Python Tool for Parsing Data from Rand McNally GPS units

I recently encountered a Rand McNally Intelliroute TND 720 GPS unit and none of the commercial forensic tools had the ability to acquire data from the device so I imaged the device and poked around for any interesting data files.

I found a file called DestHistory.txt which obviously peaked my interested. I opened the file in notepad and while it contained a lot of unusual characters it also contained multiple recent destinations sandwiched in between those characters.

I wrote a small python script which takes the contents of the DestHistory.txt and parses it into both a HTML report and a KML file which can be opened in Google Earth. The tool is called rmparse and can be download here.

The project was fairly straight forward. The only hiccup was that the DestHistory.txt is in Unicode format so when my script parsed the file there was a null between every character. I tried a standard B = A.replace( “ “, “”) command but had no luck. I ended up using a B = A.replace(“\x00”, “”) command and it worked like a champ.

The rest of the script was just parsing out the relevant portions, sticking them back together and then wrapping them in HTML and XML.

A few notes about this script:

The script has only been tested with the listed model. If it does or does not work with any other model feel free to post that in the comments.

The source file name of DestHistory.txt has been hard-coded in so the tool can be run from a GUI. Copy the DestHistory.txt to a directory, place the script in the same directory and run the script. It will generate the HTML report and KML file in that directory.

The script takes the lat/long coordinates from the source file, splits them, adds a period in the proper location and sticks them back together. The function that performs this assumes that the coordinates are in North America. It would be a simple modification to adjust that function to another region.


Popular posts from this blog

SANS Index How To Guide with Pictures

Introducing FaviconLocator: The Eazy Button to Searching by Favicon

Automating Domain Squatting Detection with DNSTwist and Python