Forensic Analysis of TomTom Navigation Application

TL;DR

This paper presents a forensic analysis process for the TomTom Android application, demonstrating how to recover and decode location data and routes stored in the app's files on Samsung devices, and comparing it with traditional GPS device data.

Contribution

It introduces a novel forensic acquisition and analysis method for the TomTom Android app, revealing stored location data and routes, and compares these findings with physical GPS device data.

Findings

Recovered GPS coordinates and timestamps from the app files

Decoded significant data files containing route information

Compared app data with physical GPS device data

Abstract

In the forensic field of digital technology, there has been a great deal of investigation into the decoding of navigation systems of the brand TomTom. As TomTom is the market leader in navigation systems, a large number of these devices are investigated. These devices can hold an abundance of significant location information. Currently, it is possible with the use of multiple methods to make physical copies of mobile devices running Android. The next great forensic problem is all the various programs that can be installed on these devices. There is now an application available from the company TomTom in the Google Play Store. This application mimics a navigation system on your Android mobile device. Indeed, the TomTom application on Android can hold a great deal of information. In this paper, we present a process of forensic acquisition and analysis of the TomTom Android application. We focus on the following questions: Is there a possibility to find previously driven routes or GPS coordinates with timestamps in the memory of the mobile device? To investigate what is stored in these files, driving tests were performed. During these driving tests a copy was made of the most important file using a self-written program. The significant files were found and the data in these files was decoded. We show and analyse our results with Samsung mobile devices. We compare also these results with forensic acquisition from TomTom GPS devices.