GPS Forensics “A Systemic Approach for GPS Evidence Acquisition
Total Page:16
File Type:pdf, Size:1020Kb
UNIVERSITY OF PIRAEUS DEPARTMENT OF DIGITAL SYSTEMS M.Sc IN DIGITAL SYSTEMS SECURITY GPS Forensics “A systemic approach for GPS evidence acquisition through forensics readiness “ Vassilakopoulos Xenofon University of Piraeus Dept. of Digital Systems M.Sc in Digital Systems Security Master Thesis Digital Systems Security Final Assignment GPS Forensics “A systemic approach for GPS evidence acquisition through forensics readiness” Supervisor: Professor Dr. Lambrinoudakis Kostas, Dept. of Digital Systems, University of Piraeus M.Sc Student: Vassilakopoulos Xenofon (mte-0209) - 1 - Abstract The use of Satellite Navigation Systems (SNS) has become increasingly common in recent years. The wide scale adoption of this technology has the potential to provide a valuable resource in forensics investigations. The potential of this resource is to provide historical location data from the device while maintaining forensics integrity. The main purpose of this thesis is to provide a systemic approach to forensics redlines. The goal of this study is to provide an automotive process that implements the collection and acquisition of forensics GPS evidence. The main purpose of the system is to provide availability of the evidence to authorized digital investigators. The system has to offer Confidentiality of the coordinates that collects from the GPS receiver and also has to provide integrity of the collected data to prove the originality and not alteration of the evidence acquired. The Data that shows individuals location called sensitive data need special treatment inside the GPS device or inside PDAs. The system developed has the ability to collect data from the GPS receiver and encrypt them using symmetric and asymmetric cryptography accompanied with hash algorithms for providing integrity of the original coordinates at the desirable encoding format (NMEA) .Another step is to save those encrypted coordinates into a file somewhere in the file system of the device together with timestamps and date provision, which should be accessible only from digital investigators. The design and implementation of this system is simulated and shows the steps that causes the desirable methodology. - 2 - Acknowledgements My appreciation goes to my supervisor, Professor Konstantinos Lambrinoudakis, for his relentless effort in various forms of guidance, knowledge and moral support during my entire difficult period of writing and implementing this project. Thank you - 3 - 1. Introduction.............................................................................................................. 8 1.1. Aim ...................................................................................................................... 8 1.2. Objectives............................................................................................................ 9 1.3. Motivation ........................................................................................................... 9 1.4 The Legal forensics examination process of GPS satellite navigation systems ................................................................................................................................... 11 1.4.1 The benefits of forensics examination of Global position system or Satellite navigation ............................................................................................... 12 1.4.1.1 Law Enforcement Officers................................................................... 12 1.4.1.2 Prosecutors............................................................................................ 12 1.4.1.3 Defence Lawyers.................................................................................. 13 1.5 The project plan ................................................................................................. 13 2. GPS Satellite navigation systems, the embedded technology and storage ... 15 2.1 The Definition of The embedded device .......................................................... 15 2.2 The Memory of Embedded system................................................................... 15 2.3 NAND and NOR flash memory architecture................................................... 16 2.3.1 Characteristics of NOR and NAND memories...................................... 17 2.3.2 The Structure and functionality of NAND and NOR memory............. 17 2.4 Linux OS on GPS devices................................................................................. 19 2.5 The Internal architecture of a GPS device........................................................ 20 2.6 GPS Receivers.................................................................................................... 22 2.7 Expansion Ports and Interfaces between GPS device and kernel in embedded systems...................................................................................................................... 23 2.8 NMEA Data........................................................................................................ 24 3. The Policies and procedures of carrying out forensics examination............. 25 4 3.1 The methodology of Carrying out forensics examination............................... 26 3.1.1 Collection ................................................................................................. 26 3.1.2 Preservation.............................................................................................. 27 3.1.3 Analysis .................................................................................................... 29 3.1.4 Presentation.............................................................................................. 30 3.2 Roles and Responsibilities ................................................................................ 30 3.3 Evidential Principles.......................................................................................... 32 3.4 Equipment in a basic Forensics Kit .................................................................. 33 4. General methodology of forensic investigation embedded GPS receiver..... 35 4.1 GPS receiver storage media .............................................................................. 36 4.2 The acquisition of an SD card........................................................................... 36 4.3 Proposed add-ons in methodology of forensic investigation embedded GPS receiver ..................................................................................................................... 39 4.4 File Slack Definition.......................................................................................... 40 5. Literature review of the forensics examination of embedded device such as GPS .............................................................................................................................. 41 5.1 Literature review................................................................................................ 41 5.2 The Global Positioning System (GPS) receivers............................................. 42 5.3 Previous work done with GPS forensics analysis............................................ 43 5.4 Acquisition of GPS receiver storage media...................................................... 44 5.5 Files of forensics interest................................................................................... 45 5.6 Identifying the GPS fix location ....................................................................... 45 6. GPS receiver forensics examination. The General Case study....................... 46 6.1 The GPS navigation system .............................................................................. 47 6.2 The system imaging........................................................................................... 48 5 6.3 The Bit stream image......................................................................................... 49 6.4 Verification of Imaging and the hash value...................................................... 50 6.5 Case study: Forensic Examination of GPS receiver such as TomTom GO 500 ................................................................................................................................... 51 6.6 The tools using for imaging GPS receivers...................................................... 51 6.7 Imaging TomTom GPS receiver........................................................................ 52 6.8 Methodology of imaging TomTom One GPS receiver.................................... 53 6.9 The Adepto Forensics tool................................................................................. 56 6.10 The Tom-Tom evidence analysis .................................................................... 60 6.11 Deleted Spaces on Device ............................................................................... 61 6.12 Files of Forensics interest................................................................................ 62 6.13 The CFG Data Files......................................................................................... 63 6.14 The Orphan Locations ..................................................................................... 63 6.15 Data analysis with FTK AccessData imager.................................................. 64 6.16. Data representation ......................................................................................... 68 7. The Systemic approach of the encrypted coordinates ..................................... 69 7.1 Problems to