IT Forensics · Car
Forensic analysis of software rollback history – Forensic documentation of rollbacks to earlier software versions
In certain cases, the software on a control unit is deliberately rolled back to an earlier version, for example to troubleshoot a fault or, in isolated cases, to bypass the security or diagnostic functions of newer versions.
Such a rollback may leave traces in the ECU’s Update history, which may be of forensic significance.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.
Our services
We examine the available software version history (Update) of a control unit for signs of a rollback and document any anomalies in a manner that is forensically verifiable.
Typical areas of application
How a software rollback analysis is carried out
Once the relevant control unit has been backed up, the available Update history is checked for any unusual version jumps or downgrades and cross-referenced with other vehicle data.
Why is software rollback analysis relevant in a forensic context?
A deliberate rollback may be considered as a possible explanation for atypical vehicle behaviour or a deliberate circumvention of safety functions.
The timing of a rollback may also be relevant in determining which software version was actually active at a particular point in time.
Frequently Asked Questions
LanCologne – Vehicle IT Forensics, Cologne
Do you require a professional forensic investigation into „forensic analysis of software rollback history"? LanCologne can assist you in securing digital evidence to a standard that will stand up in court, as well as in the transparent analysis of relevant vehicle artefacts.
Related to this topic
- Forensic investigation of CAN bus attacks – Forensically detecting tampering with the vehicle data bus
- Forensic investigation of vehicle cyber-security incidents – Forensic analysis of digital attacks on vehicle systems
- Forensic investigation of keyless relay attacks – Forensic analysis of signal amplification attacks on keyless systems
- Forensic investigation of GPS spoofing in vehicle navigation systems – Forensically detecting falsified satellite signals