You Ask, We Answer: Unsupported Infotainment Systems
Intro
Welcome to the inaugural post of our new blog series, "You Ask, We Answer," where we delve into the most frequently asked questions encountered by vehicle systems forensics consultants and practitioners. In this series, we aim to provide answers to common queries, empowering you with the knowledge and strategies needed to navigate the complexities of modern vehicle investigations.
Today, we tackle a question that arises time and again in our field: "What can I do when my infotainment system is not supported by Berla?"
As a vehicle systems forensics practitioner, you understand the frustration that comes with encountering unsupported infotainment modules. In this post, we'll explore some alternative methods and approaches to extract data from these unsupported systems.
You Ask
The vehicle in my investigation has an infotainment system that is not supported for a data acquisition by Berla iVe (Specialist Vehicle System Forensics Hardware & Software).
Explanation
Berla has been at the forefront of providing non-destructive solutions for infotainment systems within their ecosystem, steadily enhancing support year by year. Yet, it's crucial to acknowledge the intricate nature of devising and integrating such solutions into a product with a global customer base. This complexity becomes apparent considering the absence of other commercial vendors in this space and the apparent reluctance of major digital forensics solution providers to tackle vehicle data acquisitions in their existing tools.
It's important to understand that the sheer variety of vehicle trim levels globally makes it unrealistic to expect a single tool to cater to all infotainment modules. As specialists in this field, we regularly encounter a wide range of differences among vehicles, reflecting the intricate and sometimes fragmented nature of the automotive industry.
Manufacturers typically rely on tier one suppliers to furnish infotainment systems for specific vehicle trim levels. However, they may also engage secondary suppliers to ensure consistent supply. This means that even though two vehicles may appear identical in terms of age, make, model, and trim, their infotainment ECUs could come from different manufacturers. While the user interface may look the same, the internal architecture and components of these ECUs can vary as they too may use different suppliers to construct the infotainment ECU.
To illustrate, consider a vehicle with an infotainment module manufactured by a tier one supplier. This module may utilise a storage medium where user data is stored (HDD / Chip) from various tier two suppliers. Accessing these storage mediums may require different techniques depending on the tier two supplier used. This complexity underscores the challenges faced in developing solutions for these systems.
Some infotainment systems in your country may not be supported for data extraction by the software and hardware solutions provided by Berla and this can cause investigations to stop at this juncture.
We Answer
In these circumstances you need to look at what you can do rather than what you can't and look to alternative options, tools, and techniques. To consider these in turn:
1. Manual Examination. By accessing the various menus on the user interface, you can find user data. These usually consist of navigation entries, saved destinations, received destinations from apps, friendly names of connected devices and miscellaneous items such as user account details and unique identifiers. Use a Video Recorder to record the process and photograph where necessary.
2. Diagnostic Tool. Access the infotainment module with a diagnostic tool and see what user data you can find on the measured values. Only last week I discovered BT Mac addresses were visible for currently paired devices on a new platform of vehicle that I had no solution for checking otherwise. Unique identifiers such as BT Mac address for the vehicle and IMEI numbers can sometimes be found in diagnostic reads with the right tool and knowledge on how to use the tool which can assist wider digital strategies.
3. Physically Check the Module. Locating the module and seeing what is printed on the label can either identify some of the unique identifiers such as IMEI, Wi-Fi Mac address for the vehicle or allow further investigations by photographing the label and carrying out further research. This will allow further digital strategies to be developed.
4. Strip the module down. By stripping the module, you will see the internal storage mediums for where user data may be stored such as HDD, eMMC, TSOP chips and even embedded SD or micro SD cards. Once identified speak to a specialist over what other solutions may exist to access the data, read it, and manually reconstruct it.
5. Reach out. As the Vehicle Systems Forensics community is building reach out to others to see whether anybody has examined one of these units before and how they managed to read it. There are many forums online that can be a hub of information (separate blog post coming on these).
Often, we can see investigations not pursued because there is no support for a module. It is unrealistic to think that every Infotainment module is going to be supported by a commercial tool and with the fast paced change of infotainment iterations by manufactures of recent years it is not going to stop anytime soon where unsupported modules are found, and no immediate solution is available.
These alternative methods may enable you to push on a slightly open door, you never know what you may find inside.