IT Forensics · Car
Forensic analysis of CAN bus data – using in-vehicle communication for forensic purposes
The CAN bus connects a vehicle’s various control units and continuously transmits status information – such as speed, engine speed and sensor readings – between the individual systems.
In a production vehicle, all CAN bus traffic is not usually recorded on a continuous basis; for this reason, forensic analysis generally focuses on the compressed data sets stored permanently in individual control units.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.
Our services
We check which status information transmitted via the CAN bus is permanently stored in accessible control units, and analyse this using our established tools.
Typical areas of application
How CAN bus data analysis works
Once the data has been backed up, we check which control units contain accessible, permanently stored data records. These are extracted and analysed using our tools, insofar as the respective format permits.
Why is CAN bus data analysis relevant in a forensic context?
Even without a complete live recording, the aggregated status data stored in individual control units can provide important technical clues for reconstructing an incident.
As real-time recording of all bus traffic is not common in production vehicles, this is clearly communicated so as not to raise any false expectations.
Frequently Asked Questions
LanCologne – Vehicle IT Forensics, Cologne
Do you require a professional forensic investigation into the „forensic analysis of CAN bus data"? LanCologne can assist you in securing digital evidence in a manner that stands up in court, as well as in the transparent analysis of relevant vehicle artefacts.
Related to this topic
- Forensic examination of vehicle electronic control units (ECUs) – Forensic analysis of electronic control units
- Forensic analysis of tachographs – reconstructing driving and rest periods for commercial vehicles
- Forensic analysis of vehicle telematics units – Forensic use of permanently fitted communication modules
- Forensic analysis of keyless entry system data – the forensic use of keyless entry systems