Forensic investigation of vehicle-related data in Android phones connected to In-Vehicle Infotainment systems

Abstract

As modern vehicles are popularly equipped with an In-Vehicle Infotainment (IVI) system, many drivers use the IVI system which provides various infotainment services to them while driving. In general, after connecting a driver’s smartphone to the IVI system via Bluetooth, WiFi, or USB, she or he can make phone calls, use short message service (SMS), perform media playback, and utilize navigation functions of the smartphone. As a result, various vehicle-related data can be stored in the smartphone linked to the IVI system. Therefore, it is possible to obtain digital evidence through forensic investigation of the smartphone if a suspect has used his or her smartphone while connected to a vehicle’s IVI system. In this paper, we propose a new forensic technique to collect and analyze Android log messages as well as Bluetooth HCI snoop log left on Android phones which have interacted with vehicles’ IVI system via Bluetooth. The Android log messages are stored in multiple circular buffers kept by the Android logging system. The Bluetooth HCI snoop log, a type of log file, is a record of all Host Controller Interface (HCI) commands and events transmitted through Bluetooth on an Android device. From the two forensic data sources, we have identified lots of digital artifacts including as MAC address of the connected vehicle, the vehicle information, the time when being connected and disconnected to a vehicle, phone call history, etc. We also analyze the differences of digital artifacts obtained from the Android log messages and the Bluetooth HCI packets. We finally construct a timeline of the examined driver’s behaviors and vehicle events in terms of vehicle forensics.