# Android-Based Audio Video Navigation System Forensics: A Case Study
## 4 Android-Based AVN System Forensics
### Android 4.2.2-Based AVN System Forensics
#### 4.1.2 Navigation Data  
There are many navigation software installed on infotainment or AVN systems. Their route-finding methods are based on various techniques such as Dijkstra, A*, and neural networks [32; 33; 34]. However, the artefacts generated by the navigation software such as favourite location, destination history and search history are similar. The navigation app installed on the target AVN systems is Talmap [35], a Korean navigation software. Its APK file is HKMC_Navi_ECN_apk. It generates data in the subdirectories of /data/data/com.mnsoft.navi/ in various file formats such as database (.db), binary (.dat,.bin) and text (.txt).  
Table 4 lists the artefacts found in the database. The main artefacts found in the database include the recent location, search history, favourite location, and registered location. Current_Loc_Table stores the last location. It contains the coordinate information, address and administrative region code. The coordinate information is expressed in Talmap's own way. This information can be converted to the longitude and latitude using Talmap's service [35]. Location search history can be found in Destination_Table and NonSearch_Table. Destination_Table stores the last search result and NonSearch_Table stores several search results including the last one. These tables contain search words, destination addresses, distance/time to destination and coordinate information. Memory_point_Table and RegisPnt_Special_Table store the locations registered by the user. They contain the name, address and coordinate information of the registered locations.  
Table 5 shows the navigation app data stored in non-database files. The artefacts found in the files include the start time of the AVN system, the destination search history, the last search record, GPS records and registered locations. Directory UserData/KOR contains six files all of which are related to the navigation app. File Last_Route_info, USERPOI and USERRECENT have the same artefacts found in the database file. File start-log_[epochtime].txt stores the navigation app logs when the AVN system boots and the navigation app starts. Its filename contains an epoch time which can be converted to a human-readable date/time using an epoch converter. We can infer when the engine starts from the date/time. File FavariateDest.bin stores the destination search history similar to Destination_Table in Navi_vr.db. Particularly, it also stores the time when a user performs the search. File Last_Route_info stores the last search words and the coordinate of the destination. This file is only found in the LG Electronics LAN5020 KKJF model.  
File GPSTrack.dat records the GPS information. As shown in Figure 4 (left), the coordinate information and administrative area code for each point are stored as little-endian binary numbers. For example, the coordinate information of the departure point (in red rectangles) is 45607602 (02 B7 EA C4) and 13475791 (83 A0 CD 00). Furthermore, the administrative area code of the point is 1113959228 (3C AB 65 42). The coordinate information can be converted to the longitude and latitude (GPS) using Talmap's service. We convert the coordinate information of the points and reconstruct the position information of the car, as shown in Figure 4 (right). The coordinate information of the last point in GPSTrack.dat  
Figure 3: MAC address of the mobile devices connected via Bluetooth.  
coincides with the coordinate information found in CurrentLoc_Table in Navi_vr.db. We can track the route of the car based on the analysis of GPSTrack.dat.