Vehicle and Automotive Forensics

What it is and why it matters

Open the dashboard of a car built in the last ten years and you find dozens of electronic control units talking over a CAN bus. The infotainment head unit keeps navigation history, call logs synced from paired phones, USB connection records and often a log of doors opening and gears changing. The telematics unit talks to the maker's servers. The airbag control module holds an event data recorder that freezes speed, brake and throttle readings for the few seconds before a crash. Each of these is a source the examiner can reach, with the right method and the right authority.

The cases are varied. A hit-and-run where the suspect vehicle's own record of ignition cycles and location contradicts the owner. A kidnapping where the route and stops matter more than anything on a phone. A theft where the last paired device identifies a user. A collision where the event data recorder settles who braked and when. Vehicles are also carriers of other people's data, since every phone that paired with the head unit may have left contacts and messages behind.

India adds its own layer. Public service vehicles must carry a vehicle location tracking device and emergency button built to the AIS 140 standard, with data flowing to state transport backends, and fleets fit aftermarket trackers and dashcams of their own. On the laboratory side the specialist product in wide use is Berla's iVe, which is supplied to law enforcement and selected organisations, while mobile forensic suites handle the paired phones. SWGDE's best practice document for infotainment and telematics systems is the reference most laboratories follow.

Types of digital evidence

Navigation History and Tracklogs
Destinations entered, routes taken, favourite places and periodic position fixes recorded by the head unit or telematics unit, with timestamps.
Event Data Recorder
A short record in the airbag control module of speed, brake, throttle, steering, seat belt status and airbag deployment around a crash event. It is written only when a trigger occurs.
Paired Phone Data
Contacts, call logs and messages synced from phones that connected over Bluetooth, along with each phone's name and address and the time it was last connected.
Vehicle Events
Logs of doors opened, ignition cycles, gear changes, lights and reversing, which some systems record with time and position.
USB and Media Records
Serial numbers of USB sticks and phones plugged in, media played and files browsed.
Telematics and Connected Services
Remote lock and start commands, app sessions and position reports held by the maker or a service provider under the owner's account.
Trackers and Dashcams
Aftermarket GPS trackers, AIS 140 devices and dashcams with their own cards, logs and vendor portals.
Diagnostic and Odometer Data
Fault codes, service records and mileage readings from the diagnostic port, which help date events and detect tampering.

Devices and data sources

The infotainment head unit and its storage, from eMMC chips to removable SD cards
The telematics control unit and the maker's connected services account
The airbag control module holding the event data recorder
Phones that paired with or plugged into the vehicle
Aftermarket GPS trackers and the fleet portals that receive their data
Dashcams, parking cameras and their memory cards
Key fobs and the immobiliser, which record pairing and sometimes use
Toll, parking and fuel records tied to the registration number, obtained by lawful request

How an examination runs

The order matters. Each step protects the one after it.

01
Authority
Confirm the legal basis to seize the vehicle and to examine data that belongs to the owner, the driver and every person whose phone paired with it.
02
Preserve the Vehicle
Do not start it, drive it or connect a diagnostic tool. Control units draw battery power even when the ignition is off and wake when doors open, so keep handling to a minimum and record each action. Keep keys, cards, cables and accessories with the vehicle.
03
Document
Record the VIN, registration, make, model, year, trim and the modules fitted. Photograph the head unit screen, settings and any paired device list without changing them.
04
Choose the Route
Acquire through the vehicle network or the diagnostic port where a supported method exists, directly from the unit's USB or card slot, by probing test points on the board or by chip removal. Move down the list only when the gentler route fails and authority covers it.
05
Read the Event Data Recorder
Use the method the module's maker supports, through the diagnostic port or directly from the module, and record the trigger type and the module's own time.
06
Extract Paired Phones
Where phones are available, extract them with mobile forensic tools and match their identifiers to the pairing records in the vehicle.
07
Correlate and Report
Reconcile the vehicle clock, GPS time and the phone clock, build one timeline and state plainly which readings are measured, which are interpolated and what the system did not record.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

ECU: Electronic Control Unit, any of the computers in a vehicle, from the engine controller to the head unit.
CAN Bus: Controller Area Network, the shared wiring over which ECUs exchange messages. Some units log those messages, and a few acquisition methods read through it.
OBD-II Port: The diagnostic connector under the dashboard. A route for some acquisitions, and also a way to change data if used carelessly.
Infotainment Unit: The head unit that handles navigation, media, phone pairing and settings. The richest single source in most vehicles.
Telematics Control Unit: The module with a mobile data connection that reports to the maker's servers and enables connected services.
Event Data Recorder: The crash record kept in the airbag control module. It stores a few seconds of pre-crash data and is written only on a trigger such as deployment or a sudden deceleration.
VIN: Vehicle Identification Number, the seventeen-character code that identifies the vehicle and its specification.
AIS 140: The Automotive Industry Standard published by ARAI for the vehicle location tracking device and emergency button required in public service vehicles under Rule 125H of the Central Motor Vehicles Rules, 1989.
Tracklog: A series of time-stamped position fixes recorded by a navigation or telematics system as the vehicle moves.

Challenges and limits

What makes it hard

Hundreds of make, model and year combinations, each with its own storage, format and acquisition route
The vehicle wakes and writes whenever a door opens or a key is near, so careless handling overwrites records
The event data recorder holds only triggered events and nothing about normal driving
Disconnecting the battery to remove a module can erase volatile data in other modules
Connected services data sits with the maker, often abroad, and needs its own legal process
Specialist vehicle tools are supplied only to certain agencies, so capability varies between laboratories
A vehicle is often driven by others between the event and the examination, adding records that must be separated out

Keeping the evidence intact

Log every interaction with the vehicle, including opening a door, since each can change stored data
Keep the vehicle's own clock reading alongside a reference time at the start of the examination
Hash every image taken from a unit, card or module and record the acquisition route used
Photograph modules before and after removal and keep them with the vehicle exhibit chain
Separate measured readings from values a tool has interpolated or inferred when reporting

Standards and legal considerations

SWGDE Best Practices for Vehicle Infotainment and Telematics Systems
Document 12-F-004, version 3.2 of December 2024, which sets out seizure, power behaviour, paired device access and analysis for vehicle systems and is read alongside SWGDE's mobile phone practices.
Read the guide
AIS 140 and Rule 125H
Rule 125H of the Central Motor Vehicles Rules, 1989, inserted by notification in November 2016, requires a vehicle location tracking device and emergency button in public service vehicles, built to the AIS 140 standard and approved by test agencies such as ARAI or ICAT. Tracker data reaches state transport backends, which is where an examiner looks for it.
ISO/IEC 27037:2012
The preservation principles applied to a vehicle that is both a crime scene and a set of storage devices.
Read the guide
NIST SP 800-101 Rev. 1
Guidelines on Mobile Device Forensics, for the paired phones and for head units that are themselves Android systems.
Read the guide
Bharatiya Sakshya Adhiniyam, 2023
The evidence law under which records produced from a vehicle's modules are admitted, including the certificate requirement for electronic records.
Read the guide

In practice

A Hit-and-Run Timeline
A car is seized three days after a fatal collision. The head unit's event log shows an ignition cycle beginning at 11.52 pm, a tracklog passing the scene at 12.04 am and the reverse gear engaged twice nearby a minute later. The owner had said the car did not leave the house that night.
Who Was Driving
Two people were in a vehicle during an incident and each blames the other. The pairing record shows one phone connected over Bluetooth throughout the journey, the driver's seat belt reading in the event data recorder is fastened and the passenger's is not. The examiner reports the records and the limits of inferring who sat where.
A Bus and Its Tracker
A state transport bus is involved in a crash and the driver reports a moderate speed. The AIS 140 tracker's data in the transport backend gives position and speed at regular intervals, and the examiner compares it with the event data recorder, noting that the tracker's reporting interval leaves gaps of several seconds.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

AdvancedAdvanced & Specialised ForensicsAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics unitsAdvancedIoT / Drone

MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsIntermediateDCMFE

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Questions people ask

Does every car keep a location history?

No. Vehicles with built-in navigation or telematics often do, and the depth varies by make and model. Older or basic vehicles may record nothing beyond fault codes. The examiner identifies the modules fitted before promising anything.

Can the event data recorder show how a person drove over a whole journey?

No. It captures a few seconds around a trigger such as an airbag deployment. Journey information comes from navigation, telematics or an aftermarket tracker.

What happens to a phone's data when it pairs with a car?

Many head units copy contacts, call logs and sometimes messages for hands-free use and keep them after the phone leaves. That copy can be read from the vehicle, which matters both for the investigation and for the privacy of people who are not party to it.

Why is unplugging the battery a problem?

Some modules keep recent data in memory that is lost without power, and disconnecting one module can wake others and write new records. Laboratories follow a documented order and record each step.