IT Forensics · Car
Zusammenarbeit mit Kfz-Sachverständigen
Bei komplexen Unfallrekonstruktionen ergänzen sich die digitale Auswertung von Fahrzeugdaten und die klassische physisch-technische Unfallanalyse eines Kfz-Sachverständigen häufig gegenseitig.
This point is particularly important when it comes to vehicles, as manufacturers, model types, software versions and the storage and transmission formats used can vary considerably. A conventional petrol or diesel car, a modern electric vehicle and a commercial vehicle fitted with a tachograph cannot be treated according to the same technical approach. The storage location, data format, encryption and connectivity determine which data is accessible and which backup method causes the least disruption.
Wir stimmen unsere digitalen Befunde eng mit den physisch-technischen Feststellungen der Sachverständigen ab, um ein möglichst konsistentes Gesamtbild des Unfallgeschehens zu erarbeiten.
Why LanCologne?
LanCologne does not investigate digital traces relating to vehicles according to a blanket standard procedure, but rather on the basis of the specific vehicle type, the available data sources and the evidence at issue. Our staff have decades of experience in information technology and many years of practical experience in IT forensics. We assist companies, solicitors and private individuals, as well as regularly supporting courts and public authorities, in the technical investigation of digital matters.
The investigation is generally carried out on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence is either left unchanged or, where technically unavoidable alterations have been made, these are transparently documented and the evidence is stored in a manner that preserves its integrity.
Our working methods and the tools we use
Our investigation does not begin by launching an analysis programme, but by gathering evidence. The vehicle, its on-board systems, its visible condition and any connected mobile devices are documented. A decision is then made as to which data sources are accessible and in what order they are to be backed up.
The next step is to define the backup strategy. In doing so, we distinguish between whether data is accessible via removed storage media, via a standard diagnostic interface, or via a mobile device connected to the vehicle. The choice depends not on convenience, but on the vehicle type, data format, availability and the specific issue to be established. Where technically possible, we work in read-only mode; any unavoidable changes to the data’s state are explicitly logged.
The backup created is documented using hash values. The actual analysis is not carried out on the original, but on a working copy or a verified forensic image. This allows searches or specific analysis steps to be carried out without continuously altering the original evidence.
Wir stellen unsere digitalen Befunde in einer Form bereit, die eine unmittelbare Verknüpfung mit den physisch-technischen Feststellungen von Kfz-Sachverständigen ermöglicht, und stimmen uns bei Bedarf direkt mit diesen ab.
For a reader unfamiliar with the subject, one point is particularly important: a forensic programme does not automatically „find" the truth. It reads data structures and interprets them according to known rules. If a new software or system version changes a data format, an automated analysis may produce incomplete or incorrect results. That is why, in the case of crucial findings, we check which file or data structure the result originates from and whether a second technical approach confirms the same findings.
We deliberately do not use any dedicated vehicle data extraction hardware, such as proprietary infotainment or ECU readers. Instead, we analyse storage media, connected mobile devices and common file and database formats using our established forensic tools, in particular Belkasoft X and X-Ways Forensics. Where manufacturer-specific, undocumented ECU or infotainment formats prevent a fully automated analysis, we manually examine the accessible raw data and transparently document any technical limitations, rather than claiming an unsubstantiated finding.
Typical areas of application
This is how the forensic investigation is carried out
The vehicle, its systems and, where applicable, any connected mobile devices are first clearly identified and documented either photographically or in writing. We record the physical and electronic condition in which the vehicle was found. This information may prove crucial later on.
The manufacturer, model, installed systems and their software versions are identified. Only then can it be determined which data is generally accessible and which backup method is appropriate.
The backup process is carried out in such a way that the original state is altered as little as possible. Depending on the circumstances, accessible storage media are read in write-protected mode, connected mobile devices are backed up separately, and available cloud data is captured with the authorised person’s consent. Every step is logged.
Any images or copies created are given unique names, assigned hash values and verified. Analysis and searches are then carried out exclusively on working copies.
Existing data is analysed in a structured manner using our established forensic tools. Where standard software does not fully support a particular format, this is documented rather than being tacitly ignored.
In the case of findings that are particularly relevant to the evidence or unusual, we manually check the raw data, file structures and metadata to rule out any automated misinterpretations.
At the end, we do not merely list what could be gleaned from the data. We explain the technical source on which the findings are based, what conclusions can be drawn, and where the limitations lie.
Why is this area of investigation relevant to forensics?
Bei komplexen Unfallrekonstruktionen ergänzen sich die digitale Auswertung von Fahrzeugdaten und die klassische physisch-technische Unfallanalyse eines Kfz-Sachverständigen häufig gegenseitig.
The forensic value lies not solely in the volume of data found, but in its origin and reliability. A file name, a timestamp or a log entry can be misleading without context. That is why we document how an artefact may have come into being, what alternative explanations exist and what further evidence supports the findings.
Wir stimmen unsere digitalen Befunde eng mit den physisch-technischen Feststellungen der Sachverständigen ab, um ein möglichst konsistentes Gesamtbild des Unfallgeschehens zu erarbeiten.
Particularly in the case of vehicles, attempts to carry out a comprehensive technical analysis may also reach their limits if manufacturers use proprietary, unpublished data formats. A lack of documentation, encrypted memory areas and manufacturer-specific cloud connections highlight why it is so important to carry out a professional backup and to communicate existing limitations transparently before the actual analysis begins. Errors made at this stage cannot always be rectified later on.
Frequently Asked Questions
LanCologne – Vehicle IT Forensics, Cologne
Sie benötigen eine professionelle Untersuchung zu „Zusammenarbeit mit Kfz-Sachverständigen"? LanCologne unterstützt Sie bei der beweissicheren Sicherung, mehrstufigen Auswertung und nachvollziehbaren Dokumentation digitaler Spuren im Zusammenhang mit Fahrzeugen. Entscheidend ist dabei nicht, möglichst viele automatische Treffer zu erzeugen, sondern technisch belastbare und überprüfbare Beweise zu sichern.