Difference between pages "Category:Disk imaging" and "Global Positioning System"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Unix-based imagers)
 
(Forensics)
 
Line 1: Line 1:
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
+
The '''Global Positioning System''' ('''GPS''') is a satellite navigation system.
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
+
</div>
+
  
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
+
== Forensics ==
  
= Hardware imagers =
+
There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilites and features as the technology has improved. Some of the most popular GPS devices today are made by [http://www.TomTom.com TomTom]. Some of the other GPS manufacturors include [http://www.garmin.com Garmin] and [http://www.magellangps.com Magellan].
; [[DeepSpar Disk Imager]]
+
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html  - Data Sheet and Whitepaper available for download from product web page.
+
; [[ICS Solo3]]
+
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
+
; [[Logicube Talon]]
+
: Supports USB
+
; [[PSIClone]]
+
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
+
: Enhanced Error Handling and Logging
+
; [[Voom HardCopy III]]
+
: Allows destination drive to be formatted in NTFS.
+
  
= Unix-based imagers=
+
TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the [http://www.tomtom.com/products/product.php?ID=212&Category=0&Lid=1 TomTom 910] is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.
  
; [[ewfacquire]]
+
The TomTom unit connects to a computer via a USB base station. An examiner should be able forensics acquire the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.  
: Part of the [[libewf]] library package, [[ewfacquire]] can create evidence files in the EnCase and FTK Imager [[E0*]] (EWF-E01) and SMART s0* (EWF-S01) formats. [[ewfacquire]] calculates an MD5 hash while the data is being acquired. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
+
:https://libewf.sourceforge.net/
+
  
; [[Adepto]]
+
=== Digital Camera Images with GPS Information ===
: http://www.e-fense.com/helix/
+
  
; [[aimage]]
+
Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where extactly an photo was taken. This positioning information (latitude, longitude) can be stored in the [[Exif]] [[metadata]] header of [[JPEG]] files. Tools such as [[jhead]] can display the GPS information in the [[Exif]] headers.
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]] can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
+
  
; [[AIR]]
+
=== Cell Phones with GPS ===
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
+
: http://air-imager.sourceforge.net/
+
  
; [[dcfldd]]
+
Some recent cell phones (e.g. a [http://wiki.openezx.org Motorola EZX phone] such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
+
  
; [[dd]]
+
== External Links ==
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
+
  
; EnCase [[LinEn]]
+
* [http://en.wikipedia.org/wiki/Global_Positioning_System Wikipedia: GPS]
: Linux-based version of EnCase's forensic imaging tool.
+
 
+
; GNU [[ddrescue]]
+
: http://www.gnu.org/software/ddrescue/ddrescue.html
+
 
+
; [[dd_rescue]]
+
: http://www.garloff.de/kurt/linux/ddrescue/
+
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
+
 
+
; iLook [[IXimager]]
+
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
+
 
+
; [[MacQuisition Boot CD]]
+
: Provides software to safely image [[Macintosh]] drives.
+
 
+
; [[rdd]]
+
: http://sourceforge.net/projects/rdd
+
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
+
 
+
; [[sdd]]
+
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
+
 
+
= Windows-based imagers =
+
 
+
; [[AccessData]]
+
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
+
 
+
; [[ASR]]
+
: A tool for [[imaging]] and analyzing disks.
+
 
+
; [[DIBS]]
+
: Can image and convert many file formats. Also builds mobile toolkit.
+
 
+
; [[EnCase]]
+
: Can image with out dongle plugged in. Only images to E0* file.
+
 
+
; [[FTK Imager]] by [[AccessData]]
+
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
+
 
+
; [[Ghost]]
+
: FTK can read forensic, uncompressed [[Ghost image]]s.
+
 
+
; [[iLook]]
+
: The [[IRS]]'s set of forensic tools and utilities.  iLook V8 can image in Windows.
+
 
+
; [[Paraben]]
+
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
+
 
+
; [[ProDiscovery]]
+
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
+
 
+
; [[X-Ways Forensics]]
+
: Has some limited imaging capabilities. The output is [[raw format]].
+
 
+
; [[X-Ways Replica]]
+
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
+
 
+
 
+
[[Category:Tools]]
+
 
+
[[Category:Tools]]
+

Revision as of 23:42, 13 December 2006

The Global Positioning System (GPS) is a satellite navigation system.

Forensics

There are several places where GPS information can found. It can be very useful for forensic investigations in certain situations. GPS devices have expanded their capabilites and features as the technology has improved. Some of the most popular GPS devices today are made by TomTom. Some of the other GPS manufacturors include Garmin and Magellan.

TomTom provides a wide range of devices for biking, hiking, and car navigation. Depending on the capabilities of the model, several different types of digital evidence can be located on these devices. For instance, the TomTom 910 is basically a 20GB external harddrive. This model can be docked with a personal computer via a USB cable or through the use of Bluetooth technology. The listed features include the ability to store pictures, play MP3 music files, and connect to certain cell phones via bluetooth technology. Data commonly found on cell phones could easily be found on the TomTom910. Via the Bluetooth, the TomTom can transfer the entire contact list from your phone. The GPS unit also records your call logs and SMS messages. Research needs to be done to see if the TomTom stores actual trips conducted with the unit. This would include routes, times, and travel speeds.

The TomTom unit connects to a computer via a USB base station. An examiner should be able forensics acquire the harddrive through a USB write blocker. If not, it may be necessary to remove the hard drive from the unit.

Digital Camera Images with GPS Information

Some recent digital cameras have built-in GPS receivers (or external modules you can connect to the camera). This makes it possible for the camera to record where extactly an photo was taken. This positioning information (latitude, longitude) can be stored in the Exif metadata header of JPEG files. Tools such as jhead can display the GPS information in the Exif headers.

Cell Phones with GPS

Some recent cell phones (e.g. a Motorola EZX phone such as the Motorola A780) have a built-in GPS receiver and navigation software. This software might record the paths travelled (and the date/time), which can be very useful in forensic investigations.

External Links