You can try POIEdit but it won't differentiate different types of location, but then it's free.

I very much agree with this. I guess POI Edit wouldbe the best approach for going through the mapsettings.cfg file.

All you need to do is to load and drop the mapsettings.cfg file in the main window of POI Edit.

 
Posted : 07/04/2015 2:52 pm
Share: