Automotive Forensics

It is important to understand that automotive Infotainment and Telematics Systems are not the same as crash data recorders (CDR), or event data recorders (EDR).

In an automotive infotaniment and telematics system data is collected from primarily non-safety related components (i.e. speed and coordinates from GPS are captured at a lower frequency but for a substantially longer time period)

In a CDR/EDR safety system sensors capture data such as brake position, speed, steering wheel position and airbag deployment and record it at a high frequency. But they freeze the data for only for a matter of seconds leading up to and just after a crash.

Hence while CDR systems can provide complete automotive data related to a point of impact the automotive infotainment and telematics system can perhaps show the longer term driving habits of the vechile's driver.

The typical data available in a Automotive Infotainment and Telematcis Systems may include:

Vehicle / System Information: Serial number, part number, original VIN number, build number.

Installed Application Data: Weather, traffic, Facebook, Twitter.

Connected Devices: Phones, media players, USB drives. SD cards, wireless access points.

Navigation Data: Tracklogs and trackpoints, saved locations, previous destinations, active and inactive routes.

Device Information: Device IDs, calls, contacts, text messages, audio, video, images, access point information.

Events: Doors opening/closing, lights on/off, Bluetooth connections, Wi-Fi connections, USB connections, system reboots, GPS time syncs, odometer readings, gear indications.

The typical data available in a CDR / EDR may include:

Vehicle information is continuously recorded and saved, but only after a physical event like a crash. Complete vehicle dynamics information and system status for about 5 seconds before a crash. Driver relatred inputs are also collected for about 5 seconds before a crash (i.e : accelerator positon, brake pedal position and steering wheel position). Vehicle crash severity signature. Restraints use and deployment related information. Post-crash data such as activation of an automatic collision notification (ACN) system.

Laptop, Desktop & Server Forensics

Operating Systems supported: Windows, Mac and Linux Fast, discrete and Forensically Sound on-site or in Lab acquisition Any drive type: IDE, EIDE, SCSI, SATA Any drive configuration: stand alone through RAID 1 - 10

Virtual Environment

Hypervisors supported: VMware ESX - ESXi Guest Operating System supported: Windows, Mac and Linux Forensically sound Virtualization Forensics Fast, discrete and Forensically Sound on-site acquisition Any drive type: IDE, EIDE, SCSI, SATA Any drive configuration: stand alone / shared through RAID 1 - 10

Fast hardware based acquisitions

Voom HardCopy II up to 5.5 GB per min Logicube Forensic Talon - featuring keyword searching during acquisition Software based acquisitions - FTK, Encase, SMART with Tableau hardware write blockers All of our write blockers (hardware and software) are regularly validated to NIST Standards (ask our competition when was the last time they validated any of their write blocks)

Production of forensic image format:

Raw dd Encase E01 SMART Drive images delivered on any media: forensically sound duplicate hard drive, CD, DVD, BLU-RAY includes establishment and preservation - Chain of Custody

Thorough Forensic Investigation: Encase, FTK, SMART, X-Ways and Autopsy

Establish definitive Timeline of Activity Complete Document, Image, IP, PII recovery Password recovery featuring Fast PRTK - DNA distributed network Litigation support - Expert Reporting, Deposition and Testimony

Incident Response with complete Malware & Attack analysis

Complete system recovery and safe return to service

Data Recovery Services:

Email recovery: Windows, Mac and Linux environments Deleted files, directories and partitions restored Data retrieval from crashed / failed hard drive

Mobile Device Forensics

Complete Cell Phone, PDA and GPS imaging and forensic analysis