Vehicle Infotainment Forensics: It’s About More Than Accidents

With new technologies developed for vehicle infotainment systems, principally by the BERLA Corporation, digital forensic experts can access digital evidence from many of today's vehicles. This evidence can include location history, connected devices, and operating system data including hard braking events, gear shifts, speed of the wheel, and hard acceleration. 

An infotainment system is formally defined as, "A factory original or aftermarket console system that uses some form of connectivity to provide drivers and passengers with vehicle-specific information, navigation, and standalone or integrated applications and/or multimedia entertainment including audio and video."[1] In other words, an infotainment system is a combination of capabilities, including GPS, satellite radio, Bluetooth, or Wi-Fi, the ability to pair and interact with a mobile phone, and the ability to play audio and video. These capabilities are represented to the user on the screen with a Graphical User Interface (GUI), which makes the functionality of the infotainment system accessible to non-technical consumers. 

The forensic artifacts recovered from vehicle infotainment systems can also allow examiners to determine where the driver’s hands were in a vehicle at a particular point in time; for example, if someone used the controls on the steering wheel to change the volume or reached across to the center console to turn the volume knob, the vehicle infotainment system would store this information.  

The digital evidence that an examiner can recover from vehicles is not relegated to vehicle accident cases, though. Imagine the following scenario: a defendant allegedly drove to a location and committed a crime. According to the state's theory, the defendant traveled there and committed the crime alone. However, upon analysis of the infotainment system data from the vehicle, it is determined that three doors opened simultaneously upon arrival at the incident location, the front driver door and the two rear passenger doors. This action is an interesting trick, an impressive physical feat, or, most reasonably, the defendant was not alone. 

Vehicle Evidence from Event Data Recorders vs Infotainment Systems

The primary function of the Infotainment system in a vehicle is to enhance the driver’s experience, and therefore it connects to their phone and applications. An Event Data Recorder (EDR), commonly called the vehicle’s “black box”, stores limited and specific pre-and post-crash data. The resulting data from an EDR extraction applies primarily to accident reconstruction alone, which produces more robust crash evidence than the infotainment system. Still, it does not produce as much of the types of evidence as the data collected in infotainment forensics analysis. Further, some accident events are too small for an EDR to record, including a low-impact collision with a bicycle or pedestrian. In these situations, the methods by which an infotainment system records vehicle event data, with less total data but over a long period, may be the best or sole source of crash data evidence.  

Except in a vehicle crash event, infotainment system data is superior in answering the who, what, when, where, and why questions. This is especially true when a person connects their phone to the vehicle infotainment system. When this connection occurs, data from the phone is synced to the vehicle.

The data contained in the infotainment system falls into one of three primary categories, vehicle event data, navigation data, and user data.

Vehicle Event Data

Vehicle event data includes evidence related to braking, gear shifts, wheel speed, and hard acceleration, and can also record Wi-Fi and Bluetooth connections or disconnections. While this information may seem useless outside of an accident investigation, this is not the case.

If it is critical in a case to determine if someone was impaired in some way, the vehicle event data around the time the person is believed to be impaired could be compared to the entirety of the vehicle event data to see if it is different. In other words, if they historically drive responsibly, but during the period of interest, these data points paint a picture of erratic and unusual driving, the data could be utilized with other evidence to bolster or refute the claim of impairment, even if that impairment does not lead to a vehicle accident.  

For example, a defendant is accused of burglarizing a business. The vehicle event data shows that they usually drive safely, within normal parameters. However, the driving was erratic and unusual on the day in question. This information is provided to counsel. Holistically looking at their case, counsel connects the erratic driving to the fact the defendant had changed from one medication to another as instructed by their doctor the day before.

Navigation Data

The navigation data recoverable from an infotainment system includes saved locations, recent locations, and track points, among other forensic artifacts. It is not uncommon for several thousand data points related to navigation to be recovered from the vehicle. This data allows an examiner to determine where that vehicle has been historically, potentially going back to the car's genesis, resulting in potentially years of location data.

This data is exceptionally well utilized when conjoined with other forms of location evidence in the same case. Not only is the infotainment system in your car tracking where you go, but your mobile phone is also recording your location activity to act as a personal assistant, predicting when you're about to leave for work and informing you that traffic will be heavy. Your digital camera includes geolocation coordinates in the metadata of the pictures you take. Call detail records, or CDRs, which can be subpoenaed from a cellular provider, also record the cell tower and sector utilized when a phone makes a call or SMS/MMS text message. 

If the reliability of the navigation data is called into question or is, in fact, questionable, utilizing other forms of location from different devices can assist in the verification or dismissal of the evidence.  

User Data

User data is where it gets interesting. When you connect your phone to a vehicle, it syncs much of the data contained on your phone onto the internal storage of the car itself. The result is that an examiner can collect mobile phone data without even possessing the phone. User data, including messages, emails, social media content, call logs, and application data, are all recoverable from vehicles, and the list continues to expand as time passes and technology advances.

Previously reserved only for luxury vehicles, infotainment systems are seen in almost every vehicle being produced today. The widespread distribution of this technology and its rapid advancement create an environment of both innovation and customer demand. 

This demand is for cars to do more. Ever-increasing connectivity and functionality with a mobile phone, more conveniences, and more features require the infotainment system to record more information about you. For your car to do helpful things, it needs to know how to personalize the experience just for you. To do that means that the vehicle must collect as much information as possible from your mobile phone and the interactions with the infotainment system itself. Of course, this all leads to more digital evidence.

Looking Forward

Hyper-connectivity is the future with connected vehicles, smart devices, wearable technology, and even entire smart cities. This type of future will mean that more data than ever will be collected concerning our habits, location, activities, health, and financial information. Virtues and vices will be stored electronically, and when that data is collected and stored, it can often be recovered using forensic tools and methodology.

We are not far off from a world whereby almost every device and app send information and “communicates” to every other device and app we own. This is apparent if we look at the relationship between wearable technology and phones. Ultimately, we will see biometric data, sleep patterns, markers of healthiness and disease, physical activity, and heart rate contained in the infotainment data. If that sounds far-fetched, consider the following scenario, which happens every day. First, you sync your fitness watch to your phone. Then you connect your phone to your car, which syncs your phone data to the infotainment system. It would now be possible for biometric data collected from your fitness watch to be contained in the infotainment system of your car. It's a brave new world.

[1] TIBCO Software. The connected car: finding the intersection of opportunity and consumer demand. Palo Alto (CA): 2016