# Android-Based Audio Video Navigation System Forensics: A Case Study
## 4 Android-Based AVN System Forensics
### Timeline Construction  
Bluetooth and navigation data have relatively detailed information about the driver's activities, but do not have all the temporal information for each event. On the other hand, the system logs contain temporal information for the recorded events, but only store major events, making it difficult to systematically infer the driver's activities with the system logs. Through these findings, we can see that an integrated analysis is required for effective forensic analysis rather than individual analysis of the data or logs. We were able to construct a timeline of the drivers' activities by integrating then analyzing the Bluetooth data, navigation data, and system logs. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Time** & **Process** & **Info** \\ \hline
200520, & & ADM ON: false Gear in Parking: false \\
12:50:57.735 & & Vehicle Moving: false Pressed Key: false \\ \hline
200520, & & ADM ON: false Gear in Parking: true \\
12:51:18.666 & & Vehicle Moving: false Pressed Key: false \\ \hline
200520 & & ADM ON: false Gear in Parking: false \\
12:51:47.739 & & Vehicle Moving: true Pressed Key: false \\ \hline \hline \end{tabular}
\end{table} 
Table 10: System log example under the /log directory. \begin{table}
\begin{tabular}{l l} \hline \hline
**Location** & **Directory/File Name** & **Description** \\ \hline \multirow{6}{*}{FavoriteDest.bin} & search destination information \\ \cline{2-3}  & search destination address \\ \cline{2-3}  & search destination longitude/latitude \\ \cline{2-3}  & search destination Korea area Code \\ \cline{2-3}  & search time \\ \cline{2-3}  & GPSTrack.dat & GPS record (longitude | latitude | Korea area Code) \\ \cline{2-3}  & registered location information \\ \cline{2-3}  & USERPOI & registered location address \\ \cline{2-3}  & registered location longitude/latitude \\ \cline{2-3}  & & Recently searched word \\ \cline{2-3}  & The address a user has last searched for \\ \cline{2-3}  & Recently searched destination’s phone number \\ \cline{2-3}  & Recently searched destination’s longitude/latitude \\ \cline{2-3}  & Recently searched destination’s Korea area code \\ \hline \multirow{6}{*}{USERPROFILE} & favourite location info \\ \cline{2-3}  & home address \\ \cline{1-1} \cline{2-3}  & office address (work address) \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Navigation data in non-database files in the KitKat-based AVN systems. Table 11 shows the constructed timeline for the Kia NIRO EV. The driver started the vehicle at epoch time 1551854738. The epoch converter tool tells us that the epoch time 1551854738 was on 6 March 2019, at 6:45:38 Korean time. The driver searched for \"office\" as the destination, and he set the \"office\" as the destination at 6:45:45 a.m. on 6 March 2019. These activities were found by analysing the startlog_1551854738.txt, Navi_vr.db, binary file, etc., which are navigation data. At 6:52:47 a.m. on 6 March 2019, the driver connected their smartphone Galaxy Note 8 to the car's AVN system via Bluetooth. The Bluetooth MAC address of the smartphone is 94:8 bc:1:88:ba:b3. These activities were found by integrating the Bluetooth data with the system logs (e.g., class bt-hci) and analysing the integrated information. After a Bluetooth connection is established between the two devices, the AVN system sends a message requesting access to the phonebook and recent call history of the smartphone. If a user accepts the request, the phonebook and recent call history are sent to and stored in the AVN system. We found that this transmission process was completed at 6:53:15 a.m. on 6 March 2019 by analysing the class (bt-hci) related to Bluetooth communication in the system logs. By analysing BTCallHistory.db, we also identified the name of the caller or receiver, their phone number, and the call time when the driver made the phone call through the AVN system. Finally, we determined the current location of the vehicle at that time by analysing the last offsets 45625103 (0F 2F B8 45), 13475891 (33 A0 CD 00), and 1105385599 (7F D8 E2