Firstly, as with computer and mobile phone forensics, when investigating a sat nav device, it is important not to switch the device on. In fact, the entire examination of a sat nav device should be conducted in a Faraday box, to prevent the device from picking up new GPS fixes.

1. Sat Nav Forensics in Practice
Firstly, as with computer and mobile phone forensics, when investigating a sat nav device, it
is important not to switch the device on. In fact, the entire examination of a sat nav device
should be conducted in a Faraday box, to prevent the device from picking up new GPS fixes.
This minimises the risk of altering or overwriting the data stored on the device. It is possible
to make a crucial mistake here, which could adversely affect any potential court case.
Digital forensic analysis of sat nav equipment can reveal details of recent GPS fixes recorded
by the device, depending on the make and model. But it can also provide additional
information, such as stored ‘favourites’, journey plans and even deleted and archived
information, which can be crucial in establishing facts to aid an investigation. In one case an
analyst was able to find archived trip logs dating back seven months, which was useful in
building a bigger picture of the user’s day-to-day activities. This information was easy to
miss, as it was not picked up by the standard commercial forensic tools. However, with
broad experience in the analysis of a wide range of sat nav devices and their file structures,
it was possible to identify the archive files as containing potentially valuable data.
Sat nav data can not only provide information on where the user has been, but can also
help in establishing locations that the user has expressed an interest in, but not necessarily
visited – e.g. ‘points of interest’ that have been programmed into the device. This can
provide useful intelligence on a user’s planned activities, which the team in Miami would not
get from their activity of merely looking at the recent GPS fixes.
There can be a lot of useful data stored on a sat nav device, depending on the make and
model. This ranges from GPS fixes, track logs, recently set destinations, saved favourites
and archived data, to contacts, calls and SMS from paired mobile phones. However, care
must be taken over the use of that data – for example, the difference between a track log
or GPS fix, which is a guarantee of location and data such as recent destinations and saved
favourites, which only indicate interest in a location, and cannot be relied upon to
conclusively show where an individual was at a given date and time.
Tthe use of GPS technology is no longer confined to simple car-windscreen sat nav units;
most smart phones now come with GPS built in – for use with sat nav/GPS applications or
other location-specific functions. This provides more opportunities for investigating the
location of a user at a given date and time, which can provide crucial evidence to support a
case.
For more information about sat nav forensics or CCL’s other products and services please
visit www.cclgroupltd.com.
Nathan is a digital forensics specialist at CCL Group - the UK’s leading supplier of digital
forensics, including: computer forensics, mobile phone forensics and cell site analysis
services. Check out http://www.cclgroupltd.com/digital-forensics/