Driven to Evidence: The Digital Forensic Trail of Vehicles

Driven to Evidence: The Digital Forensic Trail of Vehicles

연구 분야: Cryptography

학회: International Conference on Digital Forensics and Cyber Crime

Digital forensic investigations are constantly growing in both the volume and variety of available data sources. Today, many vehicles possess an in-vehicle infotainment system (IVI), providing communication capabilities and entertainment. These features, such as the ability to send messages, place and receive phone calls, access emails and browse the internet, are user driven, however, IVIs can also obtain information that is not user controlled, such as the location and mapping data of where the vehicle was driven, and further data such as when car doors were open and closed and lights turned on and off. Vehicle forensics is the area of digital forensics that involves the acquisition and analysis of this data stored on various computer electronic systems within a vehicle and is becoming increasingly more prevalent as technology evolves. Vehicle forensics can be especially useful when it comes to a wide variety of investigations, including but not limited to law enforcement cases, insurance fraud, and accident reconstruction. Throughout literature, there is a focus on ‘dead-box’ forensic approaches and few of them also focus on the network infrastructures within vehicles and the associated investigative opportunities. The current research is further missing the analysis and comparison of artifacts between connected devices, such as mobiles, and the data residing on an IVI system. This paper presents a new approach of vehicle forensics with the acquisition and analysis of not only artifacts from internal storage in the IVI system, but also artifacts that can be recovered off mobile devices connected to the infotainment unit, and additionally what data can be retrieved from a live network capture. The objective of this research is to determine further available avenues for vehicle forensics investigations. This approach is validated with a case study of analyzing Ford Explorer systems with both iOS and Android devices.