Article Preview
TopIntroduction
Investigations of cybercrime rely increasingly on digital forensics (DF) for the gathering and presentation of evidence (Bankole et al., 2022; Garfinkel, 2010; Sunde and Dror, 2019). However, the use of evidence obtained through DF has proved to be challenging in terms of establishing that it is sufficiently authentic, accurate, complete, and convincing to a jury to be legally admissible (Yeboah-Ofori and Brown, 2020). Furthermore, there is a pressing need to assess the quality of the large number of commercial tools available (Talib et al., 2020). Computer and DF techniques have become popular in recent years, with the US market predicted to grow by 17% from 2016 to 2026 (GywneddMercy University, 2021) and having grown from USD $4.62B in 2017 to $9.68B in 2022, an annual compound rate of almost 16% (Reedy, 2020). According to another estimate, the DF market is expected to grow at a rate of 10.97% from 2021 to 2026 in step with increased use of devices linked to the Internet of Things (IoT) and increases in government regulations and cyber-attacks (Mordor, 2022). In this respect, the expanding scope of cyber threats and attacks has expanded the need for DF (Paul Joseph and Norman, 2019). Indeed, DF has become a critical aspect of almost every criminal investigation owing to the large amount of electronic evidence that most crimes create (Arshad et al., 2018).
The targets of DF include smartphones, unmanned aerial vehicles (UAVs) or drones, automobiles, and other devices connected to the IoT. Traditionally, DF has been limited to mobile phones and computers, but, with advances in digitalization, smart cars have come on the market with fully integrated systems that hold a wealth of forensically valuable data. For instance, Tesla’s Model D is digital down to its basic components, such as the electromechanical hydraulic braking system, which differs fundamentally from the mechanical brakes usually found in cars. This major transition in the automobile industry, then, is increasing the relevance of digital vehicle forensics (DVF).
In a conventional incident scenario, when a vehicle is involved in a crime or associated with a crime scene, the investigators focus on the acquisition of non-digital evidence, such as DNA, fingerprints, and other identifying materials, and do not necessarily avail themselves of the valuable retrievable data stored in modern products (Le-Khac et al., 2020). These data can pertain to routes and vehicle events, in the form of access event logs associated with such activities as opening doors and shifting gears as well as odometer and speed records and ignition cycles, and to locations, in the form of navigation information such as track logs, active routes, and previous destinations—all from devices that are connected through USB ports, Bluetooth or wireless networks, and media and communication data (Berla, 2022). A typical vehicle relies on 75 or more computer systems with 150 million or more lines of code and generates some 25 gigabytes of data hourly, and access to it can be essential for investigations to prove successful (Rak and Kopencová, 2020). DVF, also referred to as automotive forensics or car forensics, involves the rapid acquisition and analysis of digital data (or digital evidence) from motor vehicles (Bates, 2019) and the in-depth assessment of the components of vehicles to answer questions about scenarios such as accidents (Thommasone, 2021). With cars become increasingly reliant on sensors to perform everyday driving operations