IT Forensics · Car
Backing up a vehicle with outdated or incompatible diagnostic software
In the case of older vehicle models or rare optional extras, the manufacturer’s diagnostic software required for analysis may be out of date, difficult to obtain or no longer compatible with modern systems.
This point is particularly important when it comes to vehicles, as manufacturers, model types, software versions and the storage and transmission formats used can vary considerably. A conventional petrol or diesel car, a modern electric vehicle and a commercial vehicle fitted with a tachograph cannot be treated according to the same technical approach. The storage location, data format, encryption and connectivity determine which data is accessible and which backup method causes the least disruption.
In such cases, we check whether there are alternative access methods that are compatible with our established tools, and we communicate any existing technical limitations transparently.
Why LanCologne?
LanCologne does not investigate digital traces relating to vehicles according to a blanket standard procedure, but rather on the basis of the specific vehicle type, the available data sources and the evidence at issue. Our staff have decades of experience in information technology and many years of practical experience in IT forensics. We assist companies, solicitors and private individuals, as well as regularly supporting courts and public authorities, in the technical investigation of digital matters.
The investigation is generally carried out on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence is either left unchanged or, where technically unavoidable alterations have been made, these are transparently documented and the evidence is stored in a manner that preserves its integrity.
Our working methods and the tools we use
Our investigation does not begin by launching an analysis programme, but by gathering evidence. The vehicle, its on-board systems, its visible condition and any connected mobile devices are documented. A decision is then made as to which data sources are accessible and in what order they are to be backed up.
The next step is to define the backup strategy. In doing so, we distinguish between whether data is accessible via removed storage media, via a standard diagnostic interface, or via a mobile device connected to the vehicle. The choice depends not on convenience, but on the vehicle type, data format, availability and the specific issue to be established. Where technically possible, we work in read-only mode; any unavoidable changes to the data’s state are explicitly logged.
The backup created is documented using hash values. The actual analysis is not carried out on the original, but on a working copy or a verified forensic image. This allows searches or specific analysis steps to be carried out without continuously altering the original evidence.
In the event of outdated or incompatible diagnostic software, we explore alternative methods of access using our established tools and clearly document which areas cannot be analysed without the original manufacturer’s software.
For a reader unfamiliar with the subject, one point is particularly important: a forensic programme does not automatically „find" the truth. It reads data structures and interprets them according to known rules. If a new software or system version changes a data format, an automated analysis may produce incomplete or incorrect results. That is why, in the case of crucial findings, we check which file or data structure the result originates from and whether a second technical approach confirms the same findings.
We deliberately do not use any dedicated vehicle data extraction hardware, such as proprietary infotainment or ECU readers. Instead, we analyse storage media, connected mobile devices and common file and database formats using our established forensic tools, in particular Belkasoft X and X-Ways Forensics. Where manufacturer-specific, undocumented ECU or infotainment formats prevent a fully automated analysis, we manually examine the accessible raw data and transparently document any technical limitations, rather than claiming an unsubstantiated finding.
Typical areas of application
This is how the forensic investigation is carried out
The vehicle, its systems and, where applicable, any connected mobile devices are first clearly identified and documented either photographically or in writing. We record the physical and electronic condition in which the vehicle was found. This information may prove crucial later on.
The manufacturer, model, installed systems and their software versions are identified. Only then can it be determined which data is generally accessible and which backup method is appropriate.
The backup process is carried out in such a way that the original state is altered as little as possible. Depending on the circumstances, accessible storage media are read in write-protected mode, connected mobile devices are backed up separately, and available cloud data is captured with the authorised person’s consent. Every step is logged.
Any images or copies created are given unique names, assigned hash values and verified. Analysis and searches are then carried out exclusively on working copies.
Existing data is analysed in a structured manner using our established forensic tools. Where standard software does not fully support a particular format, this is documented rather than being tacitly ignored.
In the case of findings that are particularly relevant to the evidence or unusual, we manually check the raw data, file structures and metadata to rule out any automated misinterpretations.
At the end, we do not merely list what could be gleaned from the data. We explain the technical source on which the findings are based, what conclusions can be drawn, and where the limitations lie.
Why is this area of investigation relevant to forensics?
In the case of older vehicle models or rare optional extras, the manufacturer’s diagnostic software required for analysis may be out of date, difficult to obtain or no longer compatible with modern systems.
The forensic value lies not solely in the volume of data found, but in its origin and reliability. A file name, a timestamp or a log entry can be misleading without context. That is why we document how an artefact may have come into being, what alternative explanations exist and what further evidence supports the findings.
In such cases, we check whether there are alternative access methods that are compatible with our established tools, and we communicate any existing technical limitations transparently.
Particularly in the case of vehicles, attempts to carry out a comprehensive technical analysis may also reach their limits if manufacturers use proprietary, unpublished data formats. A lack of documentation, encrypted memory areas and manufacturer-specific cloud connections highlight why it is so important to carry out a professional backup and to communicate existing limitations transparently before the actual analysis begins. Errors made at this stage cannot always be rectified later on.
Frequently Asked Questions
LanCologne – Vehicle IT Forensics, Cologne
Do you require a professional investigation into „securing a vehicle with outdated or incompatible diagnostic software"? LanCologne supports you in the evidence-secure preservation, multi-stage analysis and traceable documentation of digital traces relating to vehicles. The key here is not to generate as many automatic matches as possible, but to secure technically sound and verifiable evidence.
Related to this topic
- Fahrzeug mit aktiver Cloud-Kopplung forensisch sichern
- Fahrzeug mit mehreren berechtigten Fahrern forensisch sichern
- Fahrzeug im Auslieferungszustand forensisch sichern
- Documenting vehicle searches and physical inspections for forensic purposes – Providing forensic support for systematic physical vehicle searches