Data Sources for Information Extraction in Automotive Forensics

In digital forensic analysis, it is not possible to pre-determine the exact nature of information relevant for a case. Subsequently, complete physical images of digital memory chips or devices are extracted. In the case of car forensics, it is thus crucial to have knowledge about the format, type and the logical and physical location of the information in a vehicle. Next to increasing utilization of electronics in vehicle control, the situation is further compounded by the introduction of so-called connected car or smart car solutions. In contrast to other areas like smartphone forensics, digital forensics in the automotive field is more complex as it encompasses a multitude of hardware- and software systems both in place and in remote locations, including smartphones themselves, in order to reach a complete view of relevant information. The article gives an overview of the different types of digital information stored in the respective areas. In the following, a separation of data sources is considered with data preserved inside the vehicle (front end and vehicle electronics) as well as outside of the vehicle (connected back end). For handling the increasing amount of data present in modern vehicles, a corresponding solution for data preservation and exchange is necessary. Finally to solve the problem of attributing collected data to individual drivers, pattern-recognition-based methods are presented.