Vehicle systemS forensics

DO YOU NEED TO SEE THE DATA LEFT BEHIND BY A MODERN VEHICLE?

Almost every modern vehicle now contains vehicle systems, such as infotainment, advanced driver assistance systems, airbag control modules and vehicle apps that integrate with smart devices. These systems can be exploited for useful investigative data that can assist in serious crime or collision investigation.

Vehicle Systems Forensics is a notoriously difficult discipline, made more challenging by car manufacturers who are less than forthcoming with technical data regarding their in-car systems.

That said, we are already capable of extracting data from >10,000 models of vehicles and that figure is constantly rising.

Specialist knowledge

We are one of a few companies in the UK to possess the specialist equipment, techniques and knowledge to be able to access vehicular data in this manner.

Additionally, our commitment to research and development and our hard-earned reputation as being one of the leading expert investigation consultants specialising in vehicle-related incidents in the UK further sets us apart.

We have developed in-house solutions to recover data from vehicle systems and constantly revise and invest in new equipment and technologies to aide these solutions.

We are one of the very few companies worldwide that have done any validation and testing around vehicle infotainment extractions and this enables us to have a better understanding of the data types and what they mean.

We are some of the few Vehicle Systems Forensics experts in the country. If you are interested in our services or training or want to make an enquiry, please get in touch.

Infotainment

Infotainment Data is stored on the infotainment module. User data can be stored in a variety of places such as Hard Drives, Memory Chips and even embedded SD cards that form part of the module architecture.

Accessing this data and imaging the Hard drives, Chips and eSD cards found in infotainment modules requires a variety of specialist tools involving various pieces of hardware and software.

Methods to acquire infotainment data are varied dependent upon the module subject to interrogation. We always use non-destructive methods if possible, however do offer the destructive method for consideration if it’s the only way to check for data. This requires the removal of memory chips from the printed circuit boards using a method known as ‘chip off’.

This unit is not just a user interface it is an integral component taking information from sensors all over the vehicle to keep the driver informed and connected. Some of this data is being stored within the infotainment system.

Using specialist hardware and software we can download the memory of a vehicle and extract:

Apple Car Play / Android Auto & Vehicle Apps

Both these functions are connectivity solutions that allow users to swap the manufacturers infotainment displays and user interfaces for a display that interfaces with the user’s smart phone platform of choice. It enables users to control selected apps and the device either with the infotainment screen or voice commands. Both these functions tend to require a cable connection to a USB port in the vehicle from the device although developing Wi-Fi connectivity is starting to emerge.

The fact that devices need to be connected (cable or otherwise) to the vehicle whether using the manufacture’s system or ACP/AA means some data from smart devices is transferred across onto the infotainment module and on occasions can be recovered as part of an examination of the infotainment module, ultimately recovering data from a smart phone that is no longer with the vehicle.

We can locate and extract the event data recorder from the vehicle and download all available data using our industry-leading equipment and skills.

This data can be invaluable for crash investigators and insurance companies to assist in determining exactly what happened and who, if anyone, was at fault, especially in cases where there are no witnesses or witness statements are in conflict.

The above infotainment and EDR data can often give access to data unavailable by any other means. This can be especially useful when combined with mobile phone data extracted from drivers.

Using all of these valuable data resources, we can build a clearer picture than ever before of exactly what happened during a crash.

a reasonable line of enquiry

Collectively embedded, third party systems and the emerging digital eco system of vehicles can hold a significant amount of data that may be of use to investigators of vehicle related incidents. The type of data and how much data is available in any given vehicle will vary depending on the vehicle manufacturer or the Original Equipment Manufacturers (OEM) who manufacture the components used in these systems.

The options fitted to a vehicle will also affect the data on a vehicle system for example a vehicle that is not Sat Nav enabled may not contain GPS data.

Harper Shaw Investigation Consultants Ltd utilise in house experience and expertise across the automotive industry and digital forensics field in the development of strategies and extraction of this data from vehicle systems.

three stage process

1. Triage

Triage: this starts with you providing us with a vehicle registration or VIN number. With this single piece of information, we devise a Vehicle Systems Forensics (VSF) strategy based on our knowledge of what systems the vehicle contains and experience in this field. This outlines the possibilities for data acquisition.

2. Examaintion

Onsite examination: we implement the strategy, attend the location of the vehicle and carry out a VSF examination. Maximising data opportunities, following quality management systems that we have developed to contribute to the process of data acquisition. The depth of the examination onsite is dependent upon make, model and trim of vehicle together with the necessity to forensically recover components for examination offsite.

Bench examinations: We accept modules by clients who have recovered them from a vehicle to be submitted for bench examinations in addition to those we recover onsite. All examination procedures are documented and recorded on a bespoke internal digital contemporaneous notes application. This is time and date stamped to comply with guidelines in this forensic activity.

3. Findings

Results: a summary of findings will be reported on and submitted to the relevant parties following both on and offsite acquisitions where appropriate.

Contact

FRANKIE - Vehicle Systems Forensics Rig

in 2018 we worked on a case involving a 2018 Audi S4 which was involved in serious crime offences. Following the conclusion of the case we were granted access to the vehicle by UK Law Enforcement and we stripped its components and built a rig that has been named ' Frankie'.

Frankie allows people to see the components connected together outside of the vehicle and assists students in understanding how a modern motor vehicle communicates. The rig is also a safe environment for performing ethical hacks and is used in automotive cyber security events.

This is a resource available for students attending on our in person training courses.

Vehicle systemS forensics

DO YOU NEED TO SEE THE DATA LEFT BEHIND BY A MODERN VEHICLE?