Vehicle System Forensics for Crash Reconstruction

Wesley Vandiver collision forensics, inc

Robert Anderson

Biomechanics analysis

August 2017: In the early hours of the morning, several individuals get into an altercation at a bar. The incident moves outside to the streets where an 18-year-old throws a bottle, damaging the side-view mirror of a red Ford Mustang belonging to one of the antagonists. The 18-year-old flees with a companion on a moped. Meanwhile, the Mustang owner, in a rage, pursues them at high speed, until moments later the Mustang crashes into the moped from behind, leaving one rider dead, another severely injured, and a homicide case for detectives to investigate.

There were differing stories from witnesses, gaps in the evidence gathered from closed circuit cameras, forensics from two vehicles and the crime scene itself. All left key questions about precisely what had happened during the chase. Prosecutors and police were pursuing a charge of “death by dangerous driving” instead of murder, based on the initial investigation by the Metropolitan Police Service in London.

But a relatively new source of digital evidence—the data stored inside the vehicle systems —revealed that the driver of the Mustang was accelerating as his car approached and at the precise moment of impact with the moped. Additional data was found on the vehicle systems that showed deliberate actions taken by the driver of the vehicle to harm the riders of the moped, as well as pinpointing the precise route taken from the bar to the location of impact. With this new evidence in hand, the charge was elevated to murder…[1] such as roadway markings, vehicle damage, and recorded data from event data recorders (EDRs). Digital forensics specialists routinely work with digital data from electronic devices, such as cell phones and computers. Digital forensics is the practice of preserving, gathering and presenting evidence from digital devices for the purposes of criminal or civil investigations. [5] Key evidence in the above case included both crash evidence and forensic data recovered from the vehicle’s infotainment and telematics system. Data acquired from these systems as well as others in the vehicle are rapidly growing sources of critical evidence.

Crash investigators routinely acquire and analyze electronic data in their day-to-day investigations. The Crash Data Retrieval (CDR) system brought to market by Vetronix Corporation and subsequently acquired and expanded by Bosch Corporation has, for nearly two decades, been a valuable source of crash data for investigators. Over time, the available data from supported vehicles have grown from obtaining a partial, single-axis crash pulse to modern data that include a number of pre-crash parameters. The availability of EDR data brought crash investigators into the digital forensics world and introduced them to the processes of data acquisition and data analysis.

A new and different source of automotive forensic data has emerged in recent years – infotainment/telematics system data. These data are acquired using the iVe system, developed by Berla Corporation, in Annapolis Maryland. [6] The iVe ecosystem is a collection of tools that consists of a mobile app used for identification and system removal, a hardware kit for data acquisition, and forensic software used for data analysis.

The Metropolitan Police Service in London is one of the most technologically advanced law enforcement agencies in the world. This case required the cooperative efforts of investigators from multiple disciplines and the result was a successful murder prosecution. [2] [3] [4] Crash investigators are generally accustomed to working with evidence

Together, these components allow a user to identify supported systems, access removal instructions for those systems that require removal, establish proper hardware and software connections to the system, acquire available data, conduct analysis of the data, and generate reports.

Vehicle System Forensics is a three-step process – Identify, Acquire, and Analyze.

What types of data can be recorded by a vehicle’s infotainment/telematics systems? These data can be categorized as, 1) Connected Devices, 2) Location Data, and 3) Vehicle Events.

Connected devices can include phones connected to the system, including specific phone identifiers, contacts, and call logs. Other devices can include devices connected to the vehicle via USB, Wi-Fi, or Bluetooth connections.

Location data can include user-inputted destinations, saved locations, and/or tracklogs (breadcrumb trial) detailing a history of everywhere the vehicle has traveled. This information is generally accompanied by date/time stamps and a derived vehicle speed at each track point

Although the frequency at which track points are recorded varies by manufacturer and system, many vehicles are equipped with systems that record the vehicle location at intervals of 1 Hz. Some vehicles are also equipped with systems that not only record the GPS track points at 1 Hz, but also record the reported wheel speed signal from the vehicle’s CAN bus (see figure 9).

Event data can include a broad range of potential recordings, including when and where the vehicle was when devices were connected, gear shift selections were made, doors were opened or closed, etc. Instances of hard braking or acceleration can also be identified. Events associated with location data (GPS coordinates) can be mapped alongside tracklogs (when available) so that the motion of the vehicle along with recorded events can be displayed geographically (see figure 10 and 11).

Obviously, the iVe system can acquire data that often fall outside what is recorded by EDRs. For example, although vehicle speed data can potentially be acquired from both the EDR and the vehicle infotainment/telematics system for the same vehicle, infotainment/telematics system data most commonly are GPS based, so the speed data are coupled with location data, as well as possibly date and time stamps. These track logs can, depending on the source system, include data going back weeks, months, or years. One of the most notable differences between EDR data and infotainment/telematics data is that EDR data is written to memory as a result of an event. Generally speaking, when the rate of change in the acceleration of a vehicle falls within certain parameters, the airbag system is awakened for the purpose of analyzing the event for the potential deployment of safety system devices (e.g., airbags, seat belt pretensioners, etc.). Thus, in CDR data files, we commonly deal with deployment events and non-deployment events, which are defined as events that awakened a system, qualified for recording, but did not result in the deployment of any devices.

The Federal Regulation, Title 49 Transportation, CFR Part 563 – Event Data

Recorders, commonly referred to as Part 563, applies to vehicles manufactured on or after September 1, 2012. [7] For those vehicles intended to be Part 563 compliant, simply awakening the system is not a guarantee that data related to a non-deployment event will be written to memory. Part 563 defines an “event” as, “…a crash or other physical occurrence that causes the trigger threshold to be met or exceeded, or any non-reversible deployable restraint to be deployed, whichever occurs first.” “Trigger threshold” is defined as, “…a change in vehicle velocity, in the longitudinal direction, that equals or exceeds 8 km/h within a 150 ms interval. For vehicles that record “delta-V, lateral,” trigger threshold means a change in vehicle velocity in either the longitudinal or lateral direction that equals or exceeds 8 km/h within a 150 ms interval.” Most manufacturers supported by the Bosch CDR system have adopted the upper bound of this definition, 8 km/h in 150 ms, as their threshold for recording a non-deployment event.

Therefore, many low-speed collisions and low delta-V collisions, (e.g., automobiles versus pedestrians and bicyclists) do not result in the recording of EDR data. Infotainment/ telematics system data are not crash initiated or related to any trigger other than the vehicle motion and occurrences of the events themselves.

While certain EDR data can be “locked,” preventing the overwriting of that data, vehicle infotainment/telematics data is not locked and its life in memory is dependent upon the specific system. Although certain systems support physical acquisitions that can recover some data that has been deleted and resides in unallocated space, this is not true of all systems. Therefore, if a vehicle under investigation continues to be operated after the incident in question, the acquisition of infotainment/telematics data should be given consideration in the early stages of an investigation.

Vehicle Systems data can serve as valuable evidence in nearly any investigation involving an automobile. This is certainly true in cases involving the investigation of a crash. Whether the investigator is searching for vehicle motion data, such as location and speed, or device data, such as phone calls and/or texting, such data may recorded in the vehicle, and if so, is now able to be acquired.

References

[1] LeMere, Ben and Bollö, Joel, Vehicle Forensics, A Rapidly Growing Source of Critical Digital Evidence, Evidence Technology Magazine, Winter 2018

[2] Ford Mustang Driver Jailed for Revenge Crash Murder, BBC News, May 4, 2018, https://www.bbc.com/ news/uk-england-london-44004012

[3] Mustang Owner Drove at and Killed Teenager After Bottle Thrown at his Prized Car, The Telegraph, May 4, 2018

[4] Sharman, Jon, Driver Chased Moped Rider After Wing Mirror Broken, Ran Him Down the Beat Him as He Lay Dying, Independent, May 2, 2018

[5] Cheah, Madeline, The Need for Digital Forensics in the Automotive World, Automotive Testing Technology International, March 26, 2019

[6] https://berla.co/

[7] https://www.govinfo.gov/content/pkg/CFR-2011-title49-vol6/pdf/CFR-2011-title49-vol6-part563.pdf