AdvancedCryptocurrency / Blockchain ForensicsTrace bitcoin and USDT flows, group wallets and prepare requests to exchangesAutomotive / Vehicle Forensics
Recover paired phones, trip logs and events from infotainment and telematics units
- Advanced
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
A modern car keeps more records than most people expect. The infotainment unit stores the phones that were paired with it, contacts and call logs synced over Bluetooth, navigation history and on some models events such as a door opening or the gear moving into reverse. A telematics unit may hold location points that are also sent to the manufacturer's servers. In a hit-and-run, a kidnapping or a vehicle theft, this data can place a particular phone in a particular car at a particular time.
This course explains how vehicle data is stored, which module holds what and how to acquire it without damaging a unit you may get only one chance at. You work with Berla iVe, the best-known tool for infotainment and telematics acquisition. You also learn its limits. Support depends on make, model and year. Many cars sold in India are not on the list. For those you learn the other routes: chip-off of the unit's storage, the paired phone itself and records held by the manufacturer or toll systems.
You also learn enough about the CAN bus and the OBD-II port to talk sensibly with automotive engineers and to read a crash data report, without claiming to be a mechanic.
Infotainment systemsTelematics unitsCAN bus basicsGPS track logs
After this course you can
- identify the modules in a car that hold user data and decide which ones to remove or image
- check whether a vehicle is supported by Berla iVe and plan the acquisition before touching the dashboard
- recover paired phones, call logs, contacts and messages synced to an infotainment unit
- rebuild a vehicle's journeys from GPS track logs and link them to events like ignition and door opening
- read basic CAN bus traffic and explain what the OBD-II port can and cannot give you
- write a vehicle examination report that ties car data to the suspect's phone and other records
Syllabus
7 modules · 29 topics
01How a Connected Car Stores Data4 topics
- Electronic control units (ECUs) and what each one is for
- Infotainment head unit versus telematics control unit
- Operating systems found in head units, such as Linux, QNX and Android Automotive
- Where the data sits: eMMC, NAND flash and removable SD cards
02CAN Bus and OBD-II Basics4 topics
- What a CAN frame carries: an identifier and a few bytes of data
- Why most CAN traffic is never stored and what that means for evidence
- What the OBD-II diagnostic port exposes and what it does not
- Event data recorders in the airbag module and how crash data reports are read
03Seizure and Handling4 topics
- Recording VIN, make, model, year and head unit software version
- Checking tool support before any panel is removed
- Removing a head unit with photographs at every step and without breaking connectors
- Labelling, packing and chain of custody for removed modules
04Acquisition with Berla iVe4 topics
- Identifying the exact system in iVe from vehicle details
- Bench acquisition of a removed unit versus acquisition in the vehicle
- Logical and physical acquisition, depending on what the system allows
- Hashing and verifying the acquired data
05Analysing Infotainment Data4 topics
- Connected devices: Bluetooth names and MAC addresses, first and last connection
- Contacts, call logs and text messages synced from phones
- Navigation track logs, saved places and recent destinations
- Recorded events such as ignition, doors, gear changes and USB connections, where the system keeps them
06Telematics, the Phone and Outside Records5 topics
- Android Auto and Apple CarPlay traces on the paired phone
- Manufacturer connected-car apps and their location history
- Legal requests to manufacturers for server-side telematics data
- FASTag toll records and CCTV as independent checks on the car's own data
- Chip-off and file system analysis when the vehicle is not supported
07Timeline and Report4 topics
- Merging car, phone and toll records into one timeline
- Clock differences between the vehicle, the phone and the server
- Showing routes on maps that a court can follow
- Certificate under Section 63 of the Bharatiya Sakshya Adhiniyam 2023 for the extracted records
Hands-on labs
- Lab 1
Plan the acquisition of a car's infotainment unit with Berla iVe, from support check to hash verification
- Lab 2
Find the phones paired with a car and match one to a seized handset by its Bluetooth MAC address
- Lab 3
Plot a vehicle's GPS track log on a map and mark ignition and door events on the same timeline
- Lab 4
Load a recorded CAN log into SavvyCAN and pick out repeating frames
- Lab 5
Write a short report for a hit-and-run scenario using car, phone and FASTag records
Tools you will use
- Berla iVe
- Bosch CDR (Crash Data Retrieval)
- SavvyCAN
- Linux can-utils
- Cellebrite UFED
- Magnet AXIOM
- Autopsy
- Google Earth Pro
Who it suits
- Police officers in traffic, crime branch and anti-vehicle-theft units
- Examiners in forensic science laboratories
- Insurance and accident investigators
- Digital forensic analysts adding vehicles to their work
Before you join
- Basics of Cyber Forensics or equivalent experience
- Comfort with forensic imaging and hash verification
- Mobile forensics experience helps, since the paired phone is often half the case
Questions about this course
Does every car store this kind of data?
No. A car with a basic music system may store very little. Cars with a touchscreen, built-in navigation or a connected-car app usually store much more. Always check the make, model and year against the tool's support list before you start.
Can car data prove who was driving?
Not on its own. It can show which phone was connected, when it was connected and where the car went. To say who was at the wheel you need to tie it to CCTV, toll records, the phone's own data and witness statements.
What if Berla iVe does not support the vehicle?
You still have options. The storage chip can sometimes be read after removal, the paired phone keeps its own Android Auto or CarPlay records and the manufacturer may hold telematics data that can be requested through the investigating agency.
Is this course about engine repair or tuning?
No. It covers only the data a vehicle keeps and how to collect and present it as evidence. The CAN bus and OBD-II parts are taught at the level an examiner needs.
More courses in Advanced & Specialised Forensics
AdvancedCryptocurrency / Blockchain ForensicsTrace bitcoin and USDT flows, group wallets and prepare requests to exchanges
AdvancedAI / Machine Learning ForensicsUse machine learning to sort large evidence sets and investigate AI systems
AdvancedOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.