  In the forensic field of digital technology, there has been a great deal of
investigation into the decoding of navigation systems of the brand TomTom. As
TomTom is the market leader in navigation systems, a large number of these
devices are investigated. These devices can hold an abundance of significant
location information. Currently, it is possible with the use of multiple
methods to make physical copies of mobile devices running Android. The next
great forensic problem is all the various programs that can be installed on
these devices. There is now an application available from the company TomTom in
the Google Play Store. This application mimics a navigation system on your
Android mobile device. Indeed, the TomTom application on Android can hold a
great deal of information. In this paper, we present a process of forensic
acquisition and analysis of the TomTom Android application. We focus on the
following questions: Is there a possibility to find previously driven routes or
GPS coordinates with timestamps in the memory of the mobile device? To
investigate what is stored in these files, driving tests were performed. During
these driving tests a copy was made of the most important file using a
self-written program. The significant files were found and the data in these
files was decoded. We show and analyse our results with Samsung mobile devices.
We compare also these results with forensic acquisition from TomTom GPS
devices.
