IT Forensics · Car

Automated versus manual analysis of vehicle data

Vehicle data from infotainment and telematics systems is extracted using specialised software and automatically processed. This is sufficient for many standard enquiries. However, as soon as time stamps, device assignments or rare formats become relevant as evidence, the automatically generated result must be checked against the raw data.

Enquire without obligation

This point is particularly important when it comes to vehicles, as manufacturers, model types, software versions and the storage and transmission formats used can vary considerably. A conventional petrol or diesel car, a modern electric vehicle and a commercial vehicle fitted with a tachograph cannot be treated according to the same technical approach. The storage location, data format, encryption and connectivity determine which data is accessible and which backup method causes the least disruption.

We therefore combine automated analysis steps with manual verification in a targeted manner to ensure both the efficiency and the reliability of the results.

Technical background

Automatic parsers interpret raw data according to known patterns. Problems arise with undocumented firmware versions, differing time bases (vehicle clock, GPS time, system time), multiple paired phones or incomplete data sets. Errors are then not visible, but are hidden within tables that appear plausible.

Relevant evidence and data sources

  • Paired devices (Bluetooth/USB) with scheduled times
  • Call logs, contacts and messages from the smartphone pairing
  • Navigation and location data, journey histories
  • Events such as doors being opened, the ignition being switched on, and gear changes (depending on the model)

Why LanCologne?

LanCologne does not examine digital traces relating to vehicles according to a blanket standard procedure, but rather on the basis of the specific vehicle type, the available data sources and the evidence at issue. Our staff have decades of experience in information technology and many years of practical experience in IT forensics.

Here’s how we do it

  • Automatic evaluation as a starting point.
  • Random and targeted manual checks of entries in the raw data that are relevant to the evidence.
  • Checking the time basis and documenting any discrepancies.

Borders

  • Support for individual vehicle models via analysis tools is limited.
  • Manual checking increases reliability, but also the amount of work involved.

Possible results

  • Confirmed or corrected analysis of entries relevant to the evidence
  • Documented time basis and uncertainties

Typical areas of application

•Judicial and non-judicial expert reports
•Preservation of evidence from vehicles, storage media and connected mobile devices
•Study of different vehicle types and manufacturer platforms
•Investigating accidents, theft and allegations of tampering
•Analysis of driving, media, app and system artefacts
•Reconstruction of travel routes, usage times and access times
•Cross-checking of automated analysis results
•Analysis of deleted, historical or only indirectly visible traces
•Documentation for courts, solicitors, insurance companies, public authorities and businesses

Why is this area of investigation relevant to forensics?

Automated analysis routines enable the efficient processing of large, standardised data sets, but quickly reach their limits when dealing with unusual or proprietary data formats.

The forensic value lies not solely in the volume of data found, but in its origin and reliability. A file name, a timestamp or a log entry can be misleading without context. That is why we document how an artefact may have come into being, what alternative explanations exist and what further evidence supports the findings.

We therefore combine automated analysis steps with manual verification in a targeted manner to ensure both the efficiency and the reliability of the results.

Particularly in the case of vehicles, attempts to carry out a comprehensive technical analysis may also reach their limits if manufacturers use proprietary, unpublished data formats. A lack of documentation, encrypted memory areas and manufacturer-specific cloud connections highlight why it is so important to carry out a professional backup and to communicate existing limitations transparently before the actual analysis begins. Errors made at this stage cannot always be rectified later on.

Frequently Asked Questions

Do you use specialist vehicle forensics hardware such as Berla iVe or Bosch CDR?+
No, we deliberately do not use dedicated vehicle data extraction hardware; instead, we analyse accessible storage media, connected mobile devices and file formats using our established forensic tools. Where proprietary, undocumented ECU formats prevent a complete analysis, we communicate this transparently.
Which tools do you actually use?+
For our analysis, we primarily use Belkasoft X and X-Ways Forensics, which offer extensive support for storage media, mobile devices and common file and database formats.
Can you carry out a full assessment of every vehicle model?+
No. The scope of the analysis depends on the manufacturer in question, the control unit and infotainment formats used, and the relevant documentation. Any existing technical limitations are clearly stated in the report.
Why don’t you analyse the original control unit directly?+
Because analysis software and data extraction processes can alter data. The actual analysis is therefore always carried out on a verified forensic copy or on the basis of a duly documented data extraction process.
Is it always possible to carry out a full analysis of the control unit’s data memory?+
No. Encryption, proprietary formats or a lack of access to certain control units may impose technical limitations. Such limitations are openly documented.
Do you also analyse data from smartphones paired with the vehicle?+
Yes, provided they are available and the necessary authorisation has been granted, as paired mobile devices often contain additional usage data that is not stored in the vehicle itself.
How do you deal with different manufacturer formats?+
We assess on a case-by-case basis which data formats are available and which of our tools can be used to analyse them. Unsupported, proprietary formats are documented as such.
How do you explain the results to non-technical people?+
We do not merely describe raw technical data; we also explain what an artefact signifies, how it may have arisen, and what conclusions can actually be drawn from it.
Which vehicles can be analysed?+
This depends on the manufacturer, model and system fitted, and will be checked in advance.
Why isn’t the automatic report always sufficient?+
Because parsers can misinterpret formats without this being apparent in the report.
Is data from the paired mobile phone also analysed?+
The pairing data stored in the vehicle, yes; the smartphone itself is a separate data source.

Related topics

🔗 Related topics

LanCologne – Vehicle IT Forensics, Cologne

Do you require a professional investigation into „Automated versus manual analysis of vehicle data"? LanCologne supports you in the secure preservation of evidence, multi-stage analysis and traceable documentation of digital traces relating to vehicles. The key here is not to generate as many automatic matches as possible, but to secure technically sound and verifiable evidence.

Get in touch now