You Ask We Answer: Refitting Infotainment Modules?

Welcome to the second post of our new blog series, 'You Ask, We Answer,' where we delve into some of the most frequently asked questions encountered by Vehicle Systems Forensics consultants and practitioners. In this series, we aim to provide answers to common queries, empowering you with the knowledge and strategies needed to navigate the complexities of modern vehicle investigations.

Today, we address a question we frequently encounter from investigators after completing a non-destructive data acquisition from an infotainment module removed from an undamaged vehicle. This recurring query has prompted today's blog post. Here's the latest version of the question:

'Do we need to sort anything with regards to getting the unit back in the car'

The short answer is as always – 'It Depends'.

The long answer…

Okay let's look at some questions that need answering before making a decision:

1. Is The Acquired Data of Evidential Value? Evaluate the importance of the data to the investigation. If the data is crucial and you feel the defence must have the same opportunity to examine it, the module (and vehicle) should be retained and module not refit to the vehicle.

2. How Serious is The Offence? This may have a bearing on your decision on whether to refit the module or leave it out of the vehicle and retain it. In serious offences such as murder and those which can carry a sentence of life imprisonment then you may be more inclined to retain the module out of the vehicle. Whereas if you have a lesser offence then it maybe that you are content to have a forensic image of the module and for it to be refit and released – the defence would have to work from your master image of the data if required.

3. What Other Evidence Do I Have? If the data from the module is the only evidence you have to support your case, you may want to retain the module outside of the vehicle. This data constitutes primary evidence, and its loss or the inability for the defence to examine it could compromise the defendant's right to a fair trial. Therefore, retaining the module may be crucial. (We are always reminded of R v Beckford 96).

4. Who Owns the Vehicle? Ownership of the vehicle can influence the decision to refit the module and release the vehicle. For example, if the vehicle has been recovered and no one claims ownership, there is no immediate pressure to refit the module. Conversely, if the vehicle belongs to a witness who relies on it for daily activities, such as caring for a vulnerable family member, there is greater urgency to return the vehicle. Unlike mobile phones, replacing a vehicle is not a simple or cost-effective solution.

Once you have started to answer some of these questions and considerations then you can start to make a decision and rationalise why you are doing what you are doing. There is no right or wrong answers here but you need some rationale behind your decision and these are some of the factors in our experience that help you make the decision.

Decision Making Outcomes

Belt and Braces: Action: Retain both the vehicle and the module. This approach involves keeping both the vehicle and the infotainment module. This ensures the integrity of both, allowing the defence to examine them just as you have, and draw their own conclusions. Implications: The vehicle remains off the road for an extended period, leaving the owner without transportation. This can be particularly problematic for newer electric vehicles, which may not fare well if left unused for long periods.

Next Best Thing: Action: Retain the module but release the vehicle. In this scenario, the module is retained to preserve its integrity, while the vehicle is released. It's an important consideration to ensure that if data on the infotainment module originates from other sensors (e.g. door events) on the vehicle, you have examination notes and records of their status for potential review during a defence examination. Implications: The vehicle owner regains possession of their vehicle and has the option to source a new module, potentially incurring additional costs for them or you. Meanwhile, retaining the module allows for an independent defence examination, preserving some integrity in the process.

The Compromise: Action: Refit the module and release the vehicle. In situations where there is pressure to release the vehicle, refitting the module may be necessary. In such cases, you may rely on the forensic image of the module, limiting the defence examination to this image along with any vehicle examination notes. However, it's important to acknowledge that retaining the vehicle or the module may be impractical due to our reliance on vehicles. Implications: The defence may not have the same opportunity as you to examine the vehicle or module directly. However, they can rely on examination notes and a forensic image of the data for their analysis.

In conclusion, there is no one-size-fits-all answer. Each case requires careful consideration of the factors involved to make an informed decision. Always ensure you have a clear rationale for your decision and consider the implications for both the investigation and the parties involved. If there are defence teams instructed then engage with them, consider asking them if they wish for an independent examination of the vehicle or module before it is refit and released and document this.

An Added Layer of Complexity

It is important to note extracting data from vehicles can be significantly different from extracting data from traditional devices like computers and mobile phones. For instance, accessing data from a vehicle's infotainment system often requires physically removing the module from the vehicle to be able to perform the extraction of data.

While vehicles are sometimes referred to as 'computers on wheels' or 'mobile phones on wheels,' this comparison is only partially accurate. Modern vehicles are complex, safety-critical systems, manufactured completely differently to consumer devices such as laptops and phones.

As one of our network experts puts it, 'Real cars contain not only computers but also powerful engines, high voltage batteries, and various types of explosives.' Therefore, removing an infotainment module from a vehicle involves careful planning and strict quality management processes to ensure the vehicle can be safely reassembled and returned to the road after the examination.

Unlike phones or computers, which are not directly responsible for user safety, vehicles must uphold their integrity to ensure the safety of their occupants and other road users. This crucial aspect can prolong and heighten the significance of examining and reassembling vehicle components like infotainment modules, presenting challenges that may be unfamiliar to traditional digital forensics practitioners.

Regardless of whether the module will be replaced soon due to pressure to release the vehicle or later following the conclusion of a court case, the safety of the vehicle upon release is paramount. As such always ensure you are confident in the examiner's process, level of training, and competence when handling and releasing the vehicle.