Garmin navigator

https://www.forensicnavigation.com/ - who sell Tomtology2 - Also supports Garmin, best tool for the job IMO.

Cellebrite can physically dump these devices and parse the data.

Which model is it?

Older Garmin devices are straightforward to examine. They keep accurate records of trips undertaken in GPX files, which are readable by Google Earth. The associated dates are in UTC if I remember correctly.

You can connect the device via USB writeblocker and take an image as normal - the internal storage is readable by most general forensic tools (I think it uses Fat32 off the top of my head). Then copy out the GPX files. The most recent trip should still be live.

What Chris_Ed said.

The most recent trip data will be in the Current.gpx file. The files are plain text but can also be 'dropped' into Google Earth.

it's a drive 40. thanks

While I'm not familiar with that device specifically, the manual states that it will connect to a PC and present itself as USB storage. So try connecting it via USB write blocker and examining the file system to see if it maintains GPX files.

If not, then according to this support question

http//iqc.garmin.com/eCustomer/KODSelfService/request.do?create=kbgarmin&view()=c%7B69721d30-1983-11de-76c5-000000000000%7D

.. you can view trip logs on the device itself. (that URL seems to break the forum URL code embedding bobbins, sorry)

Obvious warning; you will need to do this in a faraday box to avoid the device reconnecting to satellites. Good practice dictates that you should record your actions, too (potentially via video of some kind).

Good luck!

thanks all. I tried to connect it using a usb writeblocker to my 2 pc one has win 7sp1 the other win 10. In both situation I can't see the drive.