Digital Data Extraction for Vehicles Forensic

Investigation
Corey Stathers Musa Muhammad Adebamigbe Fasanmade
Cyber Technology Institute Cyber Technology Institute Cyber Technology Institute
De Montfort University De Montfort University De Montfort University
Leicester , UK Leicester, UK Leicester, UK
corey.stathers@googlemail.com musa.muhammad@dmu.ac.uk alex.fasanmade@dmu.ac.uk

Ali Al-Bayatti Jarrad Morden Mhd Saeed Sharif

Cyber Technology Institute Cyber Technology Institute School of Architecture, Computing and
De Montfort University De Montfort University Engineering, UEL
Leicester, UK Leicester, UK London, E16 2RD, UK.
alihmohd@dmu.ac.uk jarrad.n.morden@gmail.com s.sharif@uel.ac.uk

Abstract - In a criminal investigation, vehicles are quality of life, moving commodities, and travelling across long
quickly becoming another crucial source of digital distances for vacations, work, and other reasons. The main
evidence. When a car is involved in a criminal offensive contribution of this paper provide three solutions as follows:
such as road traffic accidents, drunk driving even a  A cost-Effective way off extracting data from a vehicle
robbery or a terrorist attack, investigators typically focus  Extracting data from a vehicle using basic techniques
 A detailed description of data produced by 3 components
on the capture of DNA, fingerprints, and other non-digital
within a vehicle
identifying materials. (e.g. calls, contacts, messages,
pictures, videos and even web history). This paper is to
II. LITERATURE REVIEW
present our findings undertaken on a 2008 Mitsubishi colt
A. Computer Systems within vehicles
with non-factory fitted equipment which in the 2000s
many drivers wanted extra comfort while driving to their There are several devices in vehicles that assist with everything from
own music and even connect the mobile device to their traditional driving to driver pleasure, yet they are all admissible as
vehicles to call others. By using Mobile forensic evidence. There are computers that operate in conjunction with the
engine to maximize efficiency, allowing the engine to create the
techniques and On-board Diagnostics (OBD) software to
maximum amount of power necessary to move the car along the
read the vehicles engine status we can show what data is road. and then there's the entertainment system, which includes a
stored within a vehicle and if there is enough to support a radio and tablets integrated into the headrests' backs. Additionally,
case. This Investigation involves a Maxtek Dashboard airbags, E-call, and factory assistance are included (in some cars).
camera, Ankeway Head unit, the ECU within the vehicle Many of these devices are volatile, which means that if the power to
and a Samsung galaxy Android tablet. the device is cut off, no data can be retrieved from it. Finally, the
insurance companies put black-boxes for their behaviours, including
Keywords – Data extraction: Android device; ECU Data; built-in GPS monitoring, on automobiles most of new drivers as well
OBDII port; XRY; XAMN; Autopsy; Hacking; Smart Cities; as any other car. A comparable system called digital tachograph used
Smart Devices; Dashboard Camera by lorries and heavy machines requires drivers/operators to scan the
machine card to start the engine and to give the machine the name
I. INTRODUCTION to establish if the operator is permitted to use the equipment.
The procedure of locating evidence within vehicles, often known as
automotive, has advanced significantly over the years, from swiping A.i. Engine Computers
prints or scanning through number plates. Prosecuting lawbreakers Engine control units (ECU) are chips used by the computers in the
has gone from being a simple forensic investigation to a highly vehicle to make the car work. The car's nervous system is a computer
complex one due to technological advancements [1]. Additionally, system called the controller area network (CAN bus), which
as automobiles become more technologically advanced, digital connects all the sensors to many ECUs installed in a vehicle. The
investigators must be more versatile in their approach to locating system can send up to 10 megabits per second to each network node.
evidence within the vehicles. Vehicles now and in the future, as The ECUs are the nodes, and current cars can have up to 70 ECUs.
autonomous vehicles become more popular, provide a wealth of CAN buses are straightforward, inexpensive, completely centralised
value in digital investigative evidence. It is estimated that 1.35 (one point of entry), extremely durable, and efficient.
million people are predicted to die each year as a result of traffic Cloud computing and the advent of the internet of things/vehicles in
collisions as the number of cars on the road increases [2]. I.5 million the future will necessitate the adaptation of CAN buses (IoV). 
vehicles were recalled in 2015 owing to cybersecurity issues. The These nodes will be able to communicate with traffic lights, smart
same year, a Jeep was involved with an accident after its engine was highways, and smart cities in addition to the cars in which they are
remotely deactivated while the driver was stuck in traffic. [3]. installed; certain cars are equipped with E-call, an emergency call
Vehicle forensics is a new forensic technique that police system that broadcasts information about accidents. 
investigators are increasingly adopting, as vehicles can reveal Following that, the crash data recorder will save the information
roughly as much information as a smartphone [4]. (CDR). These CAN-buses are a critical component of the
automotive industry's next step toward autonomous driving. 
When we think of the internet of things, we think of smartphones, Automobiles, buses, trucks, and heavy gear such as cranes all
cameras, televisions, smartwatches, gaming consoles, and contain these networks.  
amazon/google speakers, but not of vehicles.
Vehicles are a critical component of the Internet of Things and of A.ii. Driver Entertainment Computers
smart city planning. Vehicles are used in the public and
transportation sectors for a variety of purposes, including improving
Cars have had basic entertainment such as radios in them since the the properties of multi-protocol in order to produce readable logs.
1930s, However, it was not until the 2000s when factory-installed The Tamper Resistant Packaging Topology is used to prevent
Bluetooth and GPS navigation became common. This was a forensics support on the network during a criminal investigation.
significant advancement for the automobile industry and digital The concept is that unattended roadside devices are placed on the
investigators, as these devices included data that may aid in case side of the road, but these devices are equipped with anti-tamper
resolution. The hard discs in these stereos were used to store GPS packaging to prevent cyber-attacks [9].
data and contacts. Newer head units save data such as music,
contacts, home addresses, last visited destination, photographs, E. Critical Analysis
movies, and bank account information on the cloud (particularly for
Android-based head units), and use Bluetooth to link individuals [6].   We have covered the basics of what digital forensics is and what it
entails in this Review. Many of the sources we have looked at have
done and stated similar things. If we have a firm grasp on the
B. Recovering Data of Head Units
fundamental concept of the Internet of Vehicles, whether it is smart
To extract data from head units, you can use a device called a Jtag, cities or a simple case study documenting what they did to get the
which attaches to the circuit board of the head unit and hardware out and what they wanted out of it, we can build a report
communicates to a computer through USB. The Jtag can be used in on the subject. Many of these sources make reference to the internet
a method called chip off, in which the memory chip is removed and of vehicles and smart cities, which is crucial given that everything is
placed on a circuit board designed to power and extract data from it. connected, from the road to the car, via traffic signals, to the cities
The Jtag is desirable because it preserves the unit, however itself. Everything, from vehicles that are connected to one another to
removing and replacing the chip may cause the chip to fail. Some cars that are connected to infrastructure. The proposed Trust IOV in
boards come with pre-installed jtags; however, you may need to [9] goes into great detail regarding how the system works and how
solder cables to the jtags, and you will need to use a Jtagulator to attackers can get access to infrastructures and systems in order to
discover the proper connectors. install malicious code and view data that is not intended to be
viewed. On the other hand, the Smart vehicle forensic case study
C. On-Board-Diagnostic (OBD) employs a more physical approach to locating data on the vehicle's
system [1]. To summarise, our initial thoughts on the subject of
On-Board-Diagnostics (OBD) ports are classified as either OBD or 'Digital Vehicle Forensics' are that it is becoming a much more
OBD-ll. OBD-ll is now a standard since the port's initial purpose necessary topic than it was previously, and that the subject is
was to manage the electronic fuel injection system. However, becoming increasingly desired as more vehicles incorporate more
because nothing happens when the engine is turned off, it now technology, and that it is critical that we are prepared for when it is
provides information about the vehicle when it is working. Cars with required. Is it better to have an older car with no trace of connectivity
carburetors (abbreviated as 'Carb') did not require OBD because it if you prefer privacy. However, without technology, you are
was all mechanical, but electronic fuel injection requires the use of regressing, as all of this technology exists to aid in the system's
a system to regulate the combustion process in the engine. These progress while also making our lives more efficient and convenient.
ports are positioned on the driver's side of the vehicle, directly
beneath the driver's steering wheel. These are a standardised system
that enables external devices to communicate with vehicles in order III. EXPERIMENTAL DESIGN
to diagnose issues, reprogram ECUs, and unlock the vehicle's
This project was accomplished using software with which the author
performance by altering the air and fuel mixture in order to increase
was unfamiliar. GUYMAGER, OBD auto doctor, and EOBD-Facile
speed while also increasing the amount of power produced by the
are among the software included. On the contrary, the author has
engine. Certain manufacturers are even developing dongles that
previously utilised VirtualBox, Kali, XRY, XAMN, and Autopsy,
convert the OBDll port to a wireless port [6].
all of which were chosen based on the author's prior expertise with
D. The Framework of the Internet of Vehicles other applications and operating systems. Finding software capable
of creating images of the dashboard camera and the head unit was
The internet of things, big data systems, and a variety of sensors are critical. The initial goal was to use the FTK imager, but due to a lack
all used to fuel a smart city. Automated Vehicles intercommunicate of access to this software, an alternate was needed. Kali Linux is a
with city towers with data processed to make smart decisions. The Linux distribution that is specifically designed for digital forensics
goal of 'Smart' technology is to create something that is dependable and penetration testing, as discovered through studying. Kali Linux
and solves problems. When we talk about smart cities, which are comes with digital forensics tools preconfigured, which was just
smart places that employ technology to provide services and address what was needed for this investigation. The Kali Linux version used
problems in real time, whether it's traffic or waste reduction. was 2020.4, which was the most recent version at the time this
However, we will only look at the Vehicles and Technology side of investigation began. VirtualBox version 6.0.24 was used to generate
things [7]. For example, connected vehicles, often known as smart the virtual machine, which was then used to produce an image of the
vehicles, are employed by the vehicle to vehicles (V2V) and the devices. On Kali Linux, the imaging software was GUYMAGER
vehicle to infrastructure (V2I) networks (V2I). V2V communication version 0.8.12. Due to the multi-threaded pipeline design and data
delivers data wirelessly between vehicles, whereas vehicle to compression, this software is extremely fast and has a very user-
infrastructure communication sends data from the vehicle to the friendly interface.
environment around it, such as traffic lights, sensors, parking
allocation, remote diagnostics, and telematics. The V2I Autopsy version 4.17.0 was used to analyse the image obtained by
communicates using an ad hoc network and powerful management GUYMAGER. The initial plan was to finish the imaging and
technologies. V2V, on the other hand, communicates through analysis on the Kali virtual system, but the.dd file was rejected by
vehicle networks [8]. Dynamic networks, multi-protocol the Linux version of Autopsy. By creating a shared file on the host
networking, and tamper-resistant packaging are the three types of machine, the image file from the dashboard camera was sent to the
network topologies. main machine, which is a Windows machine. The autopsy software
on Windows can then be used to investigate GUYMAGER's.dd file.
Dynamic Network Topology refers to the fact that a vehicle can join It was possible to do a car analysis via the OBD port, by utilizing the
or exit the network at any moment and from any location. When applications OBD auto doctor and EOBD-Facile. This necessitated
people join or depart a network, it becomes dynamic. Unfortunately, the use of both hardware and software. This inquiry necessitated the
digital forensic technologies are not built to manage such changes in purchase of an OBDII to USB converter. The EOBD-facile
order to examine them. Multi-Protocol Networking is a term that programmed was initially ran, but it was incompatible with the car
refers to autos communicating over an ad hoc network using non-IP because there were only a limited number of profiles from which to
protocols. They could also be connected to the cloud via the IP choose, and the car was not one of them. This programmed, on the
networking protocol at the same time. It is tough for digital other hand, can mimic what the EOBD-facile displays when a
investigators to discover a means to take into considerations all of vehicle is attached. The next step was to switch to Auto Doctor,
which provided more promising outcomes. Because this The OBD-II port is located underneath the steering wheel on the
programmed was simply an evaluation version, OBD auto doctor driver's side; there is a trim panel covering it that can be removed
was not the best option. However, this meant it was still possible to for easy access. Every vehicle has a separate location for this port.
use the software for certain activities, but not to its full capabilities. Some are in the glove box on the passenger's side, but finding the
For the purposes of this project, this was acceptable. Using XRY port is simple if you consult the vehicle's user handbook or go
version 9.3, an image of the device was produced. It was then used online. In this case, the panel was held in place by two fasteners
in conjunction with XAMN version 5.3 to inspect the images underneath the steering wheel, adjacent to the driver's left knee.
created. The reason for using this software over free software is that After locating the OBD port, the software OBD auto doctor was used
it is readily available. The experiment also adhered to the to establish a profile for the vehicle. Some vehicles are listed in the
Association of Chief Police Officers' (ACPO) principles. software database, but this one was not. The car was fitted with a
generic Mitsubishi profile that was then tweaked to fit the vehicle.
V. ACPO Guidelines The next stage was to get the vehicle to communicate with the laptop
after building a profile. The OBD adapter was plugged into the
When digital evidence is to be utilised in court, it must be handled laptop and the automobile, and the programme took care of the rest.
with the utmost care and attention, as defined by the ACPO. The When the software recognises the vehicle, it displays a message
primary criterion is to prevent modifying data, which can be indicating that it is a new vehicle, and after you click OK, the
accomplished by the use of a write blocker. Due to the fact that software will automatically configure for a new car. After this stage
generating an image of the device includes working with a duplicate is complete, the analysis can begin.
rather than the original, the dashboard camera can be considered
under the first rule. In legal practise, a write blocker would be B. Dashboard Camera
utilised; unfortunately, this resource could not be secured, hence a
write blocker was not conceivable. Other pieces of evidence, on the By constructing a virtual computer on Kali Linux, an environment
other hand, must be handled in accordance with the second guideline was created for the creation of a DD images of the dashboard
due to data changes and the fact that imaging android devices camera. By connecting the dashboard camera to the desktop and then
requires the device to be turned on, which modifies the device's transmitting the camera's signal directly to the virtual machine. The
metadata. The third rule is to maintain an audit trail and to evidence virtual machine did not see the dashboard initially because Windows
everything you do. This proves that the evidence was properly would have noticed it first, but by informing the virtual machine that
handled and who had it at the appropriate time. Concurrent notes the device need investigation by kali, it observed it immediately.
were created for all devices, including the head unit, the ECU port, While the camera was imaging, a case was constructed using the
and the dashboard camera. Only the chain of custody paperwork for
Linux version of Autopsy, and once the evidence was added, it
the head unit and dashboard camera were prepared, as the OBDII
became a waiting game until GUYMAGER completed the imaging
port gathers live data and so is not evidence. One way around this is
to complete a vehicle seizure form that would be used in practise.   process. After the second imaging operation was done, the file was
added to Autopsy. The image file was then moved to the shared drive
of the virtual machine, which is also connected to the host.
VI. COLLECTING THE EVIDENCE
Following that, the evidence was imported into Autopsy's Windows
The most critical element of an investigation is gathering evidence, version, which accepted the same file as the Linux version did.  
as one false step could result in the case being dismissed in court due
to faulty evidence. Following the ACPO guidelines is critical for a C. Stereo/ Head Unit
successful inquiry, as previously stated. There have been The android head unit was the most essential piece of evidence in
complications that were beyond our control during this this car for this endeavour. These head units feature Bluetooth
project/investigation; yet, the evidence taken from the vehicle was connectivity and pair with the user's or driver's smartphone. They
legally obtained because the vehicle is in the author's ownership. offer GPS, music, previous locations, home addresses, videos, and
Data could be retrieved from two of the three targeted evidence photographs, in addition to the standard features of a tablet or phone.
sources. While the dashboard camera and ECU OBDII port gave This type of evidence is critical to an investigation, and this one
data, the android stereo head unit was unable to communicate with made extensive use of it. Because prior research suggested that it
a laptop. This may be because the USB A cable connecting the PC was doable and we had previously achieved it, the objective was to
to the head unit cable was damaged (this cable was purchased utilise the same programme that photographed the dashboard camera
specifically for this project), the type of software used to extract data to scan the head unit. With this in mind, we began the process of
from the device is incorrect, or the USB A extension cable retrieving data from this device.  
connecting the head unit to the USBA on the computer was
damaged.
The first step was to confirm that the gadget was in developer mode,
which by default enables USB debugging and enables the user to
A. Vehicle ECU Port tailor the device to their exact requirements. Developer mode is
The memory capacity of automotive ECUs is limited; they can only accessed by repeatedly touching on the build number. To locate the
store fault codes. This means that if you're driving down the road build number, navigate to settings -> about device (for this device,
and a light comes on your dashboard, you'll be able to see a fault about vehicular platform) -> build number. The device was then
code via the OBDII connector. This data is volatile because it can linked by USB A to a laptop. The virtual machine was then used in
only be extracted from the ECU when the car is running or ignition. the same manner as the dashcam was previously. 
My 2009 Mitsubishi Colt, which can be seen in the image below in The dashcam was immediately visible on GUYMAGER, but not the
figure 1, head unit. After testing all connections, the head unit would not
connect to the laptop. A study was conducted on the use of ADB
tools. ADB tools enable a developer to connect to and modify a
device remotely, either wired or wirelessly. These utilities were
installed and then executed. When all of the procedures are finished,
the device should appear in the ADB devices list; but, after
numerous attempts, the laptop was unable to locate the head unit.  

VII. EVALUATION ANALYSIS & RESULTS

A. Dashboard Camera
To begin examining this device, it was determined that it records in
Figure 1: Mitsubishi colt used in the research.
5-minute intervals. The files then self-destruct. Due to the device's
self-erasing nature, it was expected to detect only one or two deleted be saved using the free version of the software, screenshots had to
files, if any at all. However, upon closer inquiry, it was discovered be taken at various points within the journey. Some areas included
that this was not the case. After the data was sorted by the software, the vehicle exceeding 30 miles per hour. A strong uphill hill start
the file types were reviewed to determine if anything other than was also included. The vehicle was halted for a while to see how the
videos were identified during the imaging process. Autopsy can car reacts being stationary for a while after driving. The analysis of
offer a summary perspective of the investigation's origins. This the graphs at 2 points of the journey will be examined in further
device has five videos, as well as 66 additional unknown files, as depth.
seen below. A pie chart can be used to illustrate the size distribution
of file types on the storage medium.  Stopping at a traffic lights as well as normal driving is included in
  graph below. The graph illustrates that the engine coolant
Due to the fact that this is a dashboard camera and not a standard temperature stays around 188°F after the vehicle has been running
camera, its principal function is to continuously record, which means for a while. Unless the engine is stressed, once a vehicle reaches
that no images will be discovered on this gadget. The software operating temperature, it usually stays there. Deflated tyres,
identifies only five readable videos, with the remainder being erased travelling up a hill, varied road textures, the weight of the vehicle,
or overwritten. Further analysis revealed that the five videos and if it is towing something could all cause stress on the engine.
discovered had been reduced to three, with the last two files The graph also indicates that as the vehicle's revs rise, so does its
(_ME00084.mov and _ME00056.mov) unable to be viewed. WKA speed, and that as the vehicle's rpm fall, so does its speed. The revs
and EME are the two sorts of files. EME stands for Encrypted Media drop rapidly from 1800 RPM to 700 RPM as the graph reaches 22
Extension and WKA is for Weak Key Authentication. The seconds. When the vehicle's clutch is disengaged, something occurs.
software's videos can be viewed on any video player. The videos can The vehicle's engine then resumes its idle state. Although the vehicle
be viewed using the built-in Windows Films and TV Player will not stop without breaking, you can see that it is slowing down
software. The device has 56 erased files on it. This is due to the fact steadily due to friction.
that the ‘deleted' files are not actually removed. This informs the
device that the space used by the file in the storage can be freed and
used to store other data by previous education this makes perfect
sense. This does not always work because the camera will pop up
while driving to format the memory, which is inconvenient, and if
an accident occurs, the camera's evidence will be lost. The software
displays the hash values of files, their position on the storage device
when they were last edited, as well as the file type and size. The
range of sizes is 0 to 660751759. The image below depicts how this
appears during autopsy. There was also unallocated space on the
device. This is empty space that cannot be written to because it does Figure 3: OBD-Auto Doctor graph reading while driving normally
not have a partition. In other terms, it is a place in an operating On the map above, point 6 shows the vehicle's appearance after
system that does not exist. The entire storage capacity is 2.13GB (2 completing a difficult junction leading to a hill start and then
decimal places). Three unallocated spaces are shown in the diagram completing it. Figure 4 shows a graph that demonstrates how the
below. While looking over the subheadings, it's worth noting that vehicle speed lowers when the clutch is disengaged, and because we
there were 18 email addresses, which seems excessive for a camera were on a hill, the revs and speed were steeper than on a flat road or
that has no connection to the internet. A search of these putative a gentler slope. The car shifts gear from 23 seconds to 1 second, as
email addresses revealed that they were actually random strings, not shown by a brief break in revs.
email addresses. Autopsy searches for email addresses using the '@'
symbol.

B. Vehicle ECU Port

After establishing the investigation for the ECU port, a second party
drove the vehicle to acquire readings from it. Due to the vehicle's
limited number of digital gadgets, it was thought that little data
would be recorded; yet, it's fascinating to see what the programme
revealed. 
Figure 4: OBD-Auto Doctor graph reading while completing a hill start
The study began with the ignition switched on in order to observe From this ECU analysis, we can see that the software continuously
the car's idle behaviour. The graph below illustrates the vehicle's idle displays the vehicle's speed, engine temperature, and the
appearance. The purple line indicates the vehicle's speed is zero temperature of the air being sucked into the engine. If the full licence
miles per hour (stationary), the blue line indicates the engine coolant for the software had been obtained, the oxygen and fuel mixture
temperature is approximately 186–190°F, the red line indicates the
could also have been plotted on the graph.  
air intake temperature is approximately 83–86°F, and the green line
indicates the engine RPM (Revolutions Per Minute).   C. Concept of analysis against the android device
Due of the difficulty of obtaining software and connecting the head
unit to the laptop, this component of the inquiry was deemed to be a
concept. Following some research and watching movies on the
internet, it was revealed that an android tablet resembles an android
stereo head unit quite a bit. This created an image of a tablet running
the XRY software. The tablet, which was empty of data, was
provided by the De Montfort University(DMU) cybersecurity
centre. Before the inquiry began, the tablet was used to simulate a
head unit in a vehicle. The inquiry would begin with this
configuration, which included watching YouTube videos and use
Figure 2: OBD-Auto Doctor map reading when the vehicle is idle Google Maps.

A path was planned for the investigation that included pausing at C.I. Imaging
traffic lights, going above 30 mph, hill starts, stopping for a while, Using the XRY programme, an image of a Samsung GT-P5100
and then returning to where we started. Because the graph could not running Android 4.2.2 was produced (version 9.1.2). A profile for
this specific tablet was used to extract the image. However, because VIII. EVALUATION AND COMPARISON
the software did not produce the desired findings, the process was
repeated, this time using a generic android profile, and the data As stated earlier, the idea of digital vehicle forensics is becoming
required for this stage of the inquiry was obtained. To be able to increasingly needed due to all the data and evidence which is
image the tablet, the debugging option had to be turned on. On this available from newer vehicles. While researching this project we
device, searching for the build number is similar to searching for it came across an article called ‘Smart vehicle forensics’ by Nhien-An
on the head unit. The developer mode is activated by repeatedly Le-Khac, Daniel Jacobs, John Nijhoff, Karsten Bertens, Kim-
tapping the build number of the device seven times in the about Kwang Raymond Choo. [1] This paper excellently discussed
device settings. The developer menu becomes visible after this step challenges with vehicle data forensics which this paper was
is completed, USB debugging can then be enabled published in June 2018. Their idea of Digital vehicle forensics was
a very hands-on approach where they removed devices from the
After imaging the device, the XRY file can be analysed with the vehicle such as the head unit and they themselves approached some
XAMN application, which organises the evidence in subviews and challenges like we did. However, they took the investigation more
categories such as Autopsy. As previously stated, the head unit physically to resolve an issue by removing the memory chip as they
shares a significant amount of capability with a tablet. The Android could not find a JTAG. This is a very destructive test and the goal is
head unit is capable of streaming videos from YouTube, Netflix, and to find an evasive way off extracting data from such devices. Their
Spotify, as well as receiving Bluetooth photographs and, under approach was also costly as researching online, Jtagulator are
certain circumstances, snapping images (if you had an extra camera roughly between £190 - £420. At the start of this investigation, we
fitted). The tablet from which the photograph was taken had been as a team wanted to create an approach which was less evasive and
factory reset. The day before the study, a path around Leicester city cost effective but reach the same or even better results. We only had
centre was created using the tablet in the typical manner to replicate the chance to retrieve only 3 devices however our techniques were
the head unit of a vehicle. Despite the fact that the trail did not cost effective and less damaging to the vehicle.
directly follow highways, it provided a good overview of the area.
The generic information retrieved using the XRY software was IX. CONCLUSION
examined initially. In the subview general information, the
The vehicle used in this project is almost ten years old and equipped
manufacturer of the device and the international mobile equipment
identity (IMEI) number are presented. A sim card slot was present with aftermarket parts. Thus, if this analysis were done on a newer,
on this gadget, but it was not used for this inquiry. If a SIM card is higher-specified car, there is reason to believe that further data may
utilised, however, the software will be able to access call logs and be collected. This experiment demonstrated evidence gathered from
texts. The device's serial number and random strings are also one vehicle out of 35,168,259 registered in the United Kingdom.
displayed in the subview.   Each vehicle may have fewer or more data available for extraction.
[10]. What we have found is on the right track, however, a to get a
The investigation then turned to the accounts that this device used. more accurate understanding a larger number off vehicle is needed
To download specific apps from the Google Play Store, you must to further back up our theory.
first create an account. You must also log into these apps before you
can use them. This device has a dedicated account for this project, From this investigation it can be clearly state that a vehicle contains,
which can be found at dmucybercenter@gmail.com. The next step videos off the driving from the dashboard camera and how the
was to examine the images on the gadget. Photos can be seen in a dashboard camera deals with running out of storage by overwriting
different window in the XAMN viewer. 35495 images, including already made video files in the form off EME and WKA files. The
icons and images, were discovered by the software. The image Vehicle head unit compared to the tablet shows that just as much
below is a photo taken from a window at a cyber security lab on the data can be found on a head unit as a mobile. With data such Geo-
fifth floor of Gateway House, overlooking a piece of the DMU location, contacts, website history, videos, music, photos, device
campus. Additionally, the software extracted and analysed the logs and general information about the device as well as accounts on
device's web history. This may be deemed critical evidence in a the device. Finally, the ECU, the software which was used for this
court of law because it provides investigators with the information investigation shows the correlation of revs and speed. When the
necessary to conduct and organise their investigation. Additionally, engine has been running for periods of time, we can see that the
investigators will be able to determine which networks the gadget is engine becomes warmer and the temperature off the engine coolant.
connected to. This evidence may be used to establish a suspect's This project has been a success of finding a less evasive way of
connection to a crime. The device used to connect to DMU's guest analysing and investigating a vehicle.
network, as well as another device hotspot dubbed the Honor 20, are
shown below, along with the password used. Additionally, the
device logs events such as system upgrades, system crashes, and
REFERENCES
device resets and reboots; the log file records the type of event, the [1] Le-Khac, N.-A.et al., 2020. Smart Vehicle forensics: Challenges
time, and the date. and case study. Future Generation Computer Systems, pp. 1- 11.
[2] World Health Organization, 2021. Road Traffic Injuries. [Online]
GPS is also included in a head unit with a built-in satnav. This is Available at: https://www.who.int/news-room/fact-
another important piece of evidence since it can reveal if the sheets/detail/road-traffic-injuries
vehicle/device was at a specific location. This information is not [Accessed 05 March 2021].
entirely accurate, but it provides a fair ballpark estimate. A more [3] Team, T. R. N., 2017. Smart Vehicles Are Vulnerable to Hacking.
accurate reading can be obtained if Google Maps and the device are [Online]
both fully updated with new GPS location tracking. This experiment Available at: https://www.danielrrosen.com/beware-of-hackers-
demonstrates that a device's position can be determined. The device in-your-car-system/
can be seen in the image below locating Morrisons Supermarket in [Accessed 05 March 2021].
Leicester. To determine the location, the software uses latitude and [4] Chen, C., 2021. privateinternetaccess. [Online]
longitude to pinpoint a location but again it’s not as accurate as it Available at: https://www.privateinternetaccess.com/blog/police-
are-increasingly-using-digital-vehicle-forensics-to-solve-cases/
could be due to it being an outdated device. Finally, this tablet, like
[Accessed 05 March 2021].
all Android devices, can save music and audio files. Figure 28
[5] Laukkonen, J., 2020. Lifewire - A breif history on the car radio.
illustrates when the audio file was updated and added, the file's size,
[Online]
the location of the file via the path, and the file's hash value. This Available at: https://www.lifewire.com/brief-history-of-the-car-
audio view contains music, voice notes, ring tones, and the following radio-534718
file types: mp3, Wav, and Ogg. Ogg is a file format similar to MP3 [Accessed 05 November 2020].
but with additional compression.
[6] Edelstein, S., 2020. Digital Trends. [Online] [26] İbrahim Gülataş, S. B., 2018. DOAJ. [Online]
Available at: https://www.digitaltrends.com/cars/everything- Available at: http://dergipark.gov.tr/jnse
you-need-to-know-about-obd-obdii/ [Accessed February 2021].
[Accessed 05 November 2020]. [27] Johnson, J., 2014. On the Digital Forensics of Heavy Truck
[7] Bismart, 2019. Bismart. [Online] Electronic Control Modules. SAE International journal of
Available at: https://blog.bismart.com/en/what-is-a-smart-city commercial vehicles , 7(1), pp. 72-88 .
[Accessed November 06 2020]. [28] Kopencova, D. & Rak, R., 2020. IEEE Xplore. [Online]
[8] HereMobility, 2020. HereMobility. [Online] Available at: https://ieeexplore-ieee-
Available at: https://mobility.here.com/learn/smart-city- org.proxy.library.dmu.ac.uk/document/9293516
mobility/smart-city-car-connected-intelligent-integrated [Accessed February 2021].
[Accessed 06 November 2020]. [29] Lohrum, M., 2014. Free Android Forensics. [Online]
[9] Hossain, M., Hasan, R. & Zawoad, S., Unknown. Trust-IoV: A Available at:
Trustworthy Forensic Investigation Framework for the Internet http://freeandroidforensics.blogspot.com/2014/08/live-imaging-
of Vehicles (IoV), Alabama: -. android-device.html
[10] Pollard, T., 2020. carmagazine. [Online] [Accessed February 2021].
Available at: https://www.carmagazine.co.uk/car- [30] nidirect, 2021. nidirect. [Online]
news/motoring-issues/2020/how-many-cars-are-there-in-the- Available at: https://www.nidirect.gov.uk/articles/police-
uk/#:~:text=It%20might%20be%20a%20fiendishly,1.0%25%20 procedures
on%20the%20previous%20year. [Accessed 24 April 2021].
[Accessed 19 April 2021]. [31] Source Forge, 2021. GuyMager. [Online]
[11] 3EF, 2021. 3EF. [Online] Available at: https://guymager.sourceforge.io/
Available at: https://www.3ef.co.uk/contact.html [Accessed February 2021].
[Accessed February 2021]. [32] Encase Forensic, 2018. User guide. -: Guidance Software.
[12] Alexakos, C. et al., 2021. ScienceDirect. Enabling Digital
Forensics Readiness for Internet of Vehicles, 52(-), pp. 339-346. [33] Feng, X., Dawam, E. S. & Amin, S., 2020. A New Digital
[13] Andriod Studio, 2021. Developers. [Online] Forensics Model of Smart City. -, pp. 1 – 6
Available at: https://developer.android.com/studio/run/device
[Accessed February 2021]. [34] Forensic Science Investigations Ltd, 2017. 3EF. [Online]
[14] Android Studio, 2020. Developers. [Online] Available at: https://www.3ef.co.uk/vehicle-data-forensics.html
Available at: [Accessed 05 November 2020].
https://developer.android.com/studio/intro/update#sdk-manager
[35] Larson, U. E. & Nilsson, D. K., 2008. Securing Vehicles against
[Accessed February 2021].
Cyber Attacks. Tennessee, Unknown.
[15] Android Studio, 2021. Developers. [Online]
Available at: https://developer.android.com/studio/command- [36] Nelson, B., Phillips, A. & Steuart, C., 2010. Guide to Computer
line/adb Forensics and Investigations. Boston: Course Technology.
[Accessed Febuary 2021].
[16] Athena Foreniscs, 2021. athenaforensics. [Online] [37] Nilsson, D. K. & Larson, U. E., 2008. A Roadmap for securing
Available at: https://athenaforensics.co.uk/acpo-guidelines-for- Vehicles against Cyber Attacks, Synopsys: Research Gate. 
computer-forensics/
[Accessed 24 April 2021].
[17] BD, P., 2020. HOW TO INSTALL ADB ON KALI LINUX 2020
[EASY STEPS] (Youtube). [Online]
Available at:
https://www.youtube.com/watch?v=IsQXyFHNGl0&list=PL0b
Pw2tC4JsaDoYZ1glfYsHP2Fme0Wyz8
[Accessed February 2021].
[19] Computer Security Student, Unknown. Lime Forensics. [Online]
Available at:
https://www.computersecuritystudent.com/FORENSICS/LIME/l
esson1/index.html
[Accessed February 2021].
[20] CPS, 2019. Road Traffic: Mobile phones. [Online]
Available at: https://www.cps.gov.uk/legal-guidance/road-
traffic-mobile-phones
[Accessed 25 April 2021].
[21] Daily, J. S., 2019. ACM Digital Library. [Online]
Available at: https://dl-acm-
org.proxy.library.dmu.ac.uk/doi/10.1145/3309171.3309181
[Accessed February 2021].
[22] DFIR.Science, 2016. Youtube. [Online]
Available at:
https://www.youtube.com/watch?v=mqHx7HutQLo
[Accessed 3 February 2021].
[23] Digital Forensics, 2021. Digital Forensics Corp. [Online]
Available at: https://www.digitalforensics.com/blog/how-to-
make-the-forensic-image-of-the-hard-drive/
[Accessed 29 January 2021].
[24] DIGITPOL, 2021. DIGITPOL. [Online]
Available at: https://digitpol.com/contact-us/
[Accessed February 2021].
[25] IACP, 2021. Law Enforcement Cyber Center. [Online]
Available at:
https://www.iacpcybercenter.org/prosecutors/digital-search-
warrants/
[Accessed 24 April 2021].