Vehicle Forensics

  • We encourage our users to use Real Names to build a real community, friendships and networking opportunities.

    [more information]

twicesafe

Administrator
Staff member
Sep 4, 2018
84
Ratings
20
8
Vancouver, Canada
www.computerforensicsworld.com
Twitter
Forensic_Notes
#2
I think this is an area that is going to continue to grow as cars become more automated and store more information.

I think the majority of investigations still fail to consider the potential wealth of information that is available in today's car computer systems. Software like Berla (Berla.co) can be expensive, but for high-priority investigations, the evidence obtained could be essential in proving or disproving investigative theories.

Is this something that your unit or department is considering?
What are your thoughts on the future?
 

MD4N6

New Member
Oct 20, 2018
3
1
#3
My organization has been conducting vehicle forensics for about 4 years now. It has helped or even solved multiple cases where other evidence was not present. I see it as where mobile forensics was 10 years ago. That said I also feel there is a lack of encryption in this space as there was in mobile forensics years ago as well. So this begs the questions will the auto manufacturers care enough to encrypt the data in these systems in the future? I guess only time will tell.
 

twicesafe

Administrator
Staff member
Sep 4, 2018
84
Ratings
20
8
Vancouver, Canada
www.computerforensicsworld.com
Twitter
Forensic_Notes
#4
I think encryption would be the next logical step and I am honestly surprised at the lack of encryption currently being used given that most software developers are now building systems with security in mind. Especially as more autonomous features are introduced. The fear of a car being 'hacked' remotely, even if that system is completely separate from the autonomous computer system, would likely cause concern by the vehicle purchaser.

I'd be interested to know how a more technically advanced company like Tesla would compare to the old car companies like Ford, Honda, Toyota, etc.

Has anyone had an opportunity to analyze a Tesla's computer system for an investigation?

What car systems are currently employing encryption?
 

Miike

New Member
Oct 22, 2018
1
1
#5
This might be a bit more down in the weeds vs a more global discussion of vehicle forensics.
But came across an interesting article posted by someone working on their Master's project at:
Analysis of a Ford Sync Gen 1 Module

The article covers how he got an acquisition from a Ford Sync Gen 1 module (using iVe from Berla) and the data that was recovered. Interesting to see (though I guess perhaps as expected) that the phone book, call history, and a record of devices connect to system were recovered.

This was only a 1st generation module. So I imagine there is a lot more interesting data being stored by cars today.

In regards to encryption, I imagine when the Apple Car is released, we might see a bigger push in the industry for encryption;).
 
Last edited:

MD4N6

New Member
Oct 20, 2018
3
1
#6
Mike,

Yeah it retrieves a lot more data now. As far as the Apple Car and encryption goes we will see because they already released Apple Car Play and that sure doesn’t seem to be encrypted much.
 

mbaca

New Member
Sep 12, 2008
1
Ratings
1
1
#8
I think this is an area that is going to continue to grow as cars become more automated and store more information.

I think the majority of investigations still fail to consider the potential wealth of information that is available in today's car computer systems. Software like Berla (Berla.co) can be expensive, but for high-priority investigations, the evidence obtained could be essential in proving or disproving investigative theories.

Is this something that your unit or department is considering?
What are your thoughts on the future?
Berla is good for entertainment system in vehicle, but for the real data form car it is not, I need to recover data about what driver is doing with car before accident (speed, break, lights and so on) and only way is to doing manually with adopted bosh system for extracting data.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu