Difference between pages "Microsoft PocketPC" and "Global Positioning System"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Added pocketpc image)
 
(Forensics)
 
Line 1: Line 1:
__TOC__
+
The '''Global Positioning System''' ('''GPS''') is a satellite navigation system.
  
=Overview=
+
== Forensics ==
A PocketPC is commonly referred to as a handheld computer that runs a version of Microsoft’s proprietary mobile operating systems.
+
  
[[Image:Pocketpc.jpg|thumb|Acer PocketPC]]
+
There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilites and features as the technology has improved. Some of the most popular GPS devices today are made by [http://www.TomTom.com TomTom]. Some of the other GPS manufacturors include [http://www.garmin.com Garmin] and [http://www.magellangps.com Magellan].
  
Microsoft PocketPC, sometimes referred to as P/PC or PPC, is based upon the Windows CE framework. Variants of this operating system include versions such as PocketPC 2000, PocketPC 2002, Windows Mobile 2003/2003 SE, and Windows Mobile 5.0.  Variants also exist for [[SmartPhones]], such as Windows Mobile 2003 Smartphone edition. 
+
[http://www.cortextech.com/tomtom910.jpg Picture of TomTom910]
  
One of the key benefits of Microsoft's Windows Mobile platform is file format compatibility with the desktop versions of the company's productivity software. Mobile versions of Microsoft software, such as Microsoft Word, Excel, and PowerPoint, allow individuals to view and edit these files outside of the home and office.  
+
TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the [http://www.tomtom.com/products/product.php?ID=212&Category=0&Lid=1 TomTom 910] is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.  
  
Another benefit is integration with Microsoft's cross-platform solution, the .NET Framework.  The .NET Framework and its associated class libraries handle things such as memory management, file I/O, and many other functions.  The .NET Framework allows programmers to develop code in one of several .NET languages, such as C# and VB.NET.  PocketPCs run a simplified version of the framework called the .NET Compact Framework.
+
The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.  
  
In order to maintain synchronization and connectivity with desktop computers, Microsft developed the ActiveSync program.  The user merely has to connect the PocketPC to the desktop computer in order to synchronize items such as appointments, contact lists, and even multimedia files.   
+
TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card.  This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader.  The most important file for the forensic examiner will be the CFG file that is held in the map data directory.  This holds a list of all recent destinations that the user has entered into the device.  The information is held in a hex file and stores the represents grid coordinates of these locations.   
  
In 2001, PDAs running Palm OS variants held a market share of about 72%, while PocketPC held a meager 15% of the marketHowever, by the fourth quarter of 2004, Microsoft PocketPC and Palm OS were practically tied with regards to market share -- PocketPC-based devices had a market share of 40.2% while Palm OS claimed 40.7% of the marketThis upward trend clearly illustrates the growing popularity of PocketPC-based devices, and thus the increased likelihood that one will encounter such a device in the field.
+
Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kitIf the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is pairedDepending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.  
  
 +
Automated forensic analysis for TomTom GPS units is possible with software from Digivence - Forensic Analyser - TomTom Edition.  [http://www.digivence.com/SCREEN%20OPTIMISED%20REPORT%20-%20Demo%2011072007%20163219.htm Sample Report].  Whilst not shown in the example report, call history, contacts, text messages, Bluetooth MAC ID, and unit info is also automatically processed if available.
 +
 
 +
=== Digital Camera Images with GPS Information ===
  
== History ==
+
Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where extactly a photo was taken. This positioning information (latitude, longitude) can be stored in the [[Exif]] [[metadata]] header of [[JPEG]] files. Tools such as [[jhead]] can display the GPS information in the [[Exif]] headers.
  
The PocketPC operating system began as Windows CE in November of 1996.  The NEC MobilePro 200 and the Casio A-10 were the first two PDA-type devices available with this early version of the operating system.  From here, Windows CE continued in development through versions 2 (with such devices as the MD Elan SC400, DEC SA1100, Hitachi SuperH 3, NEC VR4101, Philips DR 31500, and the Toshiba TX3912).
+
=== Cell Phones with GPS ===
  
=PocketPC Variants=
+
Some recent cell phones (e.g. a [http://wiki.openezx.org Motorola EZX phone] such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.
As previously noted, there exist many variants of the PocketPC operating system. Below are a summary of each.
+
  
==PocketPC 2000==
+
== External Links ==
  
 +
* [http://en.wikipedia.org/wiki/Global_Positioning_System Wikipedia: GPS]
  
==PocketPC 2002==
 
Pocket PC 2002, Microsoft's PDA operating system, is more stable than the previous version and offers a barrel of bundled software, including MSN Messenger and a remote access client. However in order to run this operating system, serious hardware requirements must be available. Flash ROM is one of the requirements which only comes standard on the Compaq Ipaq.
 
  
==Windows Mobile 2003/SE==
+
* [http://www.digivence.com Digivence: TomTom Forensic Analyser]
Based on the Windows CE.Net operating system, Windows Mobile 2003 for Pocket PC includes a Windows-like graphical user interface (GUI), tools and helper apps, and several companion applications, including Pocket Word and Pocket Excel. It's the third major release of the platform, which debuted in April 2000 and was last updated in October 2001
+
 
+
Here's a list of Windows Mobile 2003 for Pocket PC's new features:
+
 
+
-- Enhanced Connection Manager user interface
+
+
-- Zero Configuration connections
+
+
-- Improved animated connectivity status icons
+
+
-- Improved connectivity bubbles
+
 
+
-- Always-on Bluetooth discoverability
+
+
-- Use of Bluetooth modems
+
 
+
-- Bluetooth beaming
+
 
+
-- Auto-correct spelling
+
+
-- Auto-suggest in Inbox
+
 
+
-- One-touch turn all radios off
+
+
-- 802.1x support
+
 
+
-- Certificate Management UI
+
 
+
-- IPSec/L2TP
+
 
+
-- Support for Multiple VPNs
+
+
-- IPv6 support
+
+
-- New Today screen
+
+
-- Smart Lookup in Contacts
+
+
-- Windows CE 4.2 operating systems
+
+
-- .NET Compact Framework
+
+
-- Enhanced developer support
+
+
-- 128-bit encryption strength for Crypto API
+
+
-- Improved power management
+
+
-- Windows Media Player 9 Series for Pocket PC 2003
+
+
-- Plus! Sync & Go
+
 
+
-- Support for Plus! Photo Story
+
+
-- Windows Movie Maker 2
+
 
+
-- Pictures
+
 
+
-- New version of Pocket Internet Explorer
+
+
-- "Jawbreaker" game
+
+
-- vCard and vCal support
+
 
+
-- Inbox signature support
+
+
-- New user notifications
+
 
+
==Windows Mobile 5.0==
+
Windows Mobile 5.0, based off of Windows CE 5.0, was released on May 10, 2005.  Windows Mobile 5.0 brought many changes to the PocketPC landscape.  For one, with this release, the phone and PDA versions of the OS have merged into one encompassing OS, instead of two separate versions of the same one.  Additionally, while past versions of PocketPC software utilized the RAM of a PDA for program and data storage, Windows Mobile 5.0 uses a PDA's hardware more like a traditional computer.  The operating system and user data is stored in the more persistent ROM of the device, and RAM is used in a way more similar to that of a desktop PC.  This has implications for forensics, as data stored on these devices is now less volatile.
+
 
+
 
+
=Pocket PC Devices=
+
In recent years, a number of manufacturers have elected to produce PocketPC devices.  Some of these makers include companies such as:
+
 
+
* Audiovox
+
*  Dell
+
*  HP
+
*  Mitac
+
*  Motorola
+
*  Samsung
+
*  Siemens
+
*  Symbol
+
 
+
Because different manufacturers are targeted at different segments of the market, such as business and consumers, the features and functionality of these devices sometimes differ greatly.  For example, some devices have built-in capability for taking images and videos, while other devices have tools such as biometric fingerprint readers and barcode scanners.
+
 
+
 
+
 
+
 
+
 
+
'''References:'''
+
----
+
 
+
[http://www.hpcfactor.com/support/windowsce/ The History of Microsoft Windows CE]
+
 
+
[http://palmtops.about.com/cs/pdafacts/a/Palm_Pocket_PC.htm Palm vs. Pocket PC-The Great Debate]
+
 
+
[http://www.windowsfordevices.com/news/NS8063885791.html Gartner: Windows CE ties Palm]
+
 
+
[http://en.wikipedia.org/wiki/Pocket_PC PocketPC]
+

Revision as of 08:53, 17 October 2007

The Global Positioning System (GPS) is a satellite navigation system.

Contents

Forensics

There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilites and features as the technology has improved. Some of the most popular GPS devices today are made by TomTom. Some of the other GPS manufacturors include Garmin and Magellan.

Picture of TomTom910

TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the TomTom 910 is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.

The TomTom unit connects to a computer via a USB base station. An examiner should be able to acquire the image of the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.

TomTom models such the TomTom One Regional, TomTom Europe, Go 510, Go 710 and the Go 720 store map data, favourites, and recent destinations on a removable SD card. This allows the forensic examiner to remove the SD card and make a backup with a write blocked SD card reader. The most important file for the forensic examiner will be the CFG file that is held in the map data directory. This holds a list of all recent destinations that the user has entered into the device. The information is held in a hex file and stores the represents grid coordinates of these locations.

Certain TomTom models (Go 510, Go 910, Go 920 etc.) allow the user to pair their mobile phone to the device so they can use the TomTom as a hands free kit. If the user has paired their phone to the TomTom device, then the TomTom will store the Bluetooth MAC ID for up to five phones, erasing the oldest if a sixth phone is paired. Depending on the phone model paired with the TomTom, there may also be Call lists, contacts and text messages (sent & received) stored in the device too.

Automated forensic analysis for TomTom GPS units is possible with software from Digivence - Forensic Analyser - TomTom Edition. Sample Report. Whilst not shown in the example report, call history, contacts, text messages, Bluetooth MAC ID, and unit info is also automatically processed if available.

Digital Camera Images with GPS Information

Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where extactly a photo was taken. This positioning information (latitude, longitude) can be stored in the Exif metadata header of JPEG files. Tools such as jhead can display the GPS information in the Exif headers.

Cell Phones with GPS

Some recent cell phones (e.g. a Motorola EZX phone such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.

External Links