Modern vehicles are no longer purely mechanical systems. Infotainment, navigation, telematics, electronic control units, Bluetooth connections, driver profiles, smartphone pairing, and networked services generate digital information that can become relevant in the event of accidents, vehicle theft, suspected tampering, unauthorized use, or legal disputes.

LB Forensik's vehicle forensics department specializes in the professional securing, analysis, and evaluation of digital vehicle data. We don't just examine individual control units or the infotainment system. Depending on the specific issue, we can analyze the vehicle, smartphone, user account, navigation data, and other digital evidence simultaneously.

This combination of different data sources can be crucial. A single vehicle entry often provides only a technical clue. However, if this is compared with location information from a smartphone, device connections, communication data, or other time-related artifacts, events can be reconstructed much more accurately.

Further information on the supplementary examination of mobile devices can be found under Mobile Forensics . We also explain basic information on the legally sound handling of digital data in the article Integrity of Digital Evidence.

What is vehicle forensics?

Vehicle forensics, also known as automotive forensics, refers to the forensic investigation of digital data from vehicles and systems connected to them.

Modern vehicles contain numerous electronic components that communicate with each other and, in some cases, store information. These include, for example, infotainment and navigation systems, telematics modules, electronic control units, diagnostic systems, and interfaces to smartphones and cloud services.

However, the information that is actually available and technically accessible varies considerably. Manufacturer, model, year of manufacture, equipment, software version, and specific system architecture can all influence the investigation possibilities.

Professional vehicle forensics therefore does not mean extracting as much data as possible. The crucial question is:

Which digital data sources can contribute to clarifying the specific facts?

Only then will it be determined which systems should be examined and which data should be backed up.

What digital traces can vehicles contain?

Depending on the vehicle and the installed systems, different digital artifacts may be present. Each data source must be evaluated separately with regard to its origin, creation, and significance.

infotainment systems

The infotainment system in many modern vehicles is one of the most interesting forensic data sources.

Depending on the system, information about previously connected smartphones, Bluetooth devices, USB connections, Wi-Fi connections, contacts, communication functions, media devices, or user profiles may be present.

This can, for example, provide evidence that a particular mobile device was paired with a vehicle or used inside the vehicle.

However, a recorded device connection does not automatically prove which person was using the device or vehicle at that time. Such findings must be compared with other data sources.

Navigation and location information

Depending on the vehicle, navigation systems may contain saved destinations, favorites, recent destinations, or other location-related information.

Suitable systems may also provide additional navigation or movement information.

For the reconstruction of a location or a possible journey route, such data should ideally not be considered in isolation.

A comparison with location information from a smartphone, map applications, photos, communication data or other time-related digital traces can be particularly informative.

Bluetooth, Wi-Fi and device connections

The connection between vehicle and smartphone can represent an independent digital track.

Depending on the system, device names, technical identifiers, or information about previous connections may be present.

This data can be relevant, for example, when determining whether a particular smartphone was connected to a vehicle.

Apple CarPlay and Android Auto

Using Apple CarPlay or Android Auto connects the smartphone and vehicle system particularly closely.

What traces of such use remain depends on the specific vehicle, infotainment system, and smartphone.

Therefore, a comprehensive investigation can consider both the vehicle side and the smartphone in question.

Electronic tax equipment

Electronic control units can contain technical statuses, diagnostic information, fault events and other vehicle-specific data.

The information that is permanently stored varies from control unit to control unit.

Time data also needs to be technically verified. Not every stored value automatically has a precise and independently verifiable timestamp.

Therefore, a technical entry should not be equated with a precisely determined event time without further examination.

Diagnostic and OBD data

Diagnostic interfaces can provide access to certain electronic vehicle areas and fault information.

However, a standard OBD scan is not equivalent to a full vehicle forensic examination.

Diagnostic systems primarily serve the purpose of technical vehicle diagnostics. In contrast, forensically relevant data can be stored in various, and sometimes manufacturer-specific, vehicle systems.

Simply reading diagnostic codes does not answer any forensic evidentiary question.

Event Data Recorder – EDR

In certain vehicles, event data recorders can provide an additional data source.

EDR systems can store vehicle-related information in connection with certain events. What data is available and whether it can be technically read must be checked for each individual vehicle.

An event data recorder is not the same as a permanent GPS or driving recorder.

EDR data must therefore be clearly distinguished from navigation, infotainment, telematics and general control unit data.

CAN bus forensics – what can actually be investigated

The Controller Area Network bus, or CAN bus for short, is one of the central communication systems of many vehicles.

Different electronic control units exchange information with each other via this interface during vehicle operation.

However, an important distinction is required for forensic evaluation:

The CAN bus is primarily a communication system and not a permanent archive of all vehicle activities.

Just because information was transmitted via a bus during vehicle operation does not automatically mean that it can subsequently be permanently stored and read out later.

For a subsequent investigation, it is therefore crucial to determine which control units or systems involved actually stored relevant information.

Therefore, reputable CAN bus forensics should not give the impression that it can completely reconstruct every journey or every single vehicle action afterwards.

Examine vehicle and smartphone together

A particularly interesting situation arises when the vehicle and smartphone can be viewed together.

The vehicle may, for example, contain information about a connected mobile device. The smartphone, in turn, may contain relevant Bluetooth, location, navigation, communication, or app data.

Comparing both data sources over time can reveal technical correlations that would remain hidden in an isolated investigation.

For example, it can be checked whether:

• a specific smartphone was connected to the vehicle,
• Matching the smartphone's location information with existing vehicle data
• Navigation data from both systems match,
• certain applications were used during the relevant period
• Other digital events correlate with each other in time.

LB Forensics therefore combines mobile forensics and vehicle forensics within a common investigation strategy in suitable cases.

Vehicle apps and cloud services

Many modern vehicles are also connected to manufacturer accounts, smartphone apps, or other online services.

Depending on the manufacturer, vehicle and existing user account, such systems may contain additional information about vehicle conditions, user activities, charging processes, accesses or other vehicle functions.

If relevant data is legally available and becomes relevant to the question of proof, it can be considered as an additional digital data source.

In complex cases, this creates an investigation network consisting of vehicle, smartphone and, if necessary, cloud or app data.

When is a vehicle forensic examination useful?

Vehicle forensics can be used in a wide variety of situations.

Typical questions might include:

• Traffic accidents and reconstruction of digital vehicle events
• unauthorized use of a vehicle
• Vehicle theft
• Suspected electronic manipulation
• Suspected manipulation of vehicle data
• Dispute over vehicle use or whereabouts
• business use of company vehicles
• internal investigations in companies
• Insurance claims
• civil disputes
• facts relevant under criminal law
• Assigning a smartphone to a vehicle
• Matching of vehicle, smartphone and location data

The decisive factor is always the specific research question.

Investigate unauthorized vehicle use

For privately or commercially used vehicles, the question may arise as to when a vehicle was used and what digital traces were created.

However, the identity of a driver cannot be automatically determined from vehicle data alone.

Clues can arise, for example, from user profiles, connected smartphones, navigation information, or other digital artifacts.

The strength of the evidence can be increased if additional evidence is available.

Smartphone data, communication information, photos, location information or other time-related data can be compared with the vehicle data.

Vehicle theft and digital manipulation traces

Modern vehicles have complex electronic access, comfort and safety systems.

In the case of vehicle theft, in addition to the classic evidence collection, the question of whether accessible electronic systems contain anomalies or usable technical data may also be relevant.

Depending on the vehicle, diagnostic information, electronic events, or other artifacts can be examined.

However, a strict distinction must be made between a technical anomaly and proof of a specific attack method.

Not every technical anomaly proves manipulation. Likewise, not every manipulation necessarily leaves permanently analyzable traces.

Odometer tampering and contradictory vehicle data

If there is a suspicion of manipulated mileage or distance data, it can be useful to compare different electronic data sources.

Depending on the vehicle, mileage or distance information may be available in different systems.

Discrepancies between multiple data sources can indicate irregularities.

Whether manipulation can actually be proven depends on the vehicle, the available data, and the overall technical situation.

Therefore, a single deviating value should not be evaluated in isolation.

Vehicle forensics after a traffic accident

Digital vehicle data can provide an additional source of technical information when investigating a traffic accident.

Depending on the vehicle and system, data may be available that allows conclusions to be drawn about certain technical conditions or events.

However, such information must be carefully evaluated.

Among other things, the following must be examined:

• from which system a value originates
• under what conditions it was stored,
• whether a time reference exists,
• what technical accuracy the signal in question possesses,
• whether other data sources confirm or contradict the finding.

Digital vehicle data can complement a traditional accident analysis. However, it does not automatically replace other technical or accident analysis investigations.

Deleted vehicle data – what else is possible?

Even with vehicle data, deleted data does not automatically mean it can be recovered.

Whether information that is no longer visible or has been deleted can still be reconstructed depends, among other things, on the storage system, the respective data format, possible overwriting, and technical access to the system in question.

Therefore, a complete restoration cannot be guaranteed across the board.

If a vehicle has been reset, a user profile deleted, or the infotainment system has continued to be used intensively, existing data may have been altered or overwritten.

Forensic evidence preservation instead of simple vehicle diagnostics

A car repair shop and a vehicle forensic expert pursue different goals.

A repair shop typically examines a vehicle to identify and fix technical faults.

In contrast, vehicle forensics examines digital information from the perspective of its potential relevance as evidence.

This must be documented in a traceable manner:

• which vehicle or system was examined
• which data source was evaluated
• which procedure was used,
• which data were collected
• how to technically classify this data,
• which conclusions are permissible,
• where the limits of the investigation lie.

The integrity of digital evidence is an essential part of the investigation.

Digital chain of evidence and traceable documentation

Technical data does not gain its significance simply by being read from a vehicle.

Equally important are origin, examination method and documentation.

Depending on the type of backup, suitable technical procedures can be used to document backed-up data in a traceable manner and to make subsequent changes recognizable.

The treatment of the object under investigation can also be recorded as part of a documented chain of evidence.

This makes it possible to track when the vehicle or a removed system was taken over, examined and, if necessary, passed on.

Our procedure for a vehicle forensic investigation

1. Define the research question

First, it is clarified which specific issue is to be investigated.

A precise question of proof prevents unnecessary investigations and enables the targeted selection of relevant data sources.

2. Identify the vehicle and its systems

Manufacturer, model, year of manufacture, equipment and installed systems are recorded as necessary.

The next step is to examine which systems might be relevant to the specific case.

3. Consider other digital evidence

Additional data sources will be included if necessary.

This may include, in particular, smartphones, user accounts, navigation data, or other electronic evidence.

4. Determine a suitable securing method

The specific procedure depends on the vehicle and the system to be examined.

Not every method is suitable for every vehicle.

The aim is to achieve technically appropriate security while preserving the existing initial state as much as possible.

5. Analyze data

The information obtained is examined in a structured manner and evaluated with regard to the specific question.

6. Correlate data sources

For more complex issues, different data sources can be compared with each other in terms of time and technology.

This allows for the identification of similarities, contradictions, and possible connections.

7. Document results

Depending on the assignment, investigation steps, technical findings and assessments are documented in a structured investigation report or as part of an expert report.

Further information can be found at our expert office for IT and mobile forensics.

What should be avoided before a vehicle inspection?

If a vehicle is to be examined forensically at a later date, its existing digital state should be altered as little as possible.

Where possible, the following measures in particular should not be carried out without prior consultation:

• Reset infotainment system
• Delete vehicle profiles
• Remove paired smartphones or devices
• Delete navigation destinations or history
• Restore factory settings
• perform unnecessary software updates
• Reconfigure systems unnecessarily

Intensive continued use can also lead to older information being changed or overwritten.

In the event of a potential case requiring evidence, it should therefore be clarified early on how the vehicle should be treated until the examination.

Vehicle forensics for companies

Companies often have large fleets of vehicles, company cars, or vehicles with changing users.

Vehicle forensics can therefore also be relevant in internal investigations.

Possible questions include, for example, the unauthorized use of a company vehicle, suspected manipulation, or the connection of a vehicle with other digital evidence.

In more complex internal company cases, vehicle data can be examined together with smartphones, computers or other digital systems.

Vehicle forensics for lawyers

In legal disputes, it can be crucial, even before a comprehensive investigation, to know what vehicle data might be available.

LB Forensik supports lawyers in the technical classification of digital vehicle traces and can investigate which data sources are relevant for a specific evidentiary question.

Technical findings are separated from further interpretations.

This is particularly important if no more can be derived from a single digital artifact than is actually permitted by the technical data situation.

Vehicle forensics for insurance companies and experts

Digital vehicle data can also provide an additional source of information in insurance claims.

Which data can be meaningfully evaluated depends on the damage event and the specific vehicle.

LB Forensik can process digital vehicle data as an independent forensic investigation area or combine it with other technical data sources.

Vehicle forensics for private individuals

Private individuals can also have vehicle data examined if there is a specific technical or legal question.

This can include, for example, suspected manipulation, unauthorized use of the vehicle, vehicle theft, disputes over the use of a vehicle, or the connection between the vehicle and the smartphone.

Before starting a comprehensive investigation, it is first examined which data may be relevant to the specific question at hand.

Vehicle forensics nationwide

LB Forensik supports companies, lawyers, organizations and private individuals nationwide in the examination of digital evidence.

Depending on the vehicle, the scope of the investigation and the initial technical situation, it can be determined whether an investigation should take place at the vehicle's location or under controlled investigation conditions.

Regional information can be found, among other places, at IT forensics for Stuttgart , IT forensics for Düsseldorf and IT forensics for Hanover.

Certified processes and expert competence

When it comes to digital evidence, the quality of an investigation is not solely determined by the software used.

Equally important are defined processes, suitable investigation methods, expert evaluation and comprehensible documentation.

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics.

This is distinct from the personal certification of the expert according to DIN EN ISO/IEC 17024. This certification pertains to the certified individual and their competence within the respective certification program.

This combines organizationally defined quality processes with personal expert competence.

This distinction is particularly relevant when dealing with complex vehicle data: A forensic tool can capture and structure data. The professional service lies in verifying its origin, correctly classifying relationships, and transparently presenting the limitations of a technical finding.

Limits of vehicle forensics

Even modern vehicle forensics cannot answer every question.

The data that is available depends on the specific vehicle and the information that is still available.

A professional investigation must therefore clearly identify what cannot be determined technically.

In particular, the following applies:

• Not every vehicle stores the same data.
• Not every journey can be fully reconstructed.
• Not every device connection can be attributed to a specific person.
• Not every timestamp has the same accuracy.
• Not every manipulation leaves permanently usable traces.
• Not all deleted data can be recovered.
• CAN bus communication does not automatically mean that the transmitted data has been permanently stored.

Documenting these boundaries openly is part of a reliable forensic assessment.

Frequently asked questions about vehicle forensics

Which vehicles can be forensically examined?

This depends on the manufacturer, model, year of manufacture, equipment, and installed electronic systems. Therefore, before any investigation, it is checked which data sources are available for the specific vehicle and may be relevant to the particular question being asked.

What data can be read from a vehicle?

Depending on the vehicle, information from infotainment, navigation, telematics, electronic control units, diagnostic systems, or connected mobile devices may be present. Not every vehicle stores all of this information.

Is it possible to determine which smartphone was connected to a vehicle?

Suitable infotainment systems may store information about previously paired or connected devices. Whether the time and type of connection can also be determined depends on the specific vehicle system and the data still available.

Is it possible to trace where a vehicle was located?

Under certain conditions, navigation or location information can provide clues to previous locations. However, a complete driving history is not available for every vehicle.

Can a complete route traveled be reconstructed?

There's no single answer to that. Some systems contain more comprehensive navigation information, others only individual destinations or events. Additional smartphone or other location data can improve the reconstruction.

Can it be determined who was driving the vehicle?

Vehicle data alone does not usually automatically prove the driver's identity. However, user profiles, paired smartphones, and other digital traces can provide clues. Additional evidence may be required for a conclusive identification.

Can deleted vehicle data be recovered?

Under certain circumstances, data that is no longer immediately visible may still exist. Whether reconstruction is possible depends on the storage system, potential overwriting, and technical access to the system in question. Recovery cannot be guaranteed.

Can a manipulated odometer reading be detected?

Depending on the vehicle, mileage information may be stored in various electronic systems. Deviations can indicate irregularities. Whether this proves manipulation must be technically assessed on a case-by-case basis.

Can vehicle forensics help in the case of a traffic accident?

Yes. Depending on the vehicle, digital data can provide additional information about technical conditions or events. A distinction must be made between infotainment, control unit, telematics, and, where applicable, EDR data.

What is an Event Data Recorder?

An Event Data Recorder (EDR) is a data storage device that, in specially designed vehicles, can record specific data related to a triggering event. It is not the same as a permanent GPS or trip recorder.

Can the CAN bus show the entire vehicle history?

No. The CAN bus primarily serves for communication between electronic control units. It does not automatically and permanently store all transmitted information. For subsequent analysis, it is crucial to determine which data individual systems have actually stored.

What is the difference between OBD diagnostics and vehicle forensics?

OBD or workshop diagnostics primarily serve to find technical faults. Vehicle forensics, on the other hand, examines digital data with regard to a specific evidentiary question and additionally considers data origin, storage, technical significance, and documentation.

Can the driver's smartphone be examined as well?

Yes. The combination of vehicle and smartphone data can be particularly informative. Location information, Bluetooth connections, apps, navigation, and other digital artifacts can be compared with the vehicle data.

Can vehicle data be combined with app or cloud data?

If the relevant data is legally available and pertinent to the investigation, different digital data sources can be compared. This can reveal correlations that would not be apparent from a single source.

Are data altered during a vehicle inspection?

The goal of a forensic investigation is to preserve the existing condition as much as possible and to document necessary investigative steps in a traceable manner. However, with certain vehicle systems, technical interventions can affect the system's condition. Therefore, the procedure is tailored to the specific vehicle.

Are the results admissible in court proceedings?

The forensic expert does not ultimately decide whether and to what extent a technical finding has evidentiary value in a specific case. Crucial for technical verifiability, however, are, in particular, a documented data origin, a suitable backup method, a comprehensible investigation, and the expert evaluation of the information obtained.

What should not be done before a vehicle inspection?

Infotainment systems, user profiles, and navigation information should ideally not be reset or deleted. Unnecessary software updates or changes to relevant system settings should also be avoided before potential evidence collection.

What information do you need for an initial assessment?

Particularly helpful information includes the vehicle manufacturer, model, year of manufacture, and, if possible, details of the installed infotainment or navigation system. Additionally, the specific question should be described, for example, accident, unauthorized vehicle use, suspected tampering, vehicle theft, or the connection of a smartphone to the vehicle.

Request vehicle forensics through LB-Forensics

If digital vehicle data could be relevant in the event of an accident, vehicle theft, suspected manipulation, unauthorized use or any other legal issue, it should first be examined which systems and other digital evidence are available.

An early technical assessment can prevent the loss of relevant data through resetting, deletion, or further intensive use.

LB Forensik combines vehicle forensics, mobile forensics and other areas of digital forensics within a common investigation strategy in suitable cases.

The goal is not to obtain the largest possible amount of vehicle data, but to provide a comprehensible answer to the specific technical question of proof.