The accident reconstruction community has a tough job. Recreating a crash with limited to no EDR data is a challenge. It’s a good day when an EDR download provides 20 seconds of pre-crash data. The digital forensics community has the opposite problem. Months or years worth of data are recovered during an investigation, leaving an overwhelming amount of data to sift through.
Accident Reconstruction Investigators and Digital Forensics Examiners are similar, but they investigate an incident from opposite ends. Accident Recon looks at what happened in the seconds before and during a crash while a digital forensic examiner is looking at what happened hours before and after a crash.
Scenario: A woman and her 8-year old son were on their way home from his baseball game. Because it was a beautiful night, they took the scenic back roads. As their car was coming around a corner, it was hit by what the son described as a dark SUV without its lights on. Their car spun out and the mother was knocked unconscious. The dark SUV reportedly swerved, hit a small group of trees then sped off. With only the physical crash scene evidence and the statement from an 8-year-old, investigators set off in the direction the vehicle came from to question people in the nearest town. Based on tips from several locals, investigators learned the name of the likely vehicle owner. His record showed he had previous arrests for driving under the influence. Police went to his home and the owner’s girlfriend answered the door. She had a bandage on her head. She said that she got hurt helping to replace a skylight at her mother’s, and that she and her boyfriend were there most of the evening.
Given the scenario, once investigator identify a suspect vehicle, bringing in a digital forensics examiner could be critical to the case. By acquiring data from some of the other modules in the vehicle, more can be learned about what happen before, during and after a crash.
The infotainment and telematics systems in vehicles can hold a significant amount of data related to user activities, navigation information, and event data. In the scenario above, being able to place the vehicle at the scene of the incident is critical, but also being able to show where the vehicle was prior to the incident could be just as important and help develop a stronger timeline or event chain.
Consider the following:
Upon getting permission to access the suspect SUV, the infotainment and telematics systems were downloaded. Investigators are able to determine from the tracklog history that the SUV was traveling down the same roads that the accident occurred on at approximately the same time. The SUV had come from the Hideway Bar and according to the infotainment system’s event log, the head lights were not turned on when the SUV left the bar. The event log also shows the vehicle being placed into reverse and drive several times at the scene of the accident off the side of the road, near a section of trees. The tracklog history shows the SUV departing the scene of the accident and heading to the local hospital. Several hours later, the SUV navigates from the hospital to a location saved “home” in infotainment system.
The digital forensics element supplements EDR data to show a more comprehensive picture of events before, during and after an accident – creating a stronger timeline and therefore a stronger case. With data from EDR acquisitions as well as acquisitions from the infotainment and telematics systems, the moment an accident occurs becomes a longer narrative with a story that is more clearly understood than with EDR data alone.
For more information about how to use vehicle forensic data to supplement crash data, call 443.333.9301, send an email to firstname.lastname@example.org, or attend a Vehicle Forensics & iVe Certification Training course.