Forensic acquisition and analysis of the Random Access Memory of TomTom GPS navigation systems

TomTom navigation systems are widely used, but unfortunately these devices do not store any information that can be used to link time and position on any non-volatile media. However, this kind of information can be found in the volatile Random Access Memory (RAM) of these devices. There are two methods to extract the content stored in RAM. The first method uses the available JTAG signals on the device. For the second method, a small Linux distribution is loaded into the device. Analysis of the extracted content shows some information linking time and position of the device. Although the quantity of information found at this point is limited, the possibility to link the position and time of the device can be invaluable in some cases.