Difference between pages "Global Positioning System" and "Cloud Forensics Bibliography"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
The '''Global Positioning System''' ('''GPS''') is a satellite navigation system.
+
'''In chronological order, oldest to most recent'''
  
== Forensics ==
+
<bibtex>
 +
@article{Dykstra12,
 +
author = "Josiah Dykstra and Alan T. Sherman",
 +
title = "Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques",
 +
journal = "Digital Investigation",
 +
volume = {9},
 +
year = {2012},
 +
pages = {S90--S98},
 +
  url="http://ww.cs.umbc.edu/~dykstra/DFRWS_Dykstra.pdf"
 +
</bibtex>
  
There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilities and features as the technology has improved. Some of the most popular GPS devices today are made by [http://www.TomTom.com TomTom]. Some of the other GPS manufacturers include [http://www.garmin.com Garmin] and [http://www.magellangps.com Magellan].
+
<bibtex>
 +
@inproceedings{ISSA,
 +
author = "Waldo Delport and Michael Kohn and Martin S. Olivier",
 +
title = "Isolating a cloud instance for a digital forensic investigation",
 +
  booktitle={Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference},
 +
  year={August 2011},
 +
  organization={ISSA},
 +
</bibtex>
  
 +
<bibtex>
 +
@article{CLSR,
 +
author = "Esther George and Stephen Mason",
 +
title = "Digital evidence and ‘cloud’ computing",
 +
journal = "Computer Law & Security Review",
 +
volume = {27},
 +
issue = {5},
 +
year = {September 2011},
 +
pages = {524--528}
 +
</bibtex>
  
 +
<bibtex>
 +
@article{dykstraJournal,
 +
  author = "Josiah Dykstra and Alan. T. Sherman",
 +
  title = "Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies",
 +
  journal ={Journal of Network Forensics},
 +
  volume = {3},
 +
  number = {1},
 +
  year = {Autumn, 2011},
 +
  pages = {19--31}
 +
}
 +
</bibtex>
  
 +
<bibtex>
 +
@article{ruan,
 +
  title="Cloud forensics: An overview",
 +
  author={Keyun Ruan and Joe Carthy and Tahar Kechadi and Mark Crosbie},
 +
  booktitle={Advances in Digital Forensics VII},
 +
  year={2011},
 +
  url="http://cloudforensicsresearch.org/publication/Cloud_Forensics_An_Overview_7th_IFIP.pdf"
 +
}
  
=== TomTom ===
+
</bibtex>
 +
<bibtex>
  
TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the [http://www.tomtom.com/products/product.php?ID=212&Category=0&Lid=1 TomTom 910] is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.  
+
@inproceedings{ruanSurvey,
 +
  title="Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis",
 +
  author={Keyun Ruan and Ibrahim Baggili and Joe Carthy and Tahar Kechadi},
 +
  booktitle={Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law},
 +
  year={2011},
 +
  organization={ADFSL},
 +
  url="http://www.cloudforensicsresearch.org/publication/Survey_on_Cloud_Forensics_and_Critical_Criteria_for_Cloud_Forensic_Capability_6th_ADFSL.pdf"
 +
}
 +
</bibtex>
  
The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.  
+
<bibtex>
 +
@article{CloudForensics,
 +
  author = {Mark Taylor and John Haggerty and David Gresty and David Lamb},
 +
  title = {Forensic investigation of cloud computing systems},
 +
  journal ={Network Security},
 +
  volume = {2011},
 +
  number = {3},
 +
  year = {2011},
 +
  pages = {4--10},
 +
  url="http://www.whieb.com/download.jsp?address=/upload%2Fdoc%2F20110415%2Fforensic+investigation+of+cloud+computing+systems.pdf"
 +
}
  
TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card.  This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader.  The most important file for the forensic examiner will be the CFG file that is held in the map data directory.  This holds a list of all recent destinations that the user has entered into the device.  The information is held in a hex file and stores the grid coordinates of these locations. 
+
</bibtex>
 +
<bibtex>
  
Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kit.  If the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is paired.  Depending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.  
+
@inproceedings{birk,
 +
  title="Technical Issues of Forensic Investigations in Cloud Computing Environments",
 +
  booktitle = {Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE)},
 +
  author={Dominik Birk and Christoph Wegener},
 +
  year={2011},
 +
  organization={IEEE},
 +
  address = {Oakland, CA, USA},
 +
  url="http://code-foundation.de/stuff/2011-birk-cloud-forensics.pdf"
 +
}
  
The newer TomTom models do not appear as a mass storage device when connected to Windows. They run a Linux operating system and are only accessed via their built in Webserver using the myTomTom program (a replacement for TomTomHome). They cannot currently by examined forensically.
+
</bibtex>
  
Another tool for forensically analysing TomToms is [http://www.forensicnavigation.com TomTology]. This will retrieve all journey details from both live and unallocated space. It will tell you which is the home, favourites and recent destinations and will also tell you the last journey that was plotted and where the TomTom last had a GPS fix. It will also extract phone numbers if the device has been paired with a phone and will find deleted phone numbers, useful for potentially tracing a previous owner.
+
<bibtex>
As of 2012, TomTology has been superseded by TomTology2. This new program has the same functionality as TomTology but also deals with Garmins (live and deleted) and Navmans. It also include inbuilt mapping.
+
@article{Araiza11,
 +
  title="Electronic Discovery in the Cloud",
 +
  author={Alberto G. Araiza},
 +
  journal={Duke Law and Technology Review},
 +
  volume = {8},
 +
  year = {2011},
 +
  url="http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1222&context=dltr"
 +
}
 +
</bibtex>
  
=== Garmin ===
+
<bibtex>
 +
@article{Cross10,
 +
  title="E-Discovery and Cloud Computing:  Control of ESI in the Cloud",
 +
  author={David D. Cross and Emily Kuwahara},
 +
  journal={EDDE Journal},
 +
  volume = {1},
 +
  number = {2},
 +
  year = {2010},
 +
  pages = {2--12},
 +
  url="http://www.crowell.com/documents/E-Discovery-and-Cloud-Computing-Control-of-ESI-in-the-Cloud.pdf"
 +
}
 +
</bibtex>
  
Garmin units connect to a PC in the same way as TomTom, via a USB cable. The unit will mount as a Mass Storage Unit, similar to a USB Memory Stick. After drivers for the unit have loaded, it is possible to navigate the Garmin unit's file system. Many of the files inside can easily be opened in a text or Hex editor.  
+
<bibtex>
 +
@book{Lil10,
 +
  title="Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data",
 +
  author={Terrance V. Lillard},
 +
  year={2010},
 +
  publisher={Syngress},
 +
}
 +
</bibtex>
  
Raw trip data including waypoints, date & time stamps, latitude & longitude coordinates and elevations can be extracted from the Current.gpx file located in the \Garmin\GPX\ folder. It can be viewed by opening the file with a text editor such as [http://notepad-plus.sourceforge.net/ Notepad++]. All recent trips are stored in this file.
+
<bibtex>
 +
@inproceedings{Lu10,
 +
  title="Secure provenance: the essential of bread and butter of data forensics in cloud computing",
 +
  booktitle={Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10)},
 +
  author={Rongxing Lu and Xiaodong Lin and Xiaohui Liang and Xuemin Sherman Shen},
 +
  pages={282--292},
 +
  year={2010},
 +
  address={New York, NY, USA},
 +
  organization={ACM},
 +
  url="http://bbcr.uwaterloo.ca/~rxlu/paper/asiaccs185-lu.pdf"
 +
}
  
Data can also be easily viewed via [http://earth.google.com/ Google Earth]'s import feature. If available, Google Earth will import waypoints, tracks and routes from the unit. A slider bar in the program will show saved routes by date and time. When a specific waypoint is selected, a window will open that shows Lat/Long Coordinates, Altitude, Speed, Heading and Date/Time (Zulu).
+
</bibtex>
  
With this data, raw or when viewed in Google Earth, entire trips can easily be reproduced giving exact time and locations for the GPS unit. It is unknown how many trips the unit is capable of storing or will store by default, but the [https://buy.garmin.com/shop/shop.do?pID=37418#nuvi260w Garmin Nuvi 260W] test unit had 16 days of trip data stored to memory.
+
<bibtex>
  
=== Magellan ===
+
@inproceedings{Wol09,
 +
  title="Overcast: Forensic Discovery in Cloud Environments",
 +
  booktitle = {Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09)},
 +
  author={Stephen D. Wolthusen},
 +
  pages={3--9},
 +
  year={2009},
 +
  address={Washington, DC, USA},
 +
  organization={IEEE Computer Society}
 +
}
  
Magellan GPS units also connect to a PC via a USB cable. The [http://www.magellangps.com/products/product.asp?segID=354&prodID=2053 Magellan Roadmate 1400] unit tested runs a version of Windows CE. The operating system did not appear to be tailored to the specific unit and had options included in the menus that were not available (e.g. backup and restore functionality via a SD memory card slot that did not exist). Upon connecting the unit to a PC, it will mount as a Mass Storage Unit when and if it is recognized. 
+
</bibtex>
  
Files that may contain useful information when opened in a text editor:
 
* /App/Unit.xml
 
** This file contains information about the unit such as Model and Serial number.
 
* /App/Media.cfg
 
** This file is a short list of what types of files are stored in the file structure. (e.g. User data is stored in /USR)
 
* /Sys/USBTRANS/Unit_ID.dat
 
** This file is similar to Unit.xml. It contains more information such as Operating System Version and Firmware version.
 
* /USR/TGUSERA.dat
 
** This file may contain addresses, phone numbers and some user set points such as "Home". There is no recognizable structure to this data so finding useful data is difficult.
 
* /USR/CITYHIST.dat
 
** This file may contain cities entered into the unit by a user. Like TGUSERA.dat, there is little structure here. Unfortunately, only City and State may be listed here.
 
  
Magellan provides [http://www.magellangps.com/products/map.asp?PRODID=1903 VantagePoint] software to view map and waypoint data. In order to use this software, the Magellan unit must be powered on prior to connecting it to a PC. It is unknown how useful the VantagePoint software is in collecting data as the software would not recognize the Roadmate 1400 unit. VantagePoint also did not support the .dat or .cfg files stored on the unit. [http://earth.google.com/ Google Earth] also supports Magellan units via its import feature. Earth lists Explorist and Serial as available import options.
 
 
  
=== Digital Camera Images with GPS Information ===
+
[[Category:Bibliographies]]
 
+
Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where exactly a photo was taken. This positioning information (latitude, longitude) can be stored in the [[Exif]] [[metadata]] header of [[JPEG]] files. Tools such as [[jhead]] can display the GPS information in the [[Exif]] headers.
+
 
+
=== Cell Phones with GPS ===
+
 
+
Some recent cell phones (e.g. a [http://wiki.openezx.org Motorola EZX phone] such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.
+
 
+
== External Links ==
+
 
+
* [http://www.gpsforensics.org GPSForensics.org - A communitiy dedicated to GPS device forensics]
+
 
+
* [http://en.wikipedia.org/wiki/Global_Positioning_System Wikipedia: GPS]
+
 
+
* [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=405 Paraben's Device Seizure]
+
 
+
* [http://www.forensicnavigation.com TomTology2 by Forensic Navigation]
+
 
+
* [http://www.berlacorp.com/blackthorn.html Blackthorn | GPS Forensics]
+

Revision as of 10:43, 27 June 2012

In chronological order, oldest to most recent

Josiah Dykstra, Alan T. Sherman - Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques
Digital Investigation 9:S90--S98,2012
http://ww.cs.umbc.edu/~dykstra/DFRWS_Dykstra.pdf
Bibtex
Author : Josiah Dykstra, Alan T. Sherman
Title : Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques
In : Digital Investigation -
Address :
Date : 2012

Waldo Delport, Michael Kohn, Martin S. Olivier - Isolating a cloud instance for a digital forensic investigation
Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference ,August 2011
Bibtex
Author : Waldo Delport, Michael Kohn, Martin S. Olivier
Title : Isolating a cloud instance for a digital forensic investigation
In : Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference -
Address :
Date : August 2011

Esther George, Stephen Mason - Digital evidence and ‘cloud’ computing
Computer Law & Security Review 27:524--528,September 2011
Bibtex
Author : Esther George, Stephen Mason
Title : Digital evidence and ‘cloud’ computing
In : Computer Law & Security Review -
Address :
Date : September 2011

Josiah Dykstra, Alan. T. Sherman - Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies
Journal of Network Forensics 3(1):19--31,Autumn, 2011
Bibtex
Author : Josiah Dykstra, Alan. T. Sherman
Title : Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies
In : Journal of Network Forensics -
Address :
Date : Autumn, 2011

Keyun Ruan, Joe Carthy, Tahar Kechadi, Mark Crosbie - Cloud forensics: An overview
,2011
http://cloudforensicsresearch.org/publication/Cloud_Forensics_An_Overview_7th_IFIP.pdf
Bibtex
Author : Keyun Ruan, Joe Carthy, Tahar Kechadi, Mark Crosbie
Title : Cloud forensics: An overview
In : -
Address :
Date : 2011

Keyun Ruan, Ibrahim Baggili, Joe Carthy, Tahar Kechadi - Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis
Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law ,2011
http://www.cloudforensicsresearch.org/publication/Survey_on_Cloud_Forensics_and_Critical_Criteria_for_Cloud_Forensic_Capability_6th_ADFSL.pdf
Bibtex
Author : Keyun Ruan, Ibrahim Baggili, Joe Carthy, Tahar Kechadi
Title : Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis
In : Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law -
Address :
Date : 2011

Mark Taylor, John Haggerty, David Gresty, David Lamb - Forensic investigation of cloud computing systems
Network Security 2011(3):4--10,2011
http://www.whieb.com/download.jsp?address=/upload%2Fdoc%2F20110415%2Fforensic+investigation+of+cloud+computing+systems.pdf
Bibtex
Author : Mark Taylor, John Haggerty, David Gresty, David Lamb
Title : Forensic investigation of cloud computing systems
In : Network Security -
Address :
Date : 2011

Dominik Birk, Christoph Wegener - Technical Issues of Forensic Investigations in Cloud Computing Environments
Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE) , Oakland, CA, USA,2011
http://code-foundation.de/stuff/2011-birk-cloud-forensics.pdf
Bibtex
Author : Dominik Birk, Christoph Wegener
Title : Technical Issues of Forensic Investigations in Cloud Computing Environments
In : Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE) -
Address : Oakland, CA, USA
Date : 2011

Alberto G. Araiza - Electronic Discovery in the Cloud
Duke Law and Technology Review 8,2011
http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1222&context=dltr
Bibtex
Author : Alberto G. Araiza
Title : Electronic Discovery in the Cloud
In : Duke Law and Technology Review -
Address :
Date : 2011

David D. Cross, Emily Kuwahara - E-Discovery and Cloud Computing: Control of ESI in the Cloud
EDDE Journal 1(2):2--12,2010
http://www.crowell.com/documents/E-Discovery-and-Cloud-Computing-Control-of-ESI-in-the-Cloud.pdf
Bibtex
Author : David D. Cross, Emily Kuwahara
Title : E-Discovery and Cloud Computing: Control of ESI in the Cloud
In : EDDE Journal -
Address :
Date : 2010

Terrance V. Lillard - Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data
Syngress,2010
Bibtex
Author : Terrance V. Lillard
Title : Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data
In : -
Address :
Date : 2010

Rongxing Lu, Xiaodong Lin, Xiaohui Liang, Xuemin Sherman Shen - Secure provenance: the essential of bread and butter of data forensics in cloud computing
Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10) pp. 282--292, New York, NY, USA,2010
http://bbcr.uwaterloo.ca/~rxlu/paper/asiaccs185-lu.pdf
Bibtex
Author : Rongxing Lu, Xiaodong Lin, Xiaohui Liang, Xuemin Sherman Shen
Title : Secure provenance: the essential of bread and butter of data forensics in cloud computing
In : Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10) -
Address : New York, NY, USA
Date : 2010

Stephen D. Wolthusen - Overcast: Forensic Discovery in Cloud Environments
Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09) pp. 3--9, Washington, DC, USA,2009
Bibtex
Author : Stephen D. Wolthusen
Title : Overcast: Forensic Discovery in Cloud Environments
In : Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09) -
Address : Washington, DC, USA
Date : 2009