In my previous career in law enforcement, I specialized in criminal investigation – specifically drug and death investigations. As I become more familiar with the benefits of vehicle forensics, I often think back about the important information that I missed when investigating past cases. Most law enforcement investigators, me included, have not been educated on the vast amount of information and impact that forensic from vehicles can contribute to a case. Most of us think that information from vehicles is limited to crashes, tire tracks, hidden compartments and other simple ideologies. What most law enforcement investigators don’t realize is that maybe, just maybe, vehicle forensics can help them find the missing link in their case – the amount of data that is collected, stored, and transmitted by vehicles is astounding.
When I look back on my past cases, I realize that intent would have been much easier to prove, had I been privy to vehicle forensics that showed events such as rapid braking, collision information, opening and closing of doors, or rapid acceleration. Imagine if you could access and gather information related to a driver using the navigation system or pairing their device with the vehicle. These dreams have now become a reality and are helping investigators, prosecutors, and defense attorneys build their cases.
The average vehicle generates over 1TB of data each day, and under normal driving conditions, uses over 150 Electronic Control Units that must collectively execute millions of lines of code daily. Electronic Control Units, commonly referred to as ECU’s, are computers for specific purposes made for the automobile industry. The ECU’s execute specific functions in a vehicle and vary in complexity. Some of the more complex ECU’s in a vehicle are the Engine Control Module (ECM), Automatic Braking System (ABS) and the Airbag Control Module (ACM). The ECU’s continuously communicate with each other over multiple networks in the vehicle and one ECU may record data from another ECU on the same network within the vehicle. As an investigator, or someone concerned with the data from a vehicle, it is necessary to think of a vehicle as a collection of various systems with each possibly containing information that may be relevant to the investigation or case. Thinking about what is possible, and knowing how to obtain the information, and who can assist, is important for Investigators. A vehicle that contains data and evidence must be thought of immediately as a volatile item of evidence – even after seizure of a vehicle (or at the time of seizure), actions by law enforcement, tow truck drivers, citizens or just about anyone with access to the vehicle can change or destroy evidence stored in vehicle systems. These actions have the potential to overwrite some of the data that exists in the vehicle, resulting in data lost if the vehicle is not handled appropriately.
As Investigators, it is important to have a general understanding of what information a vehicle may contain and understand that the vehicle is an important and highly underutilized piece of evidence in many investigations. Once secured, seek the assistance of someone with training, education and experience in vehicle forensics to consult with and assist in the acquisition of information from various vehicle systems.
