A Lightweight Utility for GPS Device Analysis By: Adam Schneider GCFE, ACE The TrackerCat Project

Table of Contents  What is TrackerCat?  What are GPX files?  What are KML files?  Why was TC created?  How is TC used?  KML Screenshots  What is the future of TC?  Research and Links

What is TrackerCat?  A Python utility for GPX file analysis.  A Github project created to improve TC’s features and functionality.  A heavily documented forensics project! … The Github project is also dedicated to R&D of new open source tools for GPS analysis.

What are GPX files?  GPS eXchange Format  An XML designed for recording GPS data (thousands of lines of code per file).  Contain trackpoints and waypoints.  Trackpoints are broken up into Active Logs.  Active Logs are historical logs of calculated “trips.”  Active Logs contain timestamps as do each trackpoint.  … They contain a LOT of data!

What are KML files?  Keyhole Markup Language format (really named the OpenGIS® KML Encoding Standard)  Originally designed by Keyhole, Inc. (acquired by Google).  Used to store geospatial information (coordinates, location placemarks, etc).  Designed to be imported into Google Earth.

Why was TC created?  To help infosec professionals explore GPX files if performing a manual analysis.  To provide analysts with a no-cost supplement to other forensic tools.  tc.py is an extremely simple but versatile program with the goal of eliminating some of the complexity of conducting GPS forensics.

How is TC used?  Recursive GPX Extraction : python tc.py –e [Path] Including all historically archived logs  GPX-to-KML Conversion : python tc.py –i [gpx file] –o [kml file]  Trackpoint Timestamp & Active Log Extraction: python tc.py –csv [gpx file]  Help /Feature Check: python tc.py –h

KML Screenshots GPX Active Log Sample (FTK Imager) … snip... KML Active Log (XML Spy) … snip... Trackpoint data in KMLs lack individual turn-by-turn timestamps. Each Active Log timestamp is preserved! Coordinates for Active Logs in KML are actually in a huge chunk!

Screenshots, Part II XSLT Converted KML; made by TrackerCat, Viewed in Google Earth

What is the future of TC? Github collaboration on TrackerCat means the possibility of advanced features like:  Extracting and dumping all times to body file format for the inclusion into case super timelines.  Mounting Image Files Directly  Master KML with all current & archived data … anything is possible!

Research and Links GPS Device Research Notes: fork() Forensics & Infosec Blog analysis/ TrackerCat Github Landing (Basic Info): TrackerCat on Github: Contributors = progress!