Digital Data (digital evidence) stored and recoverable from the Infotainment and Telematics Systems of many modern motor vehicles can be used effectively in civil and criminal investigations on files involving vehicle collision, vehicle theft, vehicle fraud, staged collisions and where vehicles are used during criminal activity.
Infotainment and Telematics Equipment comprise various components, including embedded computer systems that allow the Equipment to function properly. The embedded computer systems will typically have a memory device incorporated into their design. The memory device can be in the format of a NAND memory chip, NOR memory chip, EMMC memory chip, removable Hard Drives, or other type of memory device.
Data stored on the memory device can be acquired and analyzed using either the BERLA iVe vehicle forensic toolkit (preferred method if a vehicle is supported) or using advanced forensic data recovery techniques and methods depending on the design of the embedded computer system.
Challenges that exist when attempting to recover digital data from new Infotainment systems:
- Non-BERLA supported Infotainment Systems are assessed on a case-by-case basis due to the many hardware and software unknowns that can exist prior to starting the forensic process.
- The internal components are often unknown in advance and a data recovery strategy can often only be created once the Infotainment System has been removed from the vehicle, disassembled and the target memory device has been identified and assessed for data recovery potential.
- The data structure and/or operating system can often be unknown in advance meaning that the recovered data may be encrypted and/or not always be readily readable using standard digital forensic tools.
- The process is typically destructive to the chipboard of the Infotainment System, although the actual memory chip can always be preserved and retained as evidence. This can mean that the client may need to consider the cost of a replacement Infotainment System.