New Feature Highlights – iVe v1.9.2

We recently announced the release of iVe 1.9.2, which includes a multitude of significant improvements, new features, and bug fixes that better an already highly versatile tool. iVe remains the premier digital forensics application for performing logical and physical acquisitions and analysis of a vehicle’s infotainment and telematics systems. We would like to take a moment to highlight a few of the most compelling new iVe additions that make up this release.

Support for GM HMI

Prior to the release of 1.9.2, iVe already included support for multiple generations of OnStar, the well-known telematics system first introduced in 1996 and included in every domestic GM vehicle since 2009. However, GM vehicles also include separate infotainment systems, branded at the software level under various names (i.e., MyLink for Chevrolet and Holden; IntelliLink for Buick, GMC, Opel, and Vauxhall; and CUE for Cadillac). GM’s infotainment system is often run by a module referred to as the HMI, and this module is now fully supported in iVe.

Adding the HMI to iVe’s supported ECU list is important not only due to its prevalence in so many GM vehicles, but also because it includes some unique and potentially interesting data points for investigations. The HMI contains system-saved data on where navigation was initiated, and iVe displays this data under ‘Routes.’ Also, iVe parses the HMI’s PCM voice recordings, and these audio files can be accessed by navigating to the ‘Content’ section, and selecting ‘Voice Recording’ under ‘Events.’ If any recordings are present, they can be played back within the iVe application by clicking the play icon in the grid’s far right column.

ive_1-9-2_features_01

 

Viewing Events with Concurrent Tracklogs

For systems that contain events with GPS data as well as tracklog data (e.g., the Ford SYNC Generation 2 system), it is now possible to see which vehicle events correlate with concurrent tracklogs.

ive_1-9-2_features_02

To see the events that correlate with a tracklog:
  1. Navigate to the ‘Content’ section.
  2. Select the parent node for ‘Tracklogs’ under ‘Navigation.’ iVe displays the tracklog summary.
  3. For tracklogs that have concurring events, an eye icon is displayed in the grid’s far right column. Click the eye icon, and the grid updates to show the simultaneously occurring events.

ive_1-9-2_features_03

Geographic Search

When navigating to the ‘Search’ section, users now see two tabs to choose between. In addition to text searching, iVe affords a new geographic search function. The geographic search allows users to filter for any parsed content with GPS coordinates near an area of interest.

Geographic Search

To use the geographic search:
  1. Single-click the map to select a location, or type or paste GPS coordinates in the text field.
  2. To easily zoom in on the chosen location, double-click the marker on the map. (Repeat to zoom in additional levels.)
  3. Choose the desired mileage radius from the drop-down menu, and select the ‘Search’ button.
  4. Search results are displayed (i.e., items from the parsed ‘Content’ section with GPS coordinates falling within the search radius).

Just as with text search results, any geographic search results can be tagged for inclusion in reports.

The Road Ahead

We hope users find the improvements in iVe 1.9.2 beneficial in their forensic investigations and keep sending us feedback for future releases. Look for even more robust features and additional vehicle support in releases to come.