Difference between pages "Tools:Visualization" and "Global Positioning System"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m
 
(Forensics)
 
Line 1: Line 1:
Although not strictly for forensic purposes, '''visualization tools''' such as the ones discussed here can be very useful for visualizing large data sets. As forensic practitioners need to process more and more data, it is likely that some of the techniques implemented by these tools will need to be adopted.
+
The '''Global Positioning System''' ('''GPS''') is a satellite navigation system.
  
==Programming Languages and Developer Toolkits==
+
== Forensics ==
If you are building forensic tools, you probably want to start with one of these:
+
; Java and Swing
+
: Advantage: Portable and lots of good documentation out there.
+
: Disadvantage: Programs are a bit verbose, and only offers about 1/2 the performance of C
+
  
; Python with tkinter
+
There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilities and features as the technology has improved. Some of the most popular GPS devices today are made by [http://www.TomTom.com TomTom]. Some of the other GPS manufacturers include [http://www.garmin.com Garmin] and [http://www.magellangps.com Magellan].
: Advantage: Portable
+
: Disadvantage: Python is one of the slowest modern languages around.
+
  
; Python with wxWidgets
+
[[File:Blackthorn.png]]
: Advantage: Portable and a better development environment than tkiner
+
----
: Disadvantage: wxWidgets is not installed by default, so you'll need to get it installed. Not as well documented as Tkinter
+
Berla Corp. Has has released a BETA version of their new GPS forensics tool. It integrates acquisition, examination, and analysis into one small easy to use piece of software. [http://blackthorngps.com Get your free copy today]. Blackthorn currently supports both legacy and current Garmin, TomTom, and Magellan devices.
  
; [http://processing.org processing.org]
+
=== TomTom ===
: Advantage: Programming language specifically developed for visualization; compiles to java byte code
+
: Disadvantage: Very oddball
+
  
; JavaFX - Java's version of Flash
+
TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the [http://www.tomtom.com/products/product.php?ID=212&Category=0&Lid=1 TomTom 910] is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.
  
; Flash
+
The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.
  
== Open Source ==
+
TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card. This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader. The most important file for the forensic examiner will be the CFG file that is held in the map data directoryThis holds a list of all recent destinations that the user has entered into the device. The information is held in a hex file and stores the grid coordinates of these locations.
===Graph Drawing Applications===
+
* [http://www.graphviz.org/ Graphviz] - Originally developed by the [http://public.research.att.com/areas/visualization/ AT&T Information Visualization Gorup], designed for drawing connected graphs of nodes and edges. Neato is a similar system but does layout based on a spring model. Can produce output as [[PostScript]], [[PNG]], [[GIF]], or as an annotated graph file with the locations of all of the objects — ideal for drawing in a GUI. Runs from the command line on [[Unix]], [[Windows]] and [[Mac]], although there is also a [http://www.pixelglow.com/graphviz/ MacOS GUI version].
+
* [http://graphexploration.cond.org/ Guess: The Graph Exploration System] - Originally developed at HP, this is a large Jython/Java-based system that you can use for building your own applications. Distributed under GPL.
+
* [http://sourceforge.net/projects/ivc/ InfoVis Cyberinfrastructure] - Another graph drawing system written in Java.
+
* [http://jung.sourceforge.net/ Java Universal Network/Graph Framework (JUNG)] - Graphing, [[data mining]], [[social network]] analysis, and other stuff.
+
* [http://www.andrew.cmu.edu/user/krack/krackplot.shtml Krackplot] - "KrackPlot is a program for network visualization designed for social network analysts."
+
* [http://bioinformatics.icmb.utexas.edu/lgl/ Large Graph Layout (LGL)] - A bioinformatics system from University of Texas. They really mean Large.
+
* [http://www.sfu.ca/~richards/Multinet/Pages/multinet.htm MultiNet] - A data analysis package for drawing conventional data and graph data.
+
* [http://www.analytictech.com/netdraw.htm NetDraw] - "a free program written by Steve Borgatti for visualizing both 1-mode and 2-mode social network data."
+
* [http://web.mit.edu/bshi/Public/nv2d/ NetVis 2D] - Another graph visualization and layout tool written in Java.
+
* [http://www.opendx.org/ OpenDX] - Based on [[IBM]]'s Visualization Data Explorer, runs on [[Unix]]/X11/Motif.
+
* [http://vlado.fmf.uni-lj.si/pub/networks/pajek/ Pajek] - Windows program for drawing large networks.
+
* [http://sourceforge.net/projects/sonia/ Social Network Image Animator (SoNIA)] - Originally developed at Stanford. Written in Java. Makes movies.
+
* [http://www.informatik.uni-bremen.de/uDrawGraph/en/uDrawGraph/uDrawGraph.html uDrawGraph]
+
* [http://wilma.sourceforge.net/ WilmaScope] - Real-time animations of dynamic graph structures. Written in Java. Sophisticated force model with strings and attraction.
+
* [http://www.caida.org/tools/visualization/walrus/ Walrus] - A 3-d graph network exploration tool. Employs 3D hyperbolic displays and layout based on a user-supplied spanning tree.
+
=== Visualization Toolkits and Libraries ===
+
====C/C++====
+
* [http://public.kitware.com/VTK/ The Visualization Toolkit] - C++ multi-platform with interfaces available for Tcl/Tk, Java and Python. Professional support provided by [http://www.kitware.com/ Kitware].
+
* [http://kdirstat.sourceforge.net/ KDirStat], an open source implementation of [http://www.cs.umd.edu/hcil/treemap-history/index.shtml Treemaps] written in C. (Treemaps are a visualization technique developed at the University of Maryland for visualizing large amounts of multi-dimensional data.) You can find a copy of it in [http://www.derlien.com/ Disk Inventory X] and
+
====Java====
+
* [http://csbi.sourceforge.net/index.html Graph Interface Library (GINY)] - Java
+
* [http://hypergraph.sourceforge.net/ HyperGraph] - Hyperbolic trees, in Java. Check out the home page. Try clicking on the logo...
+
* [http://ivtk.sourceforge.net/ InfoViz Toolkit] - Java, originally developed at [[INRA]].
+
* [https://jdigraph.dev.java.net/ Jdigrah] - Java Directed Graphs.
+
* [http://jgrapht.sourceforge.net/ JGraphT] - A Java visualization kit designed to be simple and extensible.
+
* [http://prefuse.sourceforge.net/ Perfuse] - A Java-based toolkit for building interactive information visualization applications
+
* [http://www.ssec.wisc.edu/~billh/visad.html#intro VisAD] - A Java component library for interactive and collaborative visualization.
+
* [http://www.softwaresecretweapons.com/jspwiki/Wiki.jsp?page=LinguineMaps Linguine Maps] - An open-source Java-based system for visualizing software call maps.
+
* [http://zvtm.sourceforge.net/index.html Zoomable Visual Transformation Machine] - Java. Originally started at Xerox Research Europe.
+
  
====Unclassified====
+
Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kit. If the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is paired. Depending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.  
* [http://www.gravisto.org/ Gravisto: Graph Visualization Toolkit] - An editor and toolkit for developing graph visualization algorithms.  
+
* [http://www.gnu.frb.br:8080/rox Rox Graph Theory Framework] - An open-source plug-in framework for graph theory visualization.
+
* [http://touchgraph.sourceforge.net/ TouchGraph] - Library for building graph-based interfaces.
+
  
 +
Automated forensic analysis for TomTom GPS units is possible with software from Digivence - Forensic Analyser - TomTom Edition.  [http://www.digivence.com/SCREEN%20OPTIMISED%20REPORT%20-%20Demo%2011072007%20163219.htm Sample Report].  Whilst not shown in the example report, call history, contacts, text messages, Bluetooth MAC ID, and unit info is also automatically processed if available.
  
== Geographical Drawing Programs ==
+
Another tool for forensically analysing TomToms is [http://www.forensicnavigation.com TomTology]. This will retrieve all journey details from both live and unallocated space. It will tell you which is the home, favourites and recent destinations and will also tell you the last journey that was plotted and where the TomTom last had a GPS fix. It will also extract phone numbers if the device has been paired with a phone and will find deleted phone numbers, useful for potentially tracing a previous owner.
  
* [http://openmap.bbn.com/ OpenMap] -- From [[BBN]].
+
=== Garmin ===
  
== Commercial Tools ==
+
Garmin units connect to a PC in the same way as TomTom, via a USB cable. The unit will mount as a Mass Storage Unit, similar to a USB Memory Stick. After drivers for the unit have loaded, it is possible to navigate the Garmin unit's file system. Many of the files inside can easily be opened in a text or Hex editor.
  
* [http://www.aisee.com/ aiSee Graph Layout Software] - Supports 15 layout algorithms, recursive graph nesting, and easy printing. Runs on [[Windows]], [[Linux]], [[Solaris]], [[NetBSD]], and [[MacOS]]. 30-day trial and free registered versions available. Academic pricing available.
+
Raw trip data including waypoints, date & time stamps, latitude & longitude coordinates and elevations can be extracted from the Current.gpx file located in the \Garmin\GPX\ folder. It can be viewed by opening the file with a text editor such as [http://notepad-plus.sourceforge.net/ Notepad++]. All recent trips are stored in this file.
*  [http://www.geomantics.com/ Geomantics] - Geographical, Visualization and Graphics software. Runs on [[Windows]].
+
* [http://www.kylebank.com/ Graphis 2D and 3D graphing software] - Runs on [[Windows]]. Free 30-day evaluation copy available.
+
* [http://www.openviz.com/ OpenViz] and  [http://www.powerviz.com/ PowerViz] - Both from Advanced Visual Systems, super high-end visualization toolkits. $$$$
+
* [http://www.tomsawyer.com/ Tom Sawyer Software] Analysis, Visualizaiton, and Layout programs. - Heavy support for drawing graphs. Beautiful gallery. ActiveX, Java, C++ and .NET editions.
+
* [http://www.netminer.com/ NetMiner] - "One of the most comprehensive and usable software tools for Social Network Analysis in the world." Runs on Windows, with a Linux version under development. $35 for "Express" student version, $250 for "Professional" student version, $950 for "Normal" "Professional" version.
+
* [http://www.analytictech.com/ucinet.htm UCINET] - A comprehensive package for the analysis of social network data as well as other 1-mode and 2-mode data.
+
  
= Other Resources =
+
Data can also be easily viewed via [http://earth.google.com/ Google Earth]'s import feature. If available, Google Earth will import waypoints, tracks and routes from the unit. A slider bar in the program will show saved routes by date and time. When a specific waypoint is selected, a window will open that shows Lat/Long Coordinates, Altitude, Speed, Heading and Date/Time (Zulu).  
==Journals and Conferences==
+
 
* [http://www.palgrave-journals.com/ivs/index.html Information Visualization Journal]
+
With this data, raw or when viewed in Google Earth, entire trips can easily be reproduced giving exact time and locations for the GPS unit. It is unknown how many trips the unit is capable of storing or will store by default, but the [https://buy.garmin.com/shop/shop.do?pID=37418#nuvi260w Garmin Nuvi 260W] test unit had 16 days of trip data stored to memory.
* [http://rw4.cs.uni-sb.de/~diehl/softvis/seminar/index.php?goto=seminar ACM Symposium on Software Visualization]
+
 
==Link Farms==
+
=== Magellan ===
* [http://www-static.cc.gatech.edu/gvu/ii/resources/infovis.html GVU's Information Visualization Resources link farm]
+
 
* [http://directory.google.com/Top/Science/Math/Combinatorics/Software/Graph_Drawing/ Google Directory of Graph Drawing Software]
+
Magellan GPS units also connect to a PC via a USB cable. The [http://www.magellangps.com/products/product.asp?segID=354&prodID=2053 Magellan Roadmate 1400] unit tested runs a version of Windows CE. The operating system did not appear to be tailored to the specific unit and had options included in the menus that were not available (e.g. backup and restore functionality via a SD memory card slot that did not exist). Upon connecting the unit to a PC, it will mount as a Mass Storage Unit when and if it is recognized. 
* [http://directory.fsf.org/science/visual/ GNU Free Software directory of scientific visualization software]
+
 
* [http://www.manageability.org/blog/stuff/open-source-graph-network-visualization-in-java/view Open Source Graph Network Visualization in Java]
+
Files that may contain useful information when opened in a text editor:
* [http://www.insna.org/INSNA/soft_inf.html INSNA's web page of Computer Programs for Social Network Analysis]
+
* /App/Unit.xml
==Research Groups==
+
** This file contains information about the unit such as Model and Serial number.  
===Berkeley===
+
* /App/Media.cfg
* [http://bailando.sims.berkeley.edu/infovis.html Bailando Visualization]
+
** This file is a short list of what types of files are stored in the file structure. (e.g. User data is stored in /USR)
* [http://vis.berkeley.edu/ Berkeley Visualization Lab]
+
* /Sys/USBTRANS/Unit_ID.dat
===Brown===
+
** This file is similar to Unit.xml. It contains more information such as Operating System Version and Firmware version.
* [http://www.cs.brown.edu/people/rt/gd.html Roberto Tamassia's resources on Graph Drawing]
+
* /USR/TGUSERA.dat
===Stanford===
+
** This file may contain addresses, phone numbers and some user set points such as "Home". There is no recognizable structure to this data so finding useful data is difficult.
* [http://window.stanford.edu/projects/rivet/ Rivet Project] (Visualization complex systems)
+
* /USR/CITYHIST.dat
===UNM===
+
** This file may contain cities entered into the unit by a user. Like TGUSERA.dat, there is little structure here. Unfortunately, only City and State may be listed here.
* [http://www.msi.umn.edu/user_support/scivis/scivis-list.html Scientific Visualization at the Supercomputing Institute]
+
 
 +
Magellan provides [http://www.magellangps.com/products/map.asp?PRODID=1903 VantagePoint] software to view map and waypoint data. In order to use this software, the Magellan unit must be powered on prior to connecting it to a PC. It is unknown how useful the VantagePoint software is in collecting data as the software would not recognize the Roadmate 1400 unit. VantagePoint also did not support the .dat or .cfg files stored on the unit. [http://earth.google.com/ Google Earth] also supports Magellan units via its import feature. Earth lists Explorist and Serial as available import options.
 +
 +
 
 +
=== Digital Camera Images with GPS Information ===
 +
 
 +
Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where exactly a photo was taken. This positioning information (latitude, longitude) can be stored in the [[Exif]] [[metadata]] header of [[JPEG]] files. Tools such as [[jhead]] can display the GPS information in the [[Exif]] headers.
 +
 
 +
=== Cell Phones with GPS ===
 +
 
 +
Some recent cell phones (e.g. a [http://wiki.openezx.org Motorola EZX phone] such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.
 +
 
 +
== External Links ==
 +
 
 +
* [http://www.gpsforensics.org GPSForensics.org - A communitiy dedicated to GPS device forensics]
 +
 
 +
* [http://en.wikipedia.org/wiki/Global_Positioning_System Wikipedia: GPS]
 +
 
 +
* [http://www.digivence.com Digivence: TomTom Forensic Analyser]
 +
 
 +
* [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=405 Paraben's Device Seizure]
 +
 
 +
* [http://www.forensicnavigation.com TomTology by Forensic Navigation]
 +
 
 +
* [http://www.blackthorngps.com Blackthorn | GPS Forensics]

Revision as of 15:17, 8 September 2009

The Global Positioning System (GPS) is a satellite navigation system.

Contents

Forensics

There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilities and features as the technology has improved. Some of the most popular GPS devices today are made by TomTom. Some of the other GPS manufacturers include Garmin and Magellan.

Blackthorn.png


Berla Corp. Has has released a BETA version of their new GPS forensics tool. It integrates acquisition, examination, and analysis into one small easy to use piece of software. Get your free copy today. Blackthorn currently supports both legacy and current Garmin, TomTom, and Magellan devices.

TomTom

TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the TomTom 910 is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.

The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.

TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card. This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader. The most important file for the forensic examiner will be the CFG file that is held in the map data directory. This holds a list of all recent destinations that the user has entered into the device. The information is held in a hex file and stores the grid coordinates of these locations.

Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kit. If the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is paired. Depending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.

Automated forensic analysis for TomTom GPS units is possible with software from Digivence - Forensic Analyser - TomTom Edition. Sample Report. Whilst not shown in the example report, call history, contacts, text messages, Bluetooth MAC ID, and unit info is also automatically processed if available.

Another tool for forensically analysing TomToms is TomTology. This will retrieve all journey details from both live and unallocated space. It will tell you which is the home, favourites and recent destinations and will also tell you the last journey that was plotted and where the TomTom last had a GPS fix. It will also extract phone numbers if the device has been paired with a phone and will find deleted phone numbers, useful for potentially tracing a previous owner.

Garmin

Garmin units connect to a PC in the same way as TomTom, via a USB cable. The unit will mount as a Mass Storage Unit, similar to a USB Memory Stick. After drivers for the unit have loaded, it is possible to navigate the Garmin unit's file system. Many of the files inside can easily be opened in a text or Hex editor.

Raw trip data including waypoints, date & time stamps, latitude & longitude coordinates and elevations can be extracted from the Current.gpx file located in the \Garmin\GPX\ folder. It can be viewed by opening the file with a text editor such as Notepad++. All recent trips are stored in this file.

Data can also be easily viewed via Google Earth's import feature. If available, Google Earth will import waypoints, tracks and routes from the unit. A slider bar in the program will show saved routes by date and time. When a specific waypoint is selected, a window will open that shows Lat/Long Coordinates, Altitude, Speed, Heading and Date/Time (Zulu).

With this data, raw or when viewed in Google Earth, entire trips can easily be reproduced giving exact time and locations for the GPS unit. It is unknown how many trips the unit is capable of storing or will store by default, but the Garmin Nuvi 260W test unit had 16 days of trip data stored to memory.

Magellan

Magellan GPS units also connect to a PC via a USB cable. The Magellan Roadmate 1400 unit tested runs a version of Windows CE. The operating system did not appear to be tailored to the specific unit and had options included in the menus that were not available (e.g. backup and restore functionality via a SD memory card slot that did not exist). Upon connecting the unit to a PC, it will mount as a Mass Storage Unit when and if it is recognized.

Files that may contain useful information when opened in a text editor:

  • /App/Unit.xml
    • This file contains information about the unit such as Model and Serial number.
  • /App/Media.cfg
    • This file is a short list of what types of files are stored in the file structure. (e.g. User data is stored in /USR)
  • /Sys/USBTRANS/Unit_ID.dat
    • This file is similar to Unit.xml. It contains more information such as Operating System Version and Firmware version.
  • /USR/TGUSERA.dat
    • This file may contain addresses, phone numbers and some user set points such as "Home". There is no recognizable structure to this data so finding useful data is difficult.
  • /USR/CITYHIST.dat
    • This file may contain cities entered into the unit by a user. Like TGUSERA.dat, there is little structure here. Unfortunately, only City and State may be listed here.

Magellan provides VantagePoint software to view map and waypoint data. In order to use this software, the Magellan unit must be powered on prior to connecting it to a PC. It is unknown how useful the VantagePoint software is in collecting data as the software would not recognize the Roadmate 1400 unit. VantagePoint also did not support the .dat or .cfg files stored on the unit. Google Earth also supports Magellan units via its import feature. Earth lists Explorist and Serial as available import options.


Digital Camera Images with GPS Information

Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where exactly a photo was taken. This positioning information (latitude, longitude) can be stored in the Exif metadata header of JPEG files. Tools such as jhead can display the GPS information in the Exif headers.

Cell Phones with GPS

Some recent cell phones (e.g. a Motorola EZX phone such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.

External Links