Vehicle Forensics

[MD4N6]

What are some of your thoughts on vehicle forensics? What do you feel the future holds for this space?

 

[twicesafe]

I think this is an area that is going to continue to grow as cars become more automated and store more information.

I think the majority of investigations still fail to consider the potential wealth of information that is available in today's car computer systems. Software like Berla (Berla.co) can be expensive, but for high-priority investigations, the evidence obtained could be essential in proving or disproving investigative theories.

Is this something that your unit or department is considering?
What are your thoughts on the future?

 

[MD4N6]

My organization has been conducting vehicle forensics for about 4 years now. It has helped or even solved multiple cases where other evidence was not present. I see it as where mobile forensics was 10 years ago. That said I also feel there is a lack of encryption in this space as there was in mobile forensics years ago as well. So this begs the questions will the auto manufacturers care enough to encrypt the data in these systems in the future? I guess only time will tell.

 

[twicesafe]

I think encryption would be the next logical step and I am honestly surprised at the lack of encryption currently being used given that most software developers are now building systems with security in mind. Especially as more autonomous features are introduced. The fear of a car being 'hacked' remotely, even if that system is completely separate from the autonomous computer system, would likely cause concern by the vehicle purchaser.

I'd be interested to know how a more technically advanced company like Tesla would compare to the old car companies like Ford, Honda, Toyota, etc.

Has anyone had an opportunity to analyze a Tesla's computer system for an investigation?

What car systems are currently employing encryption?

 

[Miike]

This might be a bit more down in the weeds vs a more global discussion of vehicle forensics.
But came across an interesting article posted by someone working on their Master's project at:
Analysis of a Ford Sync Gen 1 Module

The article covers how he got an acquisition from a Ford Sync Gen 1 module (using iVe from Berla) and the data that was recovered. Interesting to see (though I guess perhaps as expected) that the phone book, call history, and a record of devices connect to system were recovered.

This was only a 1st generation module. So I imagine there is a lot more interesting data being stored by cars today.

In regards to encryption, I imagine when the Apple Car is released, we might see a bigger push in the industry for encryption.

 

[MD4N6]

Mike,

Yeah it retrieves a lot more data now. As far as the Apple Car and encryption goes we will see because they already released Apple Car Play and that sure doesn’t seem to be encrypted much.

 

[RobertM]

What type of information are you able to obtain from Apple Car Play?

I thought that it would be minimal while using the phone as the main storage device.
Is a lot of information downloaded into the car system when connected?

 

[mbaca]

I think this is an area that is going to continue to grow as cars become more automated and store more information.

I think the majority of investigations still fail to consider the potential wealth of information that is available in today's car computer systems. Software like Berla (Berla.co) can be expensive, but for high-priority investigations, the evidence obtained could be essential in proving or disproving investigative theories.

Is this something that your unit or department is considering?
What are your thoughts on the future?

Berla is good for entertainment system in vehicle, but for the real data form car it is not, I need to recover data about what driver is doing with car before accident (speed, break, lights and so on) and only way is to doing manually with adopted bosh system for extracting data.