Numbers should be pronounced normally. For example, you would say the number 357 as one continuous sentence, "Three hundred and fifty seven." If the number is shown incorrectly, say, "Back" or "No" or tap the Backspace key. Then say the number again.
Tip: If you say, "Back" when there are no numbers shown on the screen, then your GO will return you to the previous screen. When the number is shown correctly say, "Done" or "OK." Alternatively, enter the number by tapping the screen. To select a crossroads as the location, say "Crossing". Note: You need to say numbers in the same language that is used for menu buttons. 7. Your GO asks if you need to arrive at a particular time. For this exercise, tap NO. The route is calculated by your GO. 8. When the route has been calculated, tap Done.
More ways to speak to your TomTom GO
There are various ways to enter an address using speech. To see the options available, Tap Navigate to. in the Main menu and then tap Address.
Note: Postcode address entry is not possible using speech. City center - to say the centerf a city or town, tap this button and then tap the speech button at the bottom of the keyboard on the next screen. Street and house number - to say an address, tap this button and then tap the speech button at the bottom of the keyboard on the next screen. Cross street or intersection - to say the point where two streets meet, tap this button and then tap the speech button at the bottom of the keyboard on the next screen. Spoken address - tap this button to enter an address using speech and by tapping the screen. Spoken address (dialog) - tap this button to enter an address only using speech. You can still tap the screen for entering certain details if you prefer.

Music and Media

Important: Only select music and media when you are stationary. It is dangerous to select songs and make adjustments while you are driving. Your TomTom GO can play mp3 audio files and Audible Audiobooks and display HTML and text documents and photos. Note: mp3 files and Audiobooks can be stored and played on the GO 530, 730 and 930.
Putting Music and Photos on your GO
Transfer music files and photos to your TomTom GO from your computer using TomTom HOME. For information about using TomTom HOME, see Using TomTom HOME on page 94
Playing music and audiobooks
1. Tap Music and media in the Main Menu. 2. Tap TomTom Jukebox to start the Jukebox. Note: You can create playlists using a third-party application like iTunes, Musicmatch or Winamp. Playlist - tap this button to select a playlist. Artist - tap this button to select a song by a particular singer or group. Album - tap this button to select from a list of all the albums on your GO. Song - tap this button to select from all the songs on your GO. Genre - tap this button to select a particular type of music. Audiobooks - tap this button to select an Audiobook. Note: Not all mp3 files contain information about the song, such as the artist or genre. If the file contains no information, the file name is used as the song title.

You can select one of these options: POI near you - to choose from a list of POIs near to your current location. POI in city - to find a POI in a particular town or city. POI near Home - to choose from a list of POIs near to your Home location. You can select from a list of POIs which are along your route or close to your destination. Choose from one of these options: POI along route POI near destination 6. Type the name of the town you want to visit and select the town when it appears in the list. 7. Tap Parking garage. 8. Select the category of POI: Tap Any POI category to search for a POI by name. Tap the category of POI, if it is shown. Tap the arrow to choose from the complete list of categories. Select the category from the list or start to type the name of the category and select it when it appears in the list. 9. Select a parking garage. The distance listed next to each POI is the distance from the city center. 10.From the list of POIs shown, select the POI you want to navigate to. The table below explains the distances listed next to each POI. POI near you POI in city POI near Home POI along route POI near destination Last POI Distance from your current location Distance from the city center Distance from your Home location Distance from your current location Distance from your destination Distance to the last POI you visited
If you know the name of the POI, tap Find and type the name. Select it from the list when it is shown. 11.Select a parking garage. The distance listed next to each POI is the distance from the city center. Once you have selected a POI, the route to the POI is calculated by your TomTom GO. The route to the POI is then calculated by your TomTom GO.

Managing POIs

Tap Manage POIs from the Preferences menu.

Manage POIs

Note: The Manage POIs button is only available when all menu buttons are shown. To show all menu buttons, tap Show ALL menu options in the Preferences menu. You can, for example, do the following: Create your own POI categories and add POIs to them. Set warnings when you get close to POIs. Why would I want to create my own POIs? A POI acts like a shortcut - once you have saved a location as a POI you never have to type the address of that POI again. But when you create a POI you can save more than just the location. Phone number - when you create a POI, you can save a phone number with it. Categories - when you create a POI you have to put it in a category. For example, you could create a category of POIs called Favourite restaurants. With each POI, save the phone number so that you can call them from your GO to reserve a table.
How can I create my own POIs?
1. Tap the screen to bring up the main menu. 2. Tap Change preferences. 3. Tap Manage POIs. 4. Before you can add a POI, you have to create at least one POI category. Every POI is assigned to a POI category. You can only add POIs to POI categories you have created yourself. Tap Add POI category.

Add POI category

5. Enter a name for your POI category, for example, Friends or Favourite restaurants. Then select a marker for your POI category. 6. Tap Add POI. Tap this button to add a POI.

Add POI

7. Select the POI category in which you want to add the POI.
8. Select the location of your POI from the list below. You can set your Home location as a POI. If you want to change your Home location, you can create a POI of the Home location before you change it.
You can create a POI from a Favorite. You can only create a limited number of Favorites. If you want to create more Favorites you have to delete some Favorites first. Before you delete a Favorite, make it into a POI so that you dont lose the address. You can specify an address to be a POI. When you enter an address, you can choose from four options. City center Street and house number ZIP code Crossing or intersection Select a POI location from a list of places you have recently used as destinations.
You can add a Point of Interest (POI) as a POI. For example, if you are creating a category of POIs for your favourite restaurants, use this option instead of entering the addresses of the restaurants.
Tap this button to add your current position as a POI. For example, if you stop somewhere you like, while you are there you can tap this button to create the POI.
Tap this button to create a POI using the map browser. Select the location of the POI using the cursor, then tap Done.
For more information about the map browser, see Driving View on page 6 and How can I create my own POIs? on page 39 Tap this button to create a POI by entering latitude and longitude values.
Tap this button to make a POI of the current position of a TomTom Buddy. For more information about TomTom Buddies, see TomTom Services on page 65.
Tap this button to select your last recorded position as your destination.
This may be useful if your GO is unable to maintain a strong GPS signal, for example, when you drive through a long tunnel. For more information about the GPS, see Global Positioning System (GPS) on page 93.

Move item up

Tap this button to move the item down the Itinerary. This button is unavailable if the item is at the bottom of the Itinerary.

Move item down

Tap this button to see the location of the item on the map. For more information about the map browser, see Driving View on page 6.

Show on map

Tap this button to delete the item from the Itinerary.

Delete item

Hands-free calling
If you have a mobile phone with Bluetooth, you can use your TomTom GO to make phone calls and send and receive messages. Note: Not all phones are supported or compatible with all features. For more information, visit www.TomTom.com/phones

Connecting to Your Phone

First you must establish a connection between your mobile phone and your TomTom GO. Tap Mobile phone in the Main Menu and then follow the instructions on the screen. You only need to do this once, after which your TomTom GO will remember your phone.
Setting up TomTom Services
When you have established a connection with your phone, you can set up a wireless data connection for TomTom Services. For information about TomTom Services, see TomTom Services on page 65. Tips Make sure that you switch on Bluetooth on your phone. Make sure that your phone is set to "discoverable" or "visible to all". You may have to enter the password 0000 on your phone in order to connect to your TomTom GO. Make your TomTom GO a trusted device on your phone. Otherwise you will have to enter 0000 every time. See your phones user guide for information about Bluetooth settings.

Your Phone Book

You can copy your phonebook from your mobile phone to your TomTom GO so that you can make calls with just a few taps on the screen. This is the safest way to make hands-free calls.
Note: You can copy your phonebook to your TomTom GO at any time. From the Mobile phone menu, tap Get numbers from phone. Not all phones can transfer their phonebook to your GO. For more information, visit www.TomTom.com/phones

This button may only be available if all menu options are shown. To show all menu options, tap Show ALL menu options. For more information, see Hidden buttons and features on page 48. Tap this button to move important buttons, for example, the Done and Cancel buttons as well as the zoom bar, to the left hand side of the screen. This makes it easier to tap the buttons with your left hand without blocking the screen.

Operate lefthanded

To move the buttons back to the right hand side of the screen, tap Operate right-handed.

Keyboard preferences

You use the keyboard to enter your destination or to find an item in a list, such as a POI. Tap this button to select the size of the keys on the keyboard and the keyboard layout. You can select from two sizes: Large keyboard Small keyboard Three keyboard layouts are available: ABCD keyboard QWERTY keyboard AZERTY keyboard Note: The keyboard does not include accents of any kind for any language so you dont have to worry about entering letters with accents. Simply type the letter without the accent and your GO will recognize the word.

Planning preferences

This button may only be available if all menu options are shown. To show all menu options, tap Show ALL menu options. For more information, see Hidden buttons and features on page 48. Tap this button to set the kind of route planned when you select a destination. The following options are available:
Ask me every time I plan Always plan fastest routes Always plan shortest routes Always avoid freeways Always plan walking routes Always plan bicycle routes Always plan for limited speed Then answer the following question: Do you want the route summary screen to close automatically after 10 seconds?

Toll road preferences

This button may only be available if all menu options are shown. To show all menu options, tap Show ALL menu options. For more information, see Hidden buttons and features on page 48. Tap this button to set how your GO handles toll roads if they are on the route to a destination you set. You can choose from the following options:
Ask me when there are toll roads on my route - you are asked if you want to avoid a toll road whenever you plan a route. Always avoid toll roads Never to avoid toll roads

Set owner

This button may only be available if all menu options are shown. To show all menu options, tap Show ALL menu options. For more information, see Hidden buttons and features on page 48. Tap this button to enter your name and address as the owner of your GO and to change or delete a 4-digit password for your GO.
Note: You can only change or delete a 4-digit password on your TomTom GO. You can create a 4-digit password for your GO using TomTom HOME: 1. Connect your GO to your computer and turn on your GO and your computer. TomTom HOME starts automatically. For information about installing TomTom HOME on your computer, see Using TomTom HOME on page 94. 2. From the Options menu in TomTom HOME, click My GO. 3. Click the ON/OFF button on the picture of your GO to start the application on your computer. 4. From the Main Menu, click Change preferences. 5. Click Set Owner. You can now set a 4-digit password for your GO. You can only create a 4-digit password using TomTom HOME.

Marking a map error while on the move
If you notice an item on your map that needs attention, you can mark the location using the Report button and then enter the details when you are no longer driving. To show the Report button in the Driving View, do the following: 1. Tap Map corrections in the Main Menu. Tip: If you cannot see the Map corrections button in the Main Menu, tap Show ALL menu options in the Preferences menu. 2. Tap Correction preferences. 3. Tap Done and then tap Done again. 4. Select Show report button, then tap Done. The Report button is shown on the left-hand side of the Driving View. After you mark a location, you can add more information about the change when you open the Map corrections menu. For example, you are driving to a friend's house and you notice that the name of the street you are on is different from the one on your map. To report the
change, tap the Report button and your GO will save your current location. You can then send the update to TomTom Map Share when you have finished your journey. For more information see Changing my preferences for map updates on page 68.
Receiving the latest map updates
When you connect your TomTom GO to your computer, TomTom HOME automatically downloads any available map updates and sends any changes you have made, to the Map Share community. There are several types of updates which can be set in the Correction preferences menu. For information about how to do this, see Changing my preferences for map updates on page 68.
Changing my preferences for map updates
Correction preferences is used to set the way TomTom Map Share runs on your device. You can set the following preferences: Choose what types of updates you want to use on your maps. Decide if you want to share your updates with others. Show or hide the Report button in the Driving View. To set your preferences, do the following: 1. Tap Map corrections in the Main Menu. 2. Tap Correction preferences. A list of update types is shown. 3. Tick the box next to each update type you want use. 4. Tap Done. 5. Choose how you want to share your map updates with the Map Share community, then tap Done. 6. Choose if you want to see the Report button in the Driving View. 7. Tap Done. Tip: If you later decide you want to remove updates from the map, clear the checkbox next to the types of update you want to remove. If you clear all the checkboxes, your map returns to the original state before the first update. For more information on how to use the Report button, see Marking a map error while on the move on page 67.

Map update categories

There are several types of update that you can make to a map.
To make an update to your map, tap Map corrections in the Main Menu then tap Correct a map error. The following types of updates are shown. Tap this button to block or unblock a street. You can block or unblock the street in one or both directions.

Traffic incidents

Traffic incidents are displayed both on the Driving View and also on the Traffic sidebar as small symbols. There are two type of symbols: Symbols shown in a red square are incidents that Traffic can help you avoid.
Symbols shown in a red rectangle are weather related, because of their nature, you cannot use Traffic to avoid them. Traffic incident symbols and their meaning are shown below: Accident Road closed
Road works One or more lanes closed

Traffic incident

Traffic jam
Weather related symbols and their meaning are shown below: Fog Ice
Note: The incident avoided symbol is shown for any traffic incident that you avoid using TomTom Traffic.

Traffic menu

Either, tap the Traffic sidebar in the Driving View or tap TomTom Traffic in the Main Menu to open the Traffic menu. The following buttons are available: Tap this button to re-plan your route based on the latest traffic information.
Tap this button to see an overview of all traffic incidents on your route. You can use the left and right buttons on the resulting screen to see more detailed information about each of these incidents.

Show traffic on route

Tap this button to calculate and show the quickest route from your home location to your place of work and back.

Show homework traffic

See Making commuting to work easier on page 77.
Tap this button to read aloud all traffic incidents along your route.

Read aloud traffic info

Tap this button to get the latest traffic information straight away rather than waiting for an automatic update.

Update traffic info

For more information on automatic traffic updates, see Changing traffic preferences on page 76. Tap this button to disable TomTom Traffic.

Disable Traffic

Tap this button to view the guided tour on how to use TomTom Traffic.
Tap this button to browse the map and see the traffic information displayed on the map.
See Checking traffic incidents in your area on page 78. Tap this button to change your preferences for how TomTom Traffic works on your device.
See Changing traffic preferences on page 76.
Traffic information using RDS-TMC
The Traffic Message Channel (TMC) is not a TomTom Service. FM radio stations in several countries broadcast TMC information as part of their programming. TMC is also known as RDS-TMC traffic information. Your TomTom navigation device uses this information to warn you about traffic delays along your route and how you can avoid them. To use TMC traffic information, you need the TomTom RDS-TMC Traffic Receiver that comes with selected TomTom navigation devices or is available as an accessory. For more information on which TomTom devices support RDS-TMC receivers, visit www.tomtom.com. Note: TomTom is not responsible for the availability or quality of traffic information provided by TMC. TMC is not available in all countries or regions. Visit www.tomtom.com to check if it is available in your country or region.

Setting up TMC

To start using TMC all you need to do is connect the RDS-TMC Traffic Receiver to your TomTom navigation device. Important: When you install your navigation device in your car, dont block the drivers view of the road. 1. Connect the RDS-TMC Traffic Receiver to your navigation device. 2. Connect the Car Charger to the RDS-TMC Traffic Receiver and then plug the Car Charger into your cars cigarette lighter socket. Note: The RDS-TMC receiver does not work if the Car Charger is not connected. 3. Place the transparent suction cup at the tip of the antenna firmly against the upper left of your car windshield.
4. Then place the remaining suction cups along the edge of the windshield, as shown, and keep the cable straight. 5. Switch on your navigation device. The Traffic bar is shown in the Driving View and your navigation device searches for a radio station that carries RDS-TMC information.
The following symbols are shown at the top of the Traffic sidebar: Your navigation device is searching for a radio station that carries RDS-TMC on that radio frequency. Your navigation device is tuned to a radio station that carries RDSTMC on that radio frequency and has the latest RDS-TMC traffic information. Your navigation device is waiting to download the latest RDS-TMC traffic information as soon as it is available.
Using RDS-TMC traffic information
Your device receives traffic information when it is broadcasted. If there are any incidents on your route the Traffic sidebar on the right side of the Driving View warns you. An example of a Traffic sidebar with a traffic warning is shown to the left. For information on the Traffic sidebar, see The Traffic sidebar on page 86.
In the example on the left there is a traffic jam on your route with an expected delay of 38 minutes, 12 miles ahead of you. To find the quickest route to your destination, do the following: 1. Tap the Traffic sidebar. Tip: If you have trouble tapping the Traffic sidebar and the Main Menu is being displayed instead of the traffic menu, try tapping your finger half on the Traffic sidebar and half off the screen. 2. Tap Minimize traffic delays. Your device looks for the quickest route to your destination. It is possible that the new route may also include traffic delays, or may even be the same route as before. You can re-plan the route to avoid all delays, but this new route will take longer than the quickest route already shown. 3. Tap Done. Tip: It is possible to let your TomTom device automatically minimize traffic delays for you, to do this, see Changing traffic preferences on page 83.
Use the Change Traffic preferences button to choose how traffic information works on your device.
To change your traffic preferences, do the following: 1. Tap the TomTomTraffic button in the Main Menu on your device.

Tap the Traffic sidebar in the Driving View to open the Traffic menu. The following buttons are available: Minimize traffic delays Replans your route based on the latest traffic information.
Checks the traffic along your Home to Work route. See Making commuting to work easier on page 84.
Tap this button to show areas of traffic congestion along your current route.
Shows an overview of traffic incidents on the map. See Checking traffic incidents in your area on page 85.
Changes the settings for Traffic services. See Changing traffic preferences on page 83.

Remote control

Important: This TomTom product is Bluetooth enabled. Please note that in certain environments, such as hospitals or airplanes, you are required to switch off Bluetooth on all electronic devices.

Inserting the batteries

1. Hold the sides of the remote control and press the latch on the back of the device.
The keypad lifts out from the back of the device, as shown in the diagram. Take care not to drop the keypad. 2. Place the batteries in the remote control. Make sure you put the batteries in the correct way round, as shown on the remote control. 3. Replace the battery cover and press any button to switch on your remote control. Your remote control starts searching for your TomTom GO. Note: If you do not use your remote control for 20 seconds, it goes into power saving mode. If you do not use your remote control for one hour, the remote control switches off completely. Press any button to switch your remote control on.
Establishing a connection
Before your remote control can communicate with your TomTom GO, you need to establish a Bluetooth connection between your remote control and your GO. This Bluetooth process is also known as pairing. The first time you switch on your remote control, it tries to establish a connection with the nearest GO. To establish a connection, do the following: 1. Switch on your TomTom GO and tap Bluetooth preferences in the Preferences menu. Note: This button may only be available if all menu options are shown. To show all menu options, tap Show ALL menu options in the Preferences Menu.

WHAT THIS WARRANTY COVERS
1) TomTom Inc. (TomTom) warrants to the original purchaser (you) of the hardware with which this Limited Warranty is included (Hardware) that the Hardware will be free from defects in workmanship and materials under normal use (Defects) for a period of one (1) year from the date that the Hardware was first purchased by you (Warranty Period). During the Warranty Period the Hardware will be repaired or replaced at TomToms choice (Limited Warranty) without charge to you for either parts or labour. This Limited Warranty covers the replacement of the Hardware only. If the Hardware is repaired after the Warranty Period has expired, the Warranty Period for the repair will expire six (6) months after the date of repair.
WHAT THIS WARRANTY DOES NOT COVER
2) The Limited Warranty does not apply to normal wear and tear, does not apply when the Hardware is opened or repaired by someone not authorized by TomTom and does not cover repair or replacement of any Hardware or part thereof damaged by: misuse, moisture, liquids, proximity or exposure to heat and accident, abuse, non-compliance with the instructions supplied with the Hardware, neglect or misapplication. The Limited Warranty does not cover physical damage to the surface of the Hardware. This Limited Warranty does not cover any software that may accompany or be installed on the Hardware. The Limited Warranty does not cover the installation, removal or maintenance of the Hardware or any costs related herewith.
HOW TO MAKE A WARRANTY CLAIM
3) In order to make a claim of a Defect, you must contact TomTom during the Warranty Period at: 1-978-287-9555 or per email via www.tomtom.com to explain the Defect and to obtain an RMA number (Return Materials Authorization) if necessary. You must return the Hardware during the Warranty Period, along with an explanation of the Defect, to the address provided to you by TomTom. If a defect arises and a valid claim under this Limited Warranty is received by TomTom after the first one hundred and eighty (180) days of the Warranty Period, TomTom is entitled to charge you for any reasonable shipping and handling costs made in connection with the repair or replacement of the Hardware. You must comply with any other return procedures stipulated by TomTom, if any.

FCC Information for the User
This product contains a transmitter which must not be co-located or simultaneously operated in conjunction with any other transmitter. Exposure to Radio Frequency Radiation This device complies with FCC radiation exposure limits set forth for an uncontrolled environment. In order to avoid the possibility of exceeding the FCC radio frequency exposure limits, human proximity to the antenna shall not be less than 20cm (8 inches) during normal operation. Radio and Television Interference This equipment radiates radio frequency energy and if not used properly - that is, in strict accordance with the instructions in this manual - may cause interference to radio communications and television reception. This device has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiated radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation distance between the equipment and the receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult an experienced radio/TV technician for help. Changes or modifications not expressly approved by the party responsible for compliance could void the users authority to operate the equipment.
Important This equipment was tested for FCC compliance under conditions that included the use of shielded cables and connectors between it and the peripherals. It is important that you use shielded cable and connectors to reduce the possibility of causing radio and television interference. Shielded cables, suitable for the product range, can be obtained from an authorised dealer. If the user modifies the equipment or its peripherals in any way, and these modifications are not approved by TomTom, the FCC may withdraw the users right to operate the equipment. For customers in the USA, the following booklet prepared by the Federal Communications Commission may be of help: How to Identify and Resolve Radio-TV Interference Problems. This booklet is available from the US Government Printing Office, Washington, DC 20402. Stock No 004-00000345-4.

Copyright notices

2008 TomTom International BV, The Netherlands. TomTom and the "two hands" logo are among the trademarks, applications or registered trademarks owned by TomTom International B.V. Our limited warranty and end user license agreement for embedded software apply to this product; you can review both at www.tomtom.com/legal
Data Source 2008 Tele Atlas N.V. Based upon: Topografische ondergrond Copyright dienst voor het kadaster en de openbare registers, Apeldoorn 2008. Ordnance Survey of Northern Ireland. IGN France. Swisstopo. BEV, GZ 1368/2008. Geonext/DeAgostini. Norwegian Mapping Authority, Public Roads Administration / Mapsolutions. DAV. This product includes mapping data licensed from Ordnance Survey with the permission of the Controller of Her Majestys Stationery Office. Crown copyright and/or database right 2008. All rights reserved. Licence number 100026920.
Text to Speech technology, 2008 Loquendo TTS. All rights reserved. Loquendo is a registered trademark. www.loquendo.com
Apple and iPod are trademarks of Apple Computer, Inc., registered in the U.S. and other countries.
Audible, AudibleListener and Audiblemanager are registered trademarks of Audible, Inc. When purchasing and using Audible content you need to agree to the terms and conditions as posted in the Legal Notices www.audible.com.
SoundClear acoustic echo cancellation software Acoustic Technologies Inc.
MPEG Layer-3 audio coding technology licensed from Fraunhofer IIS and Thomson. Supply of this product does not convey a license nor imply any right to distribute content created with this product in revenue-generating broadcast systems (terrestrial, satellite, cable and/or other distribution channels), streaming applications (via Internet, intranets and/or other networks), other content distribution systems (pay-audio or audio-on-demand applications and the like) or on physical media (compact discs, digital versatile discs, semiconductor chips, hard drives, memory cards and the like). An independent license for such use is required. For details, please visit mp3licensing.com

Clara Maria Colombini

Experimental Testing of a Forensic Analysis Method on the TomTom GPS Navigation Device
EXPERIMENTAL TESTING OF A FORENSIC ANALYSIS METHOD ON THE TOMTOM GPS NAVIGATION DEVICE

INTRODUCTION

The earliest Satellite Navigation Systems were designed for the U.S. military, to locate the position of Polaris submarines. Over the years, satellite detection technology has become extremely widespread, and today most automotive vehicles are fitted with such systems. TomTom, the in-car satellite navigation device, is connected with the U.S. NAVSTAR Global Positioning System (GPS), which utilises 32 satellites in Mid-Earth Orbit (MEO) positioned in six different orbital planes.
The TomTom device itself contains an ARM processor made by Samsung, using Linux to manage the software which depending on the device can read either an SD card or the internal memory. A bootloader in the computer searches the hard disk or SD card for the software and map data. It then transfers the software to the 64MB internal RAM memory and starts the software. The hardware itself starts the GPS and the navigation application. The navigation application then reads whatever settings have been installed, such as the preferred voice and last chosen route.
TomTom internal architecture
The integrated GPS module ensures that the satellite signal translates into coordinates pinpointing the users exact position on the map. After start-up, the GPS module calculates the users position from the nearest satellite signals it receives; the module works out its position by calculating its distance from at least four different satellites, which send out information such as identity, altitude, position in relation to other satellites, etc. The latest models feature RDS-TMC technology. The "Radio Data System-Traffic Message Channel" is a service providing real-time traffic information integrated in the device via a special receiver. The service provider encodes the message and sends it to FM radio transmitters which transmit it as a Radio Data System (RDS) signal alongside regular FM radio broadcasts. The TMC decoder inside the TomTom decodes the RDS signal into visual and/or spoken message on the device. Bluetooth enabled models allow TomTom to communicate with other electronic devices like mobile phones, operate as a hands-free speakerphone, or receive information sent to a mobile phone via a wireless connection such as GPRS (General Packet Radio Service) or UMTS (Universal Mobile Telecommunications System). This work presents research into a forensic analysis procedure on TomTom satellite navigation devices, which are able to detect extremely useful information for investigative purposes. Information such as stored addresses, itineraries, home, points of interest, etc. enable the device users travels, favourite itineraries and most frequent destinations to be reconstructed. The main focus of the experiment was to develop a procedure for creating a repeatable forensic image of the internal memory, so that an identical forensic image can be produced at any time and can be used for analysis or as exhibits.

DEVICES ANALYSED

The following models were analysed: 1. TomTom One with 1GB internal memory only 2006 model; 2. TomTom One with 2GB internal memory only 2008 model; 3. TomTom One with external SD memory card only 2006 model; 4. TomTom One XL Italy with 512MB internal memory + SD Card 2008 model; 5. TomTom Go 730 with 1GB internal memory + SD Card 2008 model.
CREATION OF THE FORENSIC IMAGE
It should be noted that regarding the PC connection, the experiment did not consider the procedure for generating a forensic image of the SD memory card which can be removed from the device and can be treated like any other mass storage unit as per Computer Forensics rules. The term forensic image as used herein refers to the result of a special copying procedure known as bit by bit, i.e. a system that scans the entire surface of the master hard drive one bit at a time, producing a clone, i.e. an identical copy, on a destination drive whose contents will be analysed. Whenever possible, forensic analysis is not conducted on the original device but rather on its clone, or bitstream image, so as to preserve the integrity of the original evidence for any future analyses. Three forensic images were produced for each of the four models examined (one for each PC), for the following aims: 1. since there was no original image available, i.e. one that was definitely unaltered against which to compare the images produced using this experimental method, which would have required an invasive procedure physically parallel to the memory chip, the first image generated was used as the starting point, and any changes observed during the tests were checked against the other two; 2. three different PCs were used to simulate different scenarios (e.g. counter-reports, analyses at a later time, etc.).

In order to provide a sufficiently broad overview, forensic images were created using: Personal Computer running Windows OS; Personal Computer running Linux OS.
PROCEDURE IN WINDOWS ENVIRONMENT
The procedure for creating the three forensic images was carried out on three different PCs: 1. PC workstation running Microsoft Windows XP PRO SP3; 2. PC notebook running Microsoft Windows Vista Home Edition; 3. Eee PC running Microsoft Windows XP Home Edition.
Software: Accessdata FTK Imager 2.55 (free download).
Please note that it was not possible to use the hardware write blocker provided (Tableau T8) since when connected the PC does not recognise the device ( TomTom T8 PC).

PREPARING THE PC

The first step was to ensure that TomTomHOME software was not installed on the PC (for automatically updating TomTom data), or that the registry file did not contain keys or voice files from previous TomTom installations: SOFTWARE registry file; SYSTEM registry file: no entries relating to previous installations of TomTom USB drivers must be present in the CONTROL SET sub-key.\ENUM\USBSTOR. It is essential to carry out these checks because as soon as TomTom is connected to the PC it will try to update its data, searching for the software and registry keys signalled on the PC, and this will alter its files. Since no hardware write blockers can be used, the USB ports have been configured as read-only, creating a special registry entry to disable the write option command on the peripherals connected to the PC via the USB ports. The PC was disconnected from the Internet so as to prevent accidental attempts to update the device. Regarding storage of the forensic images obtained, a new 50GB firewall was created on each of the three PCs, then wiped1 and formatted in Fat32.
Procedure for permanent deletion of files from memory card by overwriting with spurious data until all traces are eliminated.
CONNECTING THE DEVICE TO THE PC
Material used: mini USB cable for TomTom Environment: the analysis was conducted in a closed room to prevent the TomTom device from locating the satellite.
The most sensitive part of the whole experiment was connecting the device to the PC so that the operating system recognises the TomToms internal memory without modifying the data stored within the memory, including the relevant metadata, i.e. other data describing this information, such as dates of creation, modification and access, as well as size, etc. The connection procedure varies from model to model: each model behaves differently depending on whether or not there is an SD Card slot. The direct analysis of the model with the SD Card only was performed according to Computer Forensics rules. The TomTom device has to be connected to the PCs USB port and turned on, so in order to detect any changes to the data present when the drivers are installed, communication flows via USB between the TomTom and the PC were monitored throughout the connection procedure. The analysis was carried out using a specific tool, SysNucleus USB Trace v. 2.0.

MODELS WITHOUT SD CARD SLOT
MODELS TESTED: Tomtom One with 1GB internal memory only 2006 model; Tomtom One with 2GB internal memory only 2008 model.

CONNECTION

The PC is turned on and the operating system started up. Monitoring is started on the data flow via USB on the port chosen for the connection.
Before turning the device on it is connected to the PC using the relevant cable. The TomTom is turned on. The screen illustrated below appears on the device:
Click on YES. The image below will now appear on the screen, indicating that the connection has started.
Once the connection has started, the screen below appears.
The computer signals that it has found a new USB device, installs the drivers and assigns a disk drive letter to the new peripheral device.
The same procedure was used for the three different PCs used. The analysis of the data produced by monitoring the communication flows via USB between the TomTom and PC during the connection and installation of the drivers of the devices evidenced that no changes were made to the data contained in the device.

CREATION OF THE IMAGE

The forensic image was made on the three different test PCs using FTK Imager Accessdata v. 2.55, which calculates the Hash2 MD5 and SHA1 both of the original3 and the new image created, and verifies that it is an exact copy. The new UBS peripheral is selected as the source and the DD image format (not processed) is chosen. Destination unit: the ad hoc partition created on the PC. The procedure is the same on all three PCs utilised.
RESULTS An examination of the Hash MD5 and SHA14 files, which are identical, confirms that the three images created for each of the 4 devices are exactly the same and there has been no change to the data in the flow that the TomTom generates when connected to a Windows system. The comparison was made using MD5summer v. 1.2.0.11.
In any case, as noted above, it is always essential to turn on the device since our intention was to conduct a non-invasive analysis, without having to open the device and/or remove the internal memory.
Hash means the hash calculated on a data flow determined after two intelligent systems (with CPU) have joined on a communications protocol. 3 Original means not the original data stored on the device, but the original data flow leaving the device when it connects with a Windows system. 4 Hash algorithms are a kind of footprint, that univocally distinguishes all electronic trace of the forensic analysis so as to comply with data integrity requirements. This digital watermark is produced by one-way hashing (e.g. MD5 and SHA1) which generates unmistakable reference to the original trace but does not allow it to be reconstructed. These algorithms are utilized internationally and ensure a satisfactory level of security/safety.

MODELS WITH INTERNAL MEMORY + SD CARD PORT
MODELS TESTED: TomTom One XL Italy with 512MB internal memory + SD Card 2008 model; TomTom Go 730 with 1GB internal memory + SD Card 2008 model. Additional material used: pre-wiped SD memory card5.
If the TomTom device has an SD memory card slot, a preliminary operation is needed before connecting to create the forensic image, since there are two ways to connect this type of device to a PC. without an SD card inserted in the slot: the device goes into update mode and looks for the TomTom Home software on the PC for automatically updating user data on the Internet. When it fails to find the software the device tries to install it (the device software includes a compact self-installing version TomTom Home). The PC recognises it as a navigation device and installs the data update drivers. In this mode, certain files on the device are automatically updated and therefore changed. This is confirmed by analysing the data produced by monitoring communication flows via USB between TomTom and PC, using the SysNucleus USB Trace v. 2.0 tool, during the connection of each device as described here. with SD Card inserted: the device goes into USB peripheral mode and as such is recognised by the PC which installs only the USB connection drivers. No communication is attempted to update the TomTom data and the TomTom Home software is not searched for on the PC, so the files stored within the device are not changed; the machine only reads the contents of the SD Card, which is assigned an external hard drive letter. An analysis of the information generated by monitoring communication flows via a USB between the TomTom and the PC, using SysNucleus USB Trace v. 2.0 during the
connection and installation of the device drivers, confirms that the data stored in the device has not been changed.
With the information thus acquired, a connection is made as described below, which turns out to be ideal for enabling the PC to detect the content of the internal memory. After deleting all traces of the previously installed TomTom drivers from the PC, the device, still off, is connected to the PC via the mini-USB cable.
The new forensic SD Card is inserted (see above: additional material used).
The device is then turned on. The image below shows the TomTom screen during connection.
The TomTom screen shows that the device is connecting: the device is in USB mode and the PC views the content only of the SD Card, to which the operating system assigns an external hard drive letter. Once the USB connection drivers are installed, the device is switched off, the SD Card
removed and the device is switched on again. The TomTom screen again shows that the device is connecting. The computer does not need to recognise the peripheral device again, as it already has the drivers, and views the data contained in the internal memory of the external hard drive previously assigned to the SD Card.

IMAGE CREATION

At this point, the forensic image is created on the three different PCS, using FTK Imager by Accessdata v. 2.55 software.
The physical unit of the new UBS peripheral is selected as the source and the image is chosen in DD format (not processed). The destination drive is the partition created ad hoc on the PC.
The same procedure is run on the three different PCs.
RESULTS The Hash MD5 and SHA16 files are identical, confirming that the three images generated for each of the 4 devices are exactly the same; the data flow generated by the TomTom when connected to one of the Windows systems has remained unchanged. The comparison was made using MD5summer v. 1.2.0.11.
In any case, as observed, the device always has to be switched on, since the analysis in question is non invasive, and as such does not require the device to be opened and or/ the internal memory removed.
Hash algorithms are a kind of footprint univocally distinguishing the electronic trace of the forensic analysis, so as to preserve data integrity. The digital watermark is created via a one-way hashing operation, (e.g. MD5 and SHA1), which generates a footprint that refers exclusively to the original trace, but does not enable it to be reconstructed. These algorithms are used internationally and ensure a satisfactory level of security.
RUNNING THE PROCEDURE UNDER LINUX
Again, the procedure was carried out on three different computers. 1. PC workstation with Linux Fedora v. 10 operating system; 2. PC notebook with Linux Helix v. 1.9 operating system, running live7 from CD; 3. Eee PC with Linux NBCaine v. 0.5. operating system running live from USB device.
Under Linux, there was no need to adopt different connection procedures for the various models of the device. Before switching the device on it is connected to the PC using the mini-USB cable. The device is then switched on. The Linux operating system recognises the device as a USB memory peripheral. It is not necessary to mount8 the TomTom, which stays on read-only. Instead, the image destination device is mounted and set to read-write.
The forensic images are then created in DD format, using the software packages listed below: 1. Linux Fedora v. 10: command line procedure via console9; 2. CD Helix Live 3: ADEPTO 2.0; 3. USB NBCaine: AIR 1.2.8.
Live mode allows an operating system downloaded directly to memory from a CD or USB flash drive to be used, without the need to rely on the hard disk(s) present on the machine. 8 Mounting enables a block peripheral to be initialised to permit read/write access. 9 Console mode is an alternative to graphics mode in which commands are facilitated by a graphical interface with buttons and windows. In consoled mode, commands must be written with no intermediation needed.

COMMAND LINE PROCEDURE

The mount command is used to check that neither of the two drives (the source disk drive, i.e. the TomTom internal memory, or the partition chosen by us to store the image) has been automatically mounted, and then the partition destined to store the forensic image is mounted in read-write; the original disk is NOT mounted because the data is read directly from the device with the copy command.
# mount -o rw /dev/hdb4 /media/hdb4
Before copying, the destination device is wiped to delete any previously stored data. The following command can be used to complete the operation:

# wipe /media/hdb4

The original is hashed using the DD command, specifying only the input file and sending the output of this command in pipe10 to an md5sum (execution of MD5 hash). # dd if=/dev/hda1 | md5sum The image is then created: the simplest form of the DD tool is used for the copy. The command syntax requires an input file and an output file to be specified.
# dd if=/dev/sdb1 of=/media/hdb4/tomtom01.img
At the end of the operation, the command returns the number of read and written records, with a few statistics on bytes copied, total operation time and average transfer rate of the process. The image created using the DD command is hashed, specifying only the input file and sending the output of this command in pipe11 to an md5sum. # dd if=/media/hdb4/tomtom01.img | md5sum
In UNIX the pipe is a mechanism for controlling information flows. In other words, the pipe is a system for using outgoing information flows from one command as input for another command.
PROCEDURE VIA AIR (AUTOMATED IMAGE & RESTORE) TOOL
There are obviously pros and cons with using a command line tool; the main advantage is that there is total control over each individual instruction imparted, including the ability to directly specify which options and parameters to use for each device; conversely, the complexity of the commands and the different number of options may easily generate mistakes.

However, the Helix and Caine distributions overcome these difficulties with a series of graphical interface tools allowing the operator to exploit the usability of the window interfaces.
Below is the procedure made for creating forensic images using the AIR (Automated Image & Restore) tool, included in the Caine distribution.
First select the source device on the left hand side of the template, and the destination device on the right. Next, select no image compression. Then select the type of hash to use for verifying the identity of the original and the copy. Here DCFLDD12 is been selected instead of DD. This option does not branch the image into different files and does not encrypt the file with a key. Then check the noerror option on the conv parameter, which continues the image creation operation even in the event of read errors. Before pressing the start button and beginning the copy process, click on the show status windows button to see how the operation is progressing.
DCFLDD is used to perform certain operations; the advantage is that it calculates hashes concurrently with the creation of the copy, eliminating the extra step needed when using DD.

RESULTS

An inspection of the Hash files, which are identical, confirms that the three images generated for each of the four devices are exactly the same and that there has been no change to the data they contain.

ANALYSIS

The memories on TomTom devices (both the internal memory and the SD Card) behave just like any other digital memory insofar as they can store, conceal and delete files of any kind. The TomTom memory creates forensic images bit by bit so that all the data stored can be analysed; even deleted or fragmented data can be carved13 out with the use of special forensic software. The tool used to perform the analysis was AccessData FTK 2.2 running Windows; it can view the contents of all files present, including the relative meta-data, and recover deleted or fragmented files. However, for the purposes of an investigation seeking satellite navigation data using the device, only the relevant files are listed below.

TTGO.BIF

Contains information concerning the device, including: model, serial number, language, current map, current base map, voice. Below is an example of file content from which this information can be gleaned. [TomTomGo] DeviceName=TomTom ONE XL DeviceVersionHW=ONE XL DeviceSerialNumber=L26497J00167 DeviceUniqueID=AK8AG AADSW RamDiskVersion=20080529 BootLoaderVersion=53026 LinuxVersion=190943 ApplicationVersionVersionNumber=8010 ApplicationVersion=9369 UserLanguage=Italiano UserName=L26497J00167 LastConnectionTime=Never GPSFirmwareVersion= BuiltInColorScheme0=Belgica BuiltInColorScheme1=Brittanica BuiltInColorScheme2=America BuiltInColorScheme3=Germanica BuiltInColorScheme4=Australia BuiltInColorScheme5=Deuteranopia BuiltInColorScheme6=Greys BuiltInColorScheme7=Antarctica BuiltInColorScheme8=Africa BuiltInColorScheme9=Astra CurrentColorSchemeBuiltIn=1 CurrentVoiceInfo=Roberto CurrentMap=Italia CurrentMapVersion=710.1571 CurrentHomeLocation=45.53052,9.03387,Via Francesco Daverio 11, Milano Traffic=N

Data carving is a technique for recovering deleted or de-allocated files.
CurrentFuelpricesType= CurrentFuelpricesTypeString= CurrentFuelpricesLastFullUpdate= ValueRatio=BpHDxKhXmBZzHUCpsA== Features=PlusDownloadDynamic,PlusDownloadGeneral,PlusDownloadMap,PlusDo wnloadPOI,PlusDownloadScheme,PlusDownloadUpgrade,PlusDownloadVoice,Plus DownloadRingTone,PlusMessageNotification,PlusPushChannel,PlusTraffic,PlusWe ather,PlusEphemeris,PlusBuddies,PlusMobileSafetyCameras,PlusRoadConditions, PlusFixedSafetyCameras,PlusFuelPrices,HDTraffic,PlusOnlineCamera,PlusTripRep orting,HomeBackup,PhotoJPGViewer,PhotoBMPViewer,Newyork,Newyork1Dot6,Iti nerary,Caymann,Durham,PhoneFeatures,CarSymbol,RDSTMC,Prague,Bluetooth,S DSlot,InternalFlash SupportedPatchTypes=1F NrSupportedErrorTypes=132 UserPatchDatVersion=102 CompressedPatchVersion=150 MapServerPatchDatVersion=104 DeletedPoiDatVersion=200 ServerLineIndexDatVersion=102 ServerNameIndexDatVersion=102 MapShareSupportedProviders=203 CharacterSet=Latin-1 CURRENTLOCATION.DAT CURRENTMAP.DAT GPRSETTINGS.DAT SETTINGS.DAT Contains the latest position of the device Contains the current map Contains the GPRS configuration (if present) Contains the name and MAC Address of any telephone connected, wireless settings, provider data, and user telephone data, if entered (GO models only) Contains the GPRS PIN number (if entered) (GO models only) Files with a CFG extension, such as mapsettings.cfg or name_map.cfg are all contained in the folders of the relevant maps and contain all the information on Favourites, itineraries, addresses , and points of interest stored. Contains telephone numbers called from the telephone connected to the TomTom (GO models only) Contains the telephone numbers that have called the telephone connected to the TomTom (GO models only) Contains the contact list of the telephone connected to the TomTom (GO models only) Contains text messages received from the telephone connected to the TomTom (GO models only) Contains text messages sent from the telephone connected to the TomTom (GO models only) Contains stored itineraries Contains itineraries not stored with a filename
GPRS.CONF MAPSETTINGS.CFG

\CONTACTS\ CALLED.TXT

\CONTACTS\ CALLERS.TXT

\CONTACTS\ CONTACTS.TXT

\CONTACTS\ INBOX.TXT

\CONTACTS\ OUTBOX.TXT

NOMEFILE.ITI TEMPORARY.ITI
Depending on the model, certain files may be missing from the device.

This table reports some differences among different models.
RECENT DESTINATION TOMTOM ONE REGIONAL TOMTOM ONE EUROPE TOMTOM GO 510 TOMTOM GO 710/720/730/750/790 TOMTOM GO 910//920/930 TOMTOM NAVIGATOR 6 YES YES YES YES YES YES BIF FILE YES YES YES YES YES YES SETTING FILE NO NO YES YES YES NO CALLED FILE NO NO YES YES YES NO CALLS FILE NO NO YES YES YES NO INBOX FILE NO NO YES YES YES NO OUTBOX FILE NO NO YES YES YES NO
SPECIFIC TOMTOM ANALYSIS SOFTWARE
There are various software packages on the market for analysing TomTom navigation files. POIedit is a shareware programme that runs under Windows, for reading DAT files. It is interesting because it can identify and view the exact locations of addresses stored in the mapsettings.cfg file on GoogleMaps (an Internet connection is required). The figure below pinpoints the geographic location of addresses contained in the mapsettings.cfg file.

BIBLIOGRAPHY

1. C.M. Colombini, Y. Corio, La corretta gestione di un incidente informatico e alcune ipotesi di linee guida per le operazioni di forensics. La Dead Analysis. White Paper, Corso di Perfezionamento in Computer Forensics e Investigazioni Digitali, AA 2007/2008. 2. B. Nutter , Pinpointing TomTom location records: A forensic analysis. 2008 Elsevier Ltd. 3. Peter Hannay, A Methodology for the forensic acquisition of the TomTom One satellite navigation System A research in progress, Edith Cowan University, 2007. 4. A.K. Theiss, DD.CC. Yen, C.Y. Ku, Global positioning systems: an analysis of applications, current development and future implementations. Computer Standards & Interfaces, 2005. 5. SEC.AU, Edith Cowan University 6. ACPO (2003). Good Practice Guide for Computer based Electronic Evidence 3.0. Retrieved 16 Oct, 2007. 7. P. Hannay, A Methodology for the Forensic Acquisition of the TomTom One Satellite Navigation SystemA Research in Progress. Paper presented at the 5th Australian Digital Forensics Conference, 2007. 8. A. K. Theiss, D. C. Yen, & Ku, Global Positioning Systems: an analysis of applications. 2005. 9. http://www.marcomattiucci.it. 10. http://ww.tomtom.com 11. http://www.GPSforensics.org 12. http://www.forensicswiki.org/wiki/GPS 13. http://www.symbian.com 14. http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=229&part num=S3C2443 15. http://www.maerco.it/index.php/2007/01/03/open-tom-tomtom-opensource/ 16. http://www.opentom.org/Main_Page
A special thanks to the Major Marco Mattiucci, Commander of the RTI Reparto Tecnologie Informatiche - RACIS Roma Arma dei Carabinieri.