Hello everyone
I need your guidance and advice. Please help
For learning purpose, i have just started working on 2 GPS devices (TomTom Go and Naveman S30) i bought them from Ebay. The Totom doesn't have USB connector, i have just the GPS, whereas for the Naveman i have a USB connector with it. A quick search brought me some technical details about the two devices.
The Tomtom has and internal hard drive1.8 inch with 20GB of storage.
The Naveman has an external SD card 2GB and 235MB internal memory.
I have Helix CD and FTK imager; demo version. wiebetech USB writeblocker and Ultra Dock v4 writeblocker.
My Questions are
1- How to image the Naveman withe the write-blocker (Hardware)? I have wiebetech writeblocker usb and IDE/SATA. I connected the Naveman USB connector to my USB writeblocker, but my machine did not detect the GPS. Am i following the right steps? What shall i do?
2- For the Tomtom, i removed its hard drive and connected it to my computer through a 1.8inch adapter, i imaged it and used Registry write blocking trick. Which adapter i have to have to connect it to my wiebetech writeBlocker?
By removing the hard drive and image it the way i did , is it forensically sound?
I really appreciate your advice and help
Hi everyone
I really need your advice and guidance
Yawl, there is some slight confusion because there is a Navman S30 but it maybe people are thinking you have identified a different product with 'Naveman' as you have used that spelling consistently.
I do not mean any offence by my comments, merely people maybe searching for details about 'Naveman' before they respond to you.
If you mean Navman S30 there is a dissertation called 'forensic-investigation-of-navman-devices.pdf' which was written in 2010 and is searchable on Google. I downloaded a copy just a few moments ago to see if it was still available. It is.
Regarding TomTom, have you seen Tomtology2 and have you visited
I suggest the above so as not to rehearse what you may already know.
For the TomTom, you can get an adaptor that clips into the bottom of it to give you a USB, you may also find the window mount provides you with a USB.
Yes removing the hard drive is forensically sound (as long as you can then reassemble it ) ).
The Navman 'should' appear as a mass storage device when connected by USB. I suspect maybe your wiebetech device may be the issue.
If it's not an actual case and it's only for playing with I suggest you try connecting it directly to your PC.
Useful response Andy.
Did you find what you needed Yawl?
trewmte
I thank you very much for correcting me. I believe in leraning from mistakes. Yes you are right, it's Navman S30. The PDF is useful. I am reading it.
''Regarding TomTom, have you seen Tomtology2 and have you visited
Any help with that , will be apreciated.
andysayers
I am more than lucky having you the expert of the GPS, helping me in this very supportive place (Forensicfocus), which i visit eveyday. So thank you very much Andy.
Yes, i removed the Tomtom hard drive and by using an 1.8inch enclosur, i connected it to my Thinkpad and did image it using FTK imager. Writbloking, i used the windows trick. Reasembled it and now it is fully working.
'' The Navman 'should' appear as a mass storage device when connected by USB. I suspect maybe your wiebetech device may be the issue.''
When i connect the Navman via USB to my Thinkpad it apears as a mass strorage device and i did image it the same way i did with the Tomtom. In my write blocker i can not find a USB input to connect the device and image it. Therefore i was thinking to buy the Zif 1.8 inch adapter in order to connect the device to the writeBlocker.
Correct me if i am wrong.
As a student, i am working on these two devices just to learn some skills and delve deeper into the forensic field
trewmte and Andy, i aprecxiate your genuine advice
Any free tools you may suggest to use, in order to explore the image file and convert whatever in the folders into readable format?
Well the Navman probably stores everything in xml files (myfavouritelocations.xml etc) so you'll be able to read everything.
The TomTom is a different beast altogether. You should find what you want in the mapsettings.cfg file.
You can try POIEdit but it won't differentiate different types of location, but then it's free.
Andy
I am deeply sorry for the delay in replying upon your last reply on my question. Thanks you, much appreciated.
You can try POIEdit but it won't differentiate different types of location, but then it's free.
I very much agree with this. I guess POI Edit wouldbe the best approach for going through the mapsettings.cfg file.
All you need to do is to load and drop the mapsettings.cfg file in the main window of POI Edit.