CYFOR Blog

Vehicle Digital Forensics Investigators can extract and analyse digital evidence for use in traffic accidents, criminal and civil investigations.

As of 2022, there were 33.2 million cars on UK roads and an estimated 1.4 billion cars on road worldwide. These figures are only increasing, and don’t include vehicles such as HGVs and buses.

The analysis of the data generated from these vehicles can provide a detailed insight into a driver’s behaviour on the road. The technological advancement of cars is increasing year on year. With the integration of mobile phones, the infotainment system of vehicles can store data such as navigation history, text messages, emails, internet browsing history and social media feeds, as well as Bluetooth and cell tower connections. As such, this data is becoming more sought after as admissible digital evidence for use in a court of law.

What is vehicle digital forensics?

Vehicle Digital Forensics is a rapidly evolving field of digital forensics that involves the acquisition, preservation, and analysis of digital evidence stored in the electronic operating systems of a motor vehicle. In recent years, criminal investigations have become more sophisticated, relying more heavily on the data extracted from vehicles. From electronic driver aids to advanced infotainment systems, the data can be used as admissible as evidence in court.

Digital evidence collected from vehicle systems can include:

• Event Data Recorders (EDR)
• Telematics/Infotainment Systems
• Key fob activity, including the VIN, the number of keys paired to a particular vehicle and the last time the vehicle was locked and unlocked.
• Navigation history, GPS coordinates, and location history
• Dash cams with data storage capability,
• Vehicle ECUs (electronic control units) with data storage capability
• Transmitted data from the car stored by the manufacturer or third party
• Application data stored on an occupant’s smartphone
• Bluetooth device connections
• Vehicle characteristics information such as acceleration, speed, and braking status.

Vehicle Digital Forensic Investigations

Vehicle Event Data Recorders (EDR) record data that can be useful when investigating traffic incidents. Vehicle infotainment systems also provide comprehensive data, providing critical information such as determining if a driver was distracted. For example, were they interacting with the touchscreen at the time of an accident? Another potential scenario could involve a mobile phone that had information vital to a criminal investigation but had been lost or factory reset. Some elements of the phone’s data may potentially be available via the vehicle’s Android head unit or from data synced with the Bluetooth “handsfree” system.

Did a driver or passenger in the vehicle connect their phone to its Bluetooth or wi-fi when they claim to have been at home? Did they listen to music or send a WhatsApp message using CarPlay or Android Auto? Was the vehicle’s satnav used to plan and navigate the route driven to commit a crime? Digital forensic experts can investigate these types of data to uncover key digital evidence for use in a civil or criminal investigation.

To date, vehicle digital forensics have been used to reconstruct a timeline of events in the build-up to an RTC and its immediate aftermath. User interaction with a mobile phone has been identified through Bluetooth connections, call logs music streamed, messages sent, Alexa, Siri, and an almost endless list of mobile applications. Speed, the direction of travel, vehicle impact, and even the “quality” of the driving has been recorded by onboard telematics and the vehicle’s engine management system: How hard did the driver brake? How erratic was their steering? How quickly did they accelerate?

Events such as an emergency response from the vehicle manufacturer might also be recorded and give an indication of when a collision occurred if no other sources are available. For example, BMWs today have an Emergency Call/SOS built into their vehicles. If the driver is involved in a collision, an operator from BMW will call them on the vehicle’s internal communications system (which has its own SIM card) to confirm that the driver is ok and arrange for emergency services, etc, to come to the scene. This system provides BMW with GPS data, so they know where the collision occurred. This can be really useful in identifying where/when an accident happened in a hit and run, or where there are questions raised due to conflicting statements or lack of CCTV coverage in an area.

These systems have also been used to reconstruct the movements of a vehicle on the day of a crime – for example, where a hire car or taxi has been involved in a murder or similar event. But these are early days for the technology, and this is only scratching the surface of the opportunities digital forensics can provide to assist with your investigation.