Evidential recovery from GPS devices

Abstract

Global Positioning Systems (GPS) have become more affordable, are now widely used in motor vehicles and in other frequently used applications. As a consequence GPS are increasingly becoming an important source of evidential data for digital forensic investigations. This paper acknowledges there are only disparate documents for the guidance of an investigator when extracting evidence form such systems. The focus of this paper is to provide the technical details of recovering artifacts from four GPS currently available to the New Zealand market. Navman brand GPS are used, following a forensically robust process. The steps of the process are described, results analysed and the associated risks are discussed. In addition, the paper discusses techniques related to the visual presentation of evidence suitable for Google Maps. Automation attempts to speed up the analysis to visualization steps are also included. The outcome is a road map that may assist digital forensic investigators develop GPS examination strategies for implementation in their own organizations.

Keywords

• GPS
• Evidential Data
• Journey Data
• Examination Strategy