Difference between pages "Global Positioning System" and "JTAG LG P930 (Nitro HD)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Forensics)
 
 
Line 1: Line 1:
The '''Global Positioning System''' ('''GPS''') is a satellite navigation system.
+
== JTAG LG P930 (Nitro HD) ==
  
== Forensics ==
+
The LG P930 (Nitro HD) is an Android based smartphone. At the time of this writing (2013FEB07), I am unaware of any method to bypass the PIN, password, or pattern locks on a LG P930 that is not rooted and does not have ADB enabled. JTAG to the rescue! Using JTAG, a copy of the NAND can be extracted, and the pin or pattern lock decoded from it.
  
There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilities and features as the technology has improved. Some of the most popular GPS devices today are made by [http://www.TomTom.com TomTom]. Some of the other GPS manufacturers include [http://www.garmin.com Garmin] and [http://www.magellangps.com Magellan].
+
For the purpose of this document, a LG P930 with a gesture pattern lock was disassembled, read via JTAG, reassembled, and the pattern lock removed.
  
[[File:Blackthorn.png]]
+
=== Getting Started ===
----
+
Berla Corp. Has has released a BETA version of their new GPS forensics tool. It integrates acquisition, examination, and analysis into one small easy to use piece of software. [http://blackthorngps.com Get your free copy today]. Blackthorn currently supports both legacy and current Garmin, TomTom, and Magellan devices.
+
  
=== TomTom ===
+
What you need to extract the lock from the device:
  
TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the [http://www.tomtom.com/products/product.php?ID=212&Category=0&Lid=1 TomTom 910] is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.  
+
# A Octoplus JTAG Box with the latest Octoplus JTAG Manager software. The Octoplus JTAG Box used for this was purchased from GSM Server on eBay. Update: This device is now supported by the RIFF Box as well.
 +
# Soldering skills and ultra-fine tip soldering iron (a JTAG jig may be available).
 +
# A DC Power supply capable of supplying 3.8V/1.83A output. The power supply used for this was an Agilent U8002A DC Power Supply.
 +
# PatternLockScripts from CCL Forensics ('GenerateAndroidGestureRainbowTable.py' and 'Android_GestureFinder.py').
  
The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.
+
=== NAND Dump Procedure ===
  
TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card. This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader. The most important file for the forensic examiner will be the CFG file that is held in the map data directory. This holds a list of all recent destinations that the user has entered into the device. The information is held in a hex file and stores the grid coordinates of these locations.
+
# Disassemble the phone down to the PCB.
 +
# Connect the Octoplus JTAG Box to the PC via USB.
 +
# Connect the Octoplus JTAG Box to the PCB via the JTAG pins.
 +
# Connect the PCB to the DC power supply.
 +
# Start the "Octoplus JTAG" software.
 +
# Power the PCB.
 +
# Dump the NAND.
  
Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kit.  If the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is paired.  Depending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.
+
Instructions for disassembly can be found on Internet but it can be summarised as follows:
  
Automated forensic analysis for TomTom GPS units is possible with software from Digivence - Forensic Analyser - TomTom Edition.   [http://www.digivence.com/SCREEN%20OPTIMISED%20REPORT%20-%20Demo%2011072007%20163219.htm Sample Report].  Whilst not shown in the example report, call history, contacts, text messages, Bluetooth MAC ID, and unit info is also automatically processed if available.
+
# Remove the rear cover and battery.
 +
# Remove the 9 x Phillips screws.
 +
# Split the phone case using a case opening tool (guitar pick).
  
Another tool for forensically analysing TomToms is [http://www.forensicnavigation.com TomTology]. This will retrieve all journey details from both live and unallocated space. It will tell you which is the home, favourites and recent destinations and will also tell you the last journey that was plotted and where the TomTom last had a GPS fix. It will also extract phone numbers if the device has been paired with a phone and will find deleted phone numbers, useful for potentially tracing a previous owner.
+
{| border="1" cellpadding="2"
 +
|-
 +
| [[ File:lg-p930-nitro-hd-front.png | 400px ]]
 +
| [[ File:lg-p930-nitro-hd-back.png | 400px ]]
 +
|-
 +
|}
  
=== Garmin ===
+
Once the phone has been disassembled, you can see the JTAG connection port near the microUSB header. The connector used on the PCB is a microminiature board-to-board Molex connectors. Molex sells the mating heading under the brand name "SlimStack" however sourcing these headers in small quantities can be difficult. In some cases, JTAG adapter jigs can be purchased from companies such as multi-com.pl however based on the cost and amount of time it takes to receive said items, it can be faster to solder lead wires off this header. Note: A decent microscope is mandatory for this step as soldering these connections without one is extremely difficult.
  
Garmin units connect to a PC in the same way as TomTom, via a USB cable. The unit will mount as a Mass Storage Unit, similar to a USB Memory Stick. After drivers for the unit have loaded, it is possible to navigate the Garmin unit's file system. Many of the files inside can easily be opened in a text or Hex editor.  
+
{| border="1" cellpadding="2"
 +
|-
 +
| [[ File:lg-p930-nitro-hd-disassembled-1.png | 350px ]]
 +
| [[ File:lg-p930-nitro-hd-disassembled-2.png | 350px ]]
 +
| [[ File:lg-p930-nitro-hd-disassembled-3.png | 350px ]]
 +
|-
 +
|}
  
Raw trip data including waypoints, date & time stamps, latitude & longitude coordinates and elevations can be extracted from the Current.gpx file located in the \Garmin\GPX\ folder. It can be viewed by opening the file with a text editor such as [http://notepad-plus.sourceforge.net/ Notepad++]. All recent trips are stored in this file.
+
With the phone now disassembled you can solder on your 0.040 gauge lead wires to the JTAG test points. Also, connect the PCB battery terminal connections to the DC power supply. The negative (-) connection is the innermost pin and the positive (+) pin is the outside pin. You can configure your power supply to match the battery specifications which in this case is 3.8V and 1.830A but do not apply power at this time.
  
Data can also be easily viewed via [http://earth.google.com/ Google Earth]'s import feature. If available, Google Earth will import waypoints, tracks and routes from the unit. A slider bar in the program will show saved routes by date and time. When a specific waypoint is selected, a window will open that shows Lat/Long Coordinates, Altitude, Speed, Heading and Date/Time (Zulu).
 
  
With this data, raw or when viewed in Google Earth, entire trips can easily be reproduced giving exact time and locations for the GPS unit. It is unknown how many trips the unit is capable of storing or will store by default, but the [https://buy.garmin.com/shop/shop.do?pID=37418#nuvi260w Garmin Nuvi 260W] test unit had 16 days of trip data stored to memory.  
+
{| border="1" cellpadding="2"
 +
|-
 +
| [[ File:lg-p930-nitro-hd-connected-via-jtag-1.png | 350px ]]
 +
| [[ File:lg-p930-nitro-hd-connected-via-jtag-2.png | 350px ]]
 +
| [[ File:lg-p930-nitro-hd-connected-via-jtag-3.png | 350px ]]
 +
|-
 +
|}
  
=== Magellan ===
+
Now we can start the Octoplus JTAG software and configure it. See the picture for more detail.
  
Magellan GPS units also connect to a PC via a USB cable. The [http://www.magellangps.com/products/product.asp?segID=354&prodID=2053 Magellan Roadmate 1400] unit tested runs a version of Windows CE. The operating system did not appear to be tailored to the specific unit and had options included in the menus that were not available (e.g. backup and restore functionality via a SD memory card slot that did not exist). Upon connecting the unit to a PC, it will mount as a Mass Storage Unit when and if it is recognized. 
 
  
Files that may contain useful information when opened in a text editor:
+
{| border="1" cellpadding="2"
* /App/Unit.xml
+
|-
** This file contains information about the unit such as Model and Serial number.  
+
| [[ File:octoplus-settings.png | 600px ]]
* /App/Media.cfg
+
|-
** This file is a short list of what types of files are stored in the file structure. (e.g. User data is stored in /USR)
+
|}
* /Sys/USBTRANS/Unit_ID.dat
+
** This file is similar to Unit.xml. It contains more information such as Operating System Version and Firmware version.
+
* /USR/TGUSERA.dat
+
** This file may contain addresses, phone numbers and some user set points such as "Home". There is no recognizable structure to this data so finding useful data is difficult.
+
* /USR/CITYHIST.dat
+
** This file may contain cities entered into the unit by a user. Like TGUSERA.dat, there is little structure here. Unfortunately, only City and State may be listed here.
+
  
Magellan provides [http://www.magellangps.com/products/map.asp?PRODID=1903 VantagePoint] software to view map and waypoint data. In order to use this software, the Magellan unit must be powered on prior to connecting it to a PC. It is unknown how useful the VantagePoint software is in collecting data as the software would not recognize the Roadmate 1400 unit. VantagePoint also did not support the .dat or .cfg files stored on the unit. [http://earth.google.com/ Google Earth] also supports Magellan units via its import feature. Earth lists Explorist and Serial as available import options.
+
Apply power to the DC power supply and turn the phone on using the button on the side of the PCB (you will feel the phone vibrate after 3-5 seconds of holding the button). After powering the phone on, connect via JTAG to the phone by hitting the "Connect" button in the Octoplus JTAG software, you should receive a "Connect Successful" message in the bottom pane. Now click on the "Read" button to start the read and name the output file accordingly. In this case I named the file "lg-p930-jtag-x0000000_x06BC000.bin" to reflect the memory range I am extracting.
+
  
=== Digital Camera Images with GPS Information ===
+
If you receive errors that the PCB could not be connected to, try the following:
  
Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where exactly a photo was taken. This positioning information (latitude, longitude) can be stored in the [[Exif]] [[metadata]] header of [[JPEG]] files. Tools such as [[jhead]] can display the GPS information in the [[Exif]] headers.
+
* Confirm that the PCB is receiving power from the DC power supply.  If you can measure current draw of the PCB, you should see that the PCB is pulling about 0.04A.  If the PCB is pulling more current, it is likely already booted and the read may fail.
 +
* Power off the PCB, power it back on, and immediately connect then start the JTAG read.
 +
* Check all of your PCB to JTAG connections under a microscope. Inspect for shorts or incorrect connections.
 +
* Upon receiving a successful JTAG dump you can process the file with the CCL Forensics Android scripts to extract the gesture or pin lock.
  
=== Cell Phones with GPS ===
+
==== Notes ====
  
Some recent cell phones (e.g. a [http://wiki.openezx.org Motorola EZX phone] such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.
+
This exhibit gave us some issue when reading ~100MB mark and the read kept disconnecting around that memory range. We opted to read the device with multiple reads by reading from 0MB-96MB, skipping over data, then reading from 192MB-EOF. This captured enough data to acquire the password hash which was located around the 1.3GB range on this particular phone.
  
== External Links ==
+
== References ==
  
* [http://www.gpsforensics.org GPSForensics.org - A communitiy dedicated to GPS device forensics]
+
* http://android-forensics.com/android-forensics-study-of-password-and-pattern-lock-protection/143
 
+
* http://forensics.spreitzenbarth.de/2012/02/
* [http://en.wikipedia.org/wiki/Global_Positioning_System Wikipedia: GPS]
+
* http://www.ccl-forensics.com/Software/other-software-a-scripts.html
 
+
* [http://www.digivence.com Digivence: TomTom Forensic Analyser]
+
 
+
* [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=405 Paraben's Device Seizure]
+
 
+
* [http://www.forensicnavigation.com TomTology by Forensic Navigation]
+
 
+
* [http://www.blackthorngps.com Blackthorn | GPS Forensics]
+

Latest revision as of 09:32, 18 August 2013

JTAG LG P930 (Nitro HD)

The LG P930 (Nitro HD) is an Android based smartphone. At the time of this writing (2013FEB07), I am unaware of any method to bypass the PIN, password, or pattern locks on a LG P930 that is not rooted and does not have ADB enabled. JTAG to the rescue! Using JTAG, a copy of the NAND can be extracted, and the pin or pattern lock decoded from it.

For the purpose of this document, a LG P930 with a gesture pattern lock was disassembled, read via JTAG, reassembled, and the pattern lock removed.

Getting Started

What you need to extract the lock from the device:

  1. A Octoplus JTAG Box with the latest Octoplus JTAG Manager software. The Octoplus JTAG Box used for this was purchased from GSM Server on eBay. Update: This device is now supported by the RIFF Box as well.
  2. Soldering skills and ultra-fine tip soldering iron (a JTAG jig may be available).
  3. A DC Power supply capable of supplying 3.8V/1.83A output. The power supply used for this was an Agilent U8002A DC Power Supply.
  4. PatternLockScripts from CCL Forensics ('GenerateAndroidGestureRainbowTable.py' and 'Android_GestureFinder.py').

NAND Dump Procedure

  1. Disassemble the phone down to the PCB.
  2. Connect the Octoplus JTAG Box to the PC via USB.
  3. Connect the Octoplus JTAG Box to the PCB via the JTAG pins.
  4. Connect the PCB to the DC power supply.
  5. Start the "Octoplus JTAG" software.
  6. Power the PCB.
  7. Dump the NAND.

Instructions for disassembly can be found on Internet but it can be summarised as follows:

  1. Remove the rear cover and battery.
  2. Remove the 9 x Phillips screws.
  3. Split the phone case using a case opening tool (guitar pick).
Lg-p930-nitro-hd-front.png Lg-p930-nitro-hd-back.png

Once the phone has been disassembled, you can see the JTAG connection port near the microUSB header. The connector used on the PCB is a microminiature board-to-board Molex connectors. Molex sells the mating heading under the brand name "SlimStack" however sourcing these headers in small quantities can be difficult. In some cases, JTAG adapter jigs can be purchased from companies such as multi-com.pl however based on the cost and amount of time it takes to receive said items, it can be faster to solder lead wires off this header. Note: A decent microscope is mandatory for this step as soldering these connections without one is extremely difficult.

Lg-p930-nitro-hd-disassembled-1.png Lg-p930-nitro-hd-disassembled-2.png Lg-p930-nitro-hd-disassembled-3.png

With the phone now disassembled you can solder on your 0.040 gauge lead wires to the JTAG test points. Also, connect the PCB battery terminal connections to the DC power supply. The negative (-) connection is the innermost pin and the positive (+) pin is the outside pin. You can configure your power supply to match the battery specifications which in this case is 3.8V and 1.830A but do not apply power at this time.


Lg-p930-nitro-hd-connected-via-jtag-1.png Lg-p930-nitro-hd-connected-via-jtag-2.png Lg-p930-nitro-hd-connected-via-jtag-3.png

Now we can start the Octoplus JTAG software and configure it. See the picture for more detail.


Octoplus-settings.png

Apply power to the DC power supply and turn the phone on using the button on the side of the PCB (you will feel the phone vibrate after 3-5 seconds of holding the button). After powering the phone on, connect via JTAG to the phone by hitting the "Connect" button in the Octoplus JTAG software, you should receive a "Connect Successful" message in the bottom pane. Now click on the "Read" button to start the read and name the output file accordingly. In this case I named the file "lg-p930-jtag-x0000000_x06BC000.bin" to reflect the memory range I am extracting.

If you receive errors that the PCB could not be connected to, try the following:

  • Confirm that the PCB is receiving power from the DC power supply. If you can measure current draw of the PCB, you should see that the PCB is pulling about 0.04A. If the PCB is pulling more current, it is likely already booted and the read may fail.
  • Power off the PCB, power it back on, and immediately connect then start the JTAG read.
  • Check all of your PCB to JTAG connections under a microscope. Inspect for shorts or incorrect connections.
  • Upon receiving a successful JTAG dump you can process the file with the CCL Forensics Android scripts to extract the gesture or pin lock.

Notes

This exhibit gave us some issue when reading ~100MB mark and the read kept disconnecting around that memory range. We opted to read the device with multiple reads by reading from 0MB-96MB, skipping over data, then reading from 192MB-EOF. This captured enough data to acquire the password hash which was located around the 1.3GB range on this particular phone.

References