Vehicle Infotainment And Telematics Forensics

VEHICLEFORENSICS · AGUIDEFORUKLAWYERS Vehicle Infotainment and Telematics Forensics The Car as a Witness: Connected Phones, Journeys, Doors and Events COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES INFOTAINMENT & TELEMATICS PAIRED-DEVICE & JOURNEY RECOVERY CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the car remembers 03 What vehicle systems record: infotainment, navigation and modules 04 Telematics and connected-car cloud data 05 Preserving and extracting vehicle data 06 Correlation, corroboration and honest limits 07 Deployment: journeys, collisions, presence and privacy 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: a modern car records paired phones, journeys, door and ignition events and often place, if the data is preserved and extracted correctly and its limits are honestly stated. § 0 2 · FIRSTPRINCIPLES The problem in plain English: the car remembers § 0 3 · WHATVEHICLESYSTEMSRECORD What vehicle systems record: infotainment, navigation and modules PAIRED PHONES JOURNEYS MODULE EVENTS COLLISION DATA CORRELATE § 0 4 · TELEMATICSANDCONNECTED - CARDATA Telematics and connected-car cloud data § 0 5 · PRESERVINGANDEXTRACTING Preserving and extracting vehicle data § 0 6 · CORRELATIONANDHONESTLIMITS Correlation, corroboration and honest limits § 0 7 · DEPLOYMENT Deployment: journeys, collisions, presence and privacy § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE CONNECTED THE PAIRED INSURER COMPANION DELETED / VEHICLE PHONE BLACK BOX APP OVERWRITTEN TELEMATICS / CLOUD § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEPAIREDPHONETHATPLACEDAPERSONINTHECAR EXAMPLE2 · THEOVERWRITTENJOURNEYANDTHETELEMATICSTHATKEPTIT EXAMPLE3 · THECOLLISIONSECONDSANDTHEHONESTRECONSTRUCTION § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a data holder) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAVEHICLE - DATA EXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The vehicle-data checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions What can a car actually tell us? Does the car prove who was driving? The car has been driven since. Is the data gone? Can we get the journey data from anywhere other than the car? Is the collision data reliable? What about the privacy of passengers whose phones were paired? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY