# Android-Based Audio Video Navigation System Forensics: A Case Study
## 4 Android-Based AVN System Forensics
### Android 4.4.2-Based AVN System Forensics
#### 4.2.2 Navigation Data  
Similar to the Jellybean-based AVN systems, the navigation app data of the KitKat-based AVN system is created by HKMC_Navi_ENC.apk and stored in database (.db) or binary (.dat,.bin) formats under directory /data/data/com.mnsoft.navi/. The /data/data/com.mnsoft.navi/databases/Navi_vr.db file exists in both Jellybean-based and KitKat-based AVN systems. Among the navigation app data stored in the database, key artefacts include recent destinations, the recent search history, favourite locations, registered locations, etc.  
By analysing the tables in the Navi_vr.db database, we found that two versions of the AVN system manage the five tables in common: Current_Loc_Table, Destination_Table, NonSearch_Table, Memory_point_Table and RegisPnt_Special_Table. Note that the name of the Memory_point_Table (in the Jellybean-based AVN systems) is slightly changed to MemoryPoint_Table in the KitKat-based AVN systems. Additionally, the attribute structure of the two tables (MemoryPoint_Table and RegisPnt_Special_Table) is different between the Jellybean and KitKat versions. Moreover, the KitKat-based AVN systems introduce new tables such as RegisPnt_G1_Table, RegisPnt_G2_Table, etc. Table 8 lists the tables and their attributes of Navi_vr.db in the KitKat-based AVN systems.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**File Name** & **Table Name** & **Attribute Name** & **Description** \\ \hline \multirow{2}{*}{BluetoothContacts.db} & \multirow{2}{*}{Bluetooth\_devices} & bd\_address & MAC address of smartphone \\ \cline{3-4}  & & friendly\_name & Smartphone’s name \\ \hline \multirow{3}{*}{MC\_[MAC address].db} & \multirow{3}{*}{Bluetooth\_contacts} & given\_name & given name \\ \cline{3-4}  & & family\_name & family name \\ \cline{3-4}  & & phone\#\_number & Phone number \\ \hline \multirow{3}{*}{MF\_[MAC address].db} & \multirow{3}{*}{Favorites} & display\_name & English name \\ \cline{3-4}  & & display\_name\_alt & Korea name \\ \cline{3-4}  & & Number & Phone number \\ \hline \multirow{3}{*}{contacts\#.db} & \multirow{3}{*}{Calls} & Name & given name \\ \cline{3-4}  & & Number & Phone number \\ \cline{3-4}  & & Date & call date \\ \cline{3-4}  & & account\_name & MAC address of smartphone \\ \hline \hline \end{tabular}
\end{table}
Table 7: Bluetooth data in KitKat-based AVN systems.  
Figure 6: Analysis of the contacts#.db file.  
The favourite locations are stored in MemoryPoint_Table along with the information of \"My home\" and \"My office\". The information of three places that the user can name arbitrarily are stored in RegisPnt_G1_Table, RegisPnt_G2_Table, and RegisPnt_G3_Table. The registered locations are stored in RegisPnt_Special_Table, and the basic information of the registered locations can be check through the attributes of this table.  
There is also other navigation data that is not stored in these databases, such as destination search history, GPS records, special registered locations (or points-of-interest), user profile information, and recent search history. These data are in the /oem_data/mnsoft/UserData/KOR/ directory, as shown in Table 9. Unlike the Jellybean-based AVN systems, a new directory USERPROFILE exists. The KitKat-based AVN system can set a user profile when a vehicle is used by multiple drivers. Thus, a driver can use the navigation system after selecting the corresponding profile. To reflect this upgraded function, the USERPROFILE directory stores the personalized information that each driver entered into the navigation module.  
The personalized information is contained in a JavaScript Object Notation (JSON) file found in the USERPROFILE directory. The arr_favorites object of the NavigationPOIAdd_Driver#.json file keeps the favourite destinations, and home and work addresses set by a driver. The addresses can also be found in the MemoryPoint_Table and RegisPnt_G#_Table of Navi_vr.db file in Table 8. The JSON file does not exist in Jellybean-based AVN systems.