Recovering data from Garmin Edge 500 GPS

A friend of me asked me if I wanted to take a look at his Garmin Edge 500 GPS bike computer, since it was missing some of his tracks. After opening the flash drive of the device in FTK Imager I noticed that the Activities directory did not contain any of the track data (.fit files) for 2014. Since I could not find the data on the device as lost or deleted items or something I decided to try some file carving. The first thing I did was creating an image of the full flash drive (which also included the currently present .fit files) with FTK Imager, the resulting image (uncompressed) was just 56MB big. There does not seem to be a lot of storage in the unit.

To be able to carve you need to know some specific information from the file type the device uses, such as the header, footer and filesize. If you are lucky this information is present in the config file of the carving tool you use (Scalpel in this case), however .fit files are not in that config file.

Looking at the different .fit files on the device the header of the the file type can be spotted:

It seems that all Garmin .fit files start with the following HEX values:

0C 10 40 00 ? ? ? 00 2E 46 49 54 40 00 00 00

The question-marks are different for each file on the device. Looking at the footer of the files we can spot the footer of the .fit files as well:

The Garmin .fit files all seem the have the following footer:

01 00 00 1A 01 ? ?

Again, the question-marks are different values for every file.

The largest .fit file I could find on the device was 650KB, so I decided that I would take a maximum of 1MB as file-size. Combining this information results in the following Scalpel rule:

 fit y 1000000 \x0C\x10\x40\x00???\x00\x2E\x46\x49\x54\x40\x00\x00\x00 \x01\x00\x00\x1A\x01??

After adding this rule to the scalpel.conf file we can start the carving:

# scalpel -c /etc/scalpel/scalpel.conf -o garmin image.001
 Scalpel version 1.60
 Written by Golden G. Richard III, based on Foremost 0.69.
 Opening target "/root/image.001"
 Image file pass 1/2.
 image.001: 100.0% |*************************************************************************************************************************************| 53.9 MB 00:00 ETAAllocating work queues...
 Work queues allocation complete. Building carve lists...
 Carve lists built. Workload:
 fit with header "\x0c\x10\x40\x00\x3f\x3f\x3f\x00\x2e\x46\x49\x54\x40\x00\x00\x00" and footer "\x01\x00\x00\x1a\x01\x3f\x3f" --> 398 files
 Carving files from image.
 Image file pass 2/2.
 image.001: 100.0% |*************************************************************************************************************************************| 53.9 MB 00:00 ETAProcessing of image file complete. Cleaning up...
 Done.
 Scalpel is done, files carved = 398, elapsed = 1 seconds.

Scalpel seems to have found 398 files. There were still 275 files present in the in Activities directory, which are of course included in this total. However that means that Scalpel was able to identify 123 possible lost .fit files.

To be able to quickly read information from all the .fit files and identify them I used the Perl script fitdump. For this tool to work you will need the Garmin::FIT Perl module.

The commandline I used to find out the creation dates from the fit files:

# ./fitdump fit-0-0/* |egrep '(time_created)|(\*\*\*\*)'

In this commandline the Scalpel output directory is named “fit-0-0”, which contains the carved fit files. The output of this commandline looks like:

***** fit-0-0/00000028.fit *****
time_created (4-1-UINT32): 2014-04-20T03:57:45 (766915065)

This way I was able to identify which .fit file was from which date. In the end I was able to recover 50 .fit files from 2014 which were no longer on the device.