Vehicle Systems Forensics in 2025

If you'd have told me back in 2016 how far vehicle systems forensics would come, I'm not sure I'd have believed you. Back then, we examined maybe three infotainment systems in a whole year. Fast forward to 2025, and we've already worked on four vehicles and received two modules for analysis in just the first week. That's a remarkable shift and a clear reflection of how much this field has evolved and what we've learned along the way to facilitate these examinations.

It's not all about the numbers, though. What we are seeing is an ever-increasing awareness of how much data vehicles actually have on them and how important that can be in an investigation, from serious crimes to collisions. At the same time, we have to work out how to keep up, since there's always a new vehicle, a new system, or a new piece of data we didn't expect to find.

A Never-Ending Puzzle

The fact is, we're never going to "crack" Vehicle Systems Forensics. There are too many cars on the road, and they're all different with their own little surprises and quirks of data types. After all these years, we're still finding surprises. The other day, we did a 10-year-old infotainment system in support of a an investigation. It was a proprietary file system, and we found some really interesting data we'd never seen before on a vehicle.

Be it a new or an experienced professional to this field, it is going to be a discovery year for any person practicing in 2025. So much to be known, so little time. It's like the more and more the dependency on vehicle data grows, greater the exploration possibilities show up.

Growth Brings Challenges

Of course, with more data requests come bigger challenges. Acquiring the data itself is one of the biggest hurdles. Encryption is and will become a major factor (and I'll cover that in a future blog), but even without encryption, vehicle systems are complex, varied, and often proprietary. Accessing their data isn't always straightforward.

The good news? This year, new tools are expected to hit the market, potentially making it easier to extract and rebuild data from more infotainment systems and other modules. While I'll leave it to the vendors to announce these tools when they're ready, their development reflects the demand and growth in this field companies wouldn't invest in these solutions otherwise.

Crash data is another big area to watch. Tools like Bosch CDR, Crash Scan, Hyundai & Kia EDR, and Tesla EDR are now widely used, and newer vehicles are adding even more detailed crash data capabilities. The announcement that in the USA crash data may be increased to manufactures providing 20 seconds of pre-crash data at 10Hz is a reflection of this if mandated (Source: https://www.federalregister.gov/documents/2024/12/18/2024-29862/event-data-recorders).

However, we're still facing gaps, particularly around autonomous features. For instance, were those features active during a crash? If so, who controlled them the driver or the vehicle itself? Take a feature such as autonomous parking whereby a pedestrian is struck in the process how do we determine whether this feature was active and the vehicle carrying out the manoeuvres or the driver was performing the parking? Is the data there across all brands? If so is it accessible? Perhaps not.

That's a big headache for forensic collision investigators, and I don't see that changing anytime soon. A few of our carryover cases from 2024, we've asked those kinds of questions. Some of that information is just not available at this time. Again, that may require some kind of collective partnership from the investigator, the manufacturer, and regulators to fill the gaps.

Guidance and Responsibility

Another area where the field needs to catch up is in developing guidance and best practices for Vehicle Systems Forensics examinations. Despite the progress we've made in accessing and analysing vehicle data, there's still no clear standard for how this work should be conducted. Whilst the Scientific Working Group on Digital Evidence (SWDGE) Best Practices for Vehicle Infotainment & Telematics Systems (Source: https://www.swgde.org/best-practices-for-vehicle-infotainment-and-telematics-systems-v3-0/) is a fantastic starting point it is limited to infotainment and telematics systems and when considering some of the scenarios we have dealt with over the last eight years needs some further considerations.

To help fill this gap, I'm putting together a suggested best practice guide for Vehicle Systems Forensics examinations on the back of eight years practising in the field. It's nearly finished and complements our Module 2 of our training programme (Vehicle Examinations). I hope it will provide a framework for practitioners to conduct this work more effectively and consider flexibility in the approach to the examinations they face. I also consider this to provide an opportunity for future collaboration, discussion and improvement, it is certainly only a starting point and needs to evolve with the dynamic challenges in the field.

Another issue is one of privacy. Cars are very different, from say phones or computers, as regards a digital investigation. There are many reasons for that, but one to outline from a privacy standpoint is that they often store data from multiple users. Think of a rental car; it could contain data from the last ten or more drivers and all their passengers. How do we handle that in a responsible way? While the automotive industry as a whole needs to address these concerns, the reality is that many vehicles already on the road (and likely to stay there for years) weren't designed with privacy in mind. It's a problem we'll be grappling with for some time.

Looking Ahead

While more data and other tools / solutions will come along in 2025 to acquire data, the real challenge is making sense of it. Data is coming at us left, right and centre; interpreting it - figuring out what it actually means requires research, testing, and experience. This area's ready for growth, and to those who have already contributed to this by carrying out research and publishing it I thank you as it is invaluable in understanding the field better. This area comes with its challenges. Those are topics for another post in this series.

One thing is certain: vehicle data is here to stay. From complex crime investigations to serious collisions, it's becoming an integral piece of the puzzle. There is still much work to be done, but the opportunities for learning, growth, and making a difference have never been greater.