Search papers, labs, and topics across Lattice.
This paper synthesizes existing literature and practitioner insights to define digital vehicle forensics (DVF) and formalize its triage challenges, addressing the complexities of evidence collection from modern cyber-physical vehicles. It highlights eight key characteristics of DVF, such as networked dependencies and safety implications, which complicate the identification and preservation of digital evidence. The authors propose a characteristic-driven triage procedure that aids investigators in prioritizing evidence sources while considering various constraints, thereby enhancing the rigor of DVF investigations.
Digital vehicle forensics faces unique challenges that could compromise investigations, but a new framework helps prioritize evidence sources effectively.
Modern vehicles are cyber-physical, networked systems that may contain valuable digital traces for accident reconstruction, crime investigation, warranty analysis, and cybersecurity incident response. However, digital vehicle forensics (DVF) remains less mature than computer, mobile, and cloud forensics because relevant data is distributed across in-vehicle components, mobile devices, manufacturer back ends, third-party services, and physical evidence. This article addresses this gap through a structured synthesis of academic literature, standards, and practitioner-oriented sources. First, we define DVF as the identification, preservation, acquisition, verification, interpretation, and reporting of vehicle-related digital evidence under safety, legal, privacy, and forensic-soundness constraints. Second, we formalize the DVF triage problem as the selection and correlation of evidence sources subject to volatility, accessibility, safety, integrity, and authorization constraints. Third, we explain how eight characteristics were derived from the literature and case material: multiple users, massively networked, cyber-physical system, dependencies between components, functional data, safety implications, accessibility, and limited abstraction. Finally, we add an adversarial perspective and a characteristic-driven triage procedure that helps investigators prioritize evidence sources while documenting assumptions, limitations, and failure cases. The resulting contribution is not an algorithmic performance claim; it is a reproducible conceptual framework for understanding, planning, and communicating DVF investigations.
