IT Forensics · Car

Combined analysis of vehicle and mobile phone data

The vehicle and smartphone record the same journey from two different perspectives: the vehicle records connections, calls and vehicle events, whilst the smartphone records movements, app usage and location history. By combining these, gaps can be filled – for example, when the vehicle does not store location data – and insights into usage can be refined.

Enquire without obligation

This point is particularly important when it comes to vehicles, as manufacturers, model types, software versions and the storage and transmission formats used can vary considerably. A conventional petrol or diesel car, a modern electric vehicle and a commercial vehicle fitted with a tachograph cannot be treated according to the same technical approach. The storage location, data format, encryption and connectivity determine which data is accessible and which backup method causes the least disruption.

A combined analysis of both data sources can fill gaps in individual systems and enhance the overall validity of the study.

Technical background

A smartphone can be paired with several vehicles, and a vehicle with many phones. A pairing indicates that a device was in the vehicle, not who was driving. Smartphone data such as physical activity, CarPlay/Android Auto sessions or screen usage whilst driving can provide additional clues.

Relevant evidence and data sources

  • Vehicle: connected devices, call logs, navigation destinations, ignition/door events
  • Smartphone: Location history, physical activity, CarPlay/Android Auto sessions, screen and app usage
  • Telematics or manufacturer portals (where available)

Why LanCologne?

LanCologne does not examine digital traces relating to vehicles according to a blanket standard procedure, but rather on the basis of the specific vehicle type, the available data sources and the evidence at issue. Our staff have decades of experience in information technology and many years of practical experience in IT forensics.

Here’s how we do it

  • Separate fuse protection for both power sources.
  • Normalisation of the time axes.
  • Matching events and assessing similarities and discrepancies.

Borders

  • It is usually not possible to identify the person behind the wheel from the device data alone.
  • The absence of a connection does not rule out the presence of a telephone.

Possible results

  • Consolidated timeline of the journey
  • Guidance on using devices whilst driving
  • Identification of unresolved contradictions

Typical areas of application

•Judicial and non-judicial expert reports
•Preservation of evidence from vehicles, storage media and connected mobile devices
•Study of different vehicle types and manufacturer platforms
•Investigating accidents, theft and allegations of tampering
•Analysis of driving, media, app and system artefacts
•Reconstruction of travel routes, usage times and access times
•Cross-checking of automated analysis results
•Analysis of deleted, historical or only indirectly visible traces
•Documentation for courts, solicitors, insurance companies, public authorities and businesses

Why is this area of investigation relevant to forensics?

Vehicle data and data from connected mobile devices often complement one another, for example when vehicle-based location data is missing but a connected smartphone has recorded its own position or movement data.

The forensic value lies not solely in the volume of data found, but in its origin and reliability. A file name, a timestamp or a log entry can be misleading without context. That is why we document how an artefact may have come into being, what alternative explanations exist and what further evidence supports the findings.

A combined analysis of both data sources can fill gaps in individual systems and enhance the overall validity of the study.

Particularly in the case of vehicles, attempts to carry out a comprehensive technical analysis may also reach their limits if manufacturers use proprietary, unpublished data formats. A lack of documentation, encrypted memory areas and manufacturer-specific cloud connections highlight why it is so important to carry out a professional backup and to communicate existing limitations transparently before the actual analysis begins. Errors made at this stage cannot always be rectified later on.

Frequently Asked Questions

Do you use specialist vehicle forensics hardware such as Berla iVe or Bosch CDR?+
No, we deliberately do not use dedicated vehicle data extraction hardware; instead, we analyse accessible storage media, connected mobile devices and file formats using our established forensic tools. Where proprietary, undocumented ECU formats prevent a complete analysis, we communicate this transparently.
Which tools do you actually use?+
For our analysis, we primarily use Belkasoft X and X-Ways Forensics, which offer extensive support for storage media, mobile devices and common file and database formats.
Can you carry out a full assessment of every vehicle model?+
No. The scope of the analysis depends on the manufacturer in question, the control unit and infotainment formats used, and the relevant documentation. Any existing technical limitations are clearly stated in the report.
Why don’t you analyse the original control unit directly?+
Because analysis software and data extraction processes can alter data. The actual analysis is therefore always carried out on a verified forensic copy or on the basis of a duly documented data extraction process.
Is it always possible to carry out a full analysis of the control unit’s data memory?+
No. Encryption, proprietary formats or a lack of access to certain control units may impose technical limitations. Such limitations are openly documented.
Do you also analyse data from smartphones paired with the vehicle?+
Yes, provided they are available and the necessary authorisation has been granted, as paired mobile devices often contain additional usage data that is not stored in the vehicle itself.
How do you deal with different manufacturer formats?+
We assess on a case-by-case basis which data formats are available and which of our tools can be used to analyse them. Unsupported, proprietary formats are documented as such.
How do you explain the results to non-technical people?+
We do not merely describe raw technical data; we also explain what an artefact signifies, how it may have arisen, and what conclusions can actually be drawn from it.
Can it be established who was driving?+
Not usually directly. However, combined data can provide clues which are assessed in conjunction with other evidence.
What data does the vehicle store from the mobile phone?+
Depending on the system, this may include contacts, call logs, messages and device identifiers.
Is it essential to analyse the mobile phone?+
No, but it fills in the gaps and makes the information more meaningful.

Related topics

🔗 Related topics

LanCologne – Vehicle IT Forensics, Cologne

Do you require a professional investigation into the „Combined analysis of vehicle and mobile phone data"? LanCologne supports you in the secure collection of evidence, multi-stage analysis and traceable documentation of digital traces relating to vehicles. The key here is not to generate as many automatic matches as possible, but to secure technically sound and verifiable evidence.

Get in touch now