IT Forensics · Car

Forensic analysis of OTA-Update logs – Forensic investigation of over-the-air updates

Over-the-air Update updates enable manufacturers to update software in vehicles wirelessly; depending on the system, this may generate log data relating to the download, installation and outcome of the Update process.

Enquire without obligation

These logs can be accessed both locally in the vehicle and, subject to the appropriate authorisation, by the manufacturer, and provide insights into the exact sequence of events in a Update process.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We analyse the available local OTA-Update logs and, where access is granted, consult supplementary manufacturer records for comparison.

Typical areas of application

•Evidence of the time and result of an OTA-Update
•Clarification of possible links between Update and vehicle behaviour
•Investigation of failed or interrupted Update processes
•Support with product recalls and product liability issues
•Judicial and non-judicial expert reports
•Cooperation with manufacturers regarding Update-related incidents

This is how an OTA-Update analysis is carried out

Once the backup has been completed, any available local Update logs are extracted and, where accessible, cross-referenced with the manufacturer’s records. Any anomalies, such as failed installations, are documented separately.

Why is the OTA-Update analysis relevant in a forensic context?

A failed or incomplete Update test may be relevant as a possible explanation for atypical vehicle behaviour.

Determining the exact date and time of a Update is often crucial for establishing which software version was actually active at the time of an incident.

Frequently Asked Questions

Does every modern vehicle have OTA-Update functionality?+
No, this depends very much on the manufacturer, model and specification.
Can OTA-Update logs be amended retrospectively?+
This is taken into account as part of the forensic investigation through plausibility and integrity checks.
Are manufacturer-specific Server protocols also included?+
Only with the appropriate authorisation from the vehicle owner or on the basis of a valid legal basis.

LanCologne – Vehicle IT Forensics, Cologne

Do you require a professional forensic investigation into the „forensic analysis of OTA-Update protocols"? LanCologne can assist you with the legally admissible preservation of digital evidence and the transparent analysis of relevant vehicle artefacts.

Get in touch now