Vehicle Forensics: স্মার্ট গাড়ির দুর্ঘটনা বা হ্যাকিংয়ের পর গাড়ির কম্পিউটার থেকে ডিজিটাল প্রমাণ সংগ্রহের ফরেনসিক কৌশল!

Vehicle Forensics digital forensics-এর একটি subdiscipline যা vehicle electronics, embedded system এবং connected service থেকে evidence collection, preservation, analysis এবং reporting-এর সাথে সম্পর্কিত। Scope অনেক বিস্তৃত-

• Accident Reconstruction: pre-crash speed, brake application, throttle position, steering input।
• Criminal Investigation: location history, phone pairing, contact, message।
• Insurance Fraud Detection: staged accident, false claim।
• Cyber Attack Investigation: post-hack ECU state, intrusion artifact।
• Civil Litigation: product liability, warranty dispute।
• Stolen Vehicle Recovery: GPS, telematics tracking।

NIST এবং SWGDE (Scientific Working Group on Digital Evidence)-এর vehicle forensics-এর dedicated guideline publish হয়েছে।

Event Data Recorder (EDR)

"Black box" for cars। NHTSA-এর regulation অনুযায়ী US-এ ২০১৪+ all light passenger vehicle-এ mandatory। EDR মূলত airbag control module-এ embedded। Pre-crash 5-20 second data record-

• vehicle speed।
• throttle/accelerator position।
• brake application।
• engine RPM।
• steering wheel angle।
• seat belt status।
• airbag deployment time।
• impact severity (delta-V)।

EDR extraction-এর জন্য Bosch CDR (Crash Data Retrieval) tool industry standard। Most law enforcement এবং accident reconstruction firm এটি ব্যবহার করেন।

Infotainment System (IVI)

Sat-nav, audio, Bluetooth pairing, smartphone integration। Rich data source-

• recent destination।
• saved location (home, work)।
• track played, podcast।
• paired phone identifier (Bluetooth MAC, contact, message)।
• text message synced (যদি Android Auto/CarPlay)।
• call log।
• Wi-Fi network connected।
• user account credential (Tesla, BMW ConnectedDrive)।

IVI extraction often most valuable for criminal investigation। Tools: Berla iVe, MSAB XRY, Cellebrite Auto, ZetX (specialized in vehicle telematics)।

Telematics Control Unit (TCU)

Cellular-connected module। Manufacturer cloud-এ data send করে এবং remote command receive করে। Forensic value-

• precise GPS history।
• cellular connection log।
• remote command history (start/stop, lock/unlock)।
• diagnostic trouble code (DTC)।
• firmware version।

TCU data typically manufacturer cloud-এ persists, এবং law enforcement subpoena/legal request-এর মাধ্যমে obtain।

ECU Memory

প্রতিটি ECU-এ flash memory, EEPROM, RAM। Specialized event এবং setting-

• transmission ECU: gear shift history।
• engine ECU: fault code, run hour।
• ABS ECU: brake event।
• body ECU: door, window, lock event।

ECU extraction physical method-এ (chip-off, JTAG, BDM) বা OBD-II port-এর through।

OBD-II Port

On-Board Diagnostics 1996+ vehicle-এ standard। DTC, sensor data, freeze frame data। Real-time monitoring এবং live data capture।

OBD-II forensic tool: AutoEnginuity, Ross-Tech VCDS (VAG-specific), specialized scanner।

Connected Mobile App

OEM mobile app (Tesla App, BMW ConnectedDrive, FordPass, Toyota Connected, Hyundai Bluelink) cloud-side rich data store করে। Vehicle history, location, command audit log।

App-side extraction: smartphone forensic tool (Cellebrite, Magnet AXIOM)। Cloud-side extraction: legal request to OEM।

Aftermarket Device

Dashcam (Nextbase, BlackVue, Garmin), insurance telematics dongle (Progressive Snapshot), fleet tracker — সবগুলোই additional evidence source।

Forensic-relevant network-

• CAN bus (Controller Area Network): most common, ECU intercommunication। CAN-Hi এবং CAN-Lo, 500 kbps typical।
• LIN bus: Local Interconnect Network, low-speed sensor।
• FlexRay: high-speed, safety-critical (newer).
• Automotive Ethernet: gigabit, ADAS, infotainment।
• MOST (Media Oriented Systems Transport): legacy infotainment।

Forensic acquisition-এ Vehicle Spy, CANalyzer, SavvyCAN — bus traffic capture।

Step 1 — Scene Documentation

Vehicle position, damage extent, photographic documentation। Witness account, weather, road condition।

Step 2 — Vehicle Preservation

Battery disconnect সাবধানে — অনেক ECU-এ volatile state। তবু default practice — investigation-এর জন্য battery preserved। Tamper-proof seal।

Step 3 — Acquisition Planning

কোন data source priority? Time-sensitive কী (volatile data)? Hardware approach (OBD-II, chip-off) vs cloud subpoena?

Step 4 — Acquisition

EDR Extraction

Bosch CDR tool বা equivalent। Connect via DLC (Data Link Connector — OBD-II port) বা directly module-এ (if vehicle severely damaged)। PDF report generated containing EDR data।

IVI Extraction

Berla iVe — comprehensive IVI tool যা ৪০০০+ vehicle model support করে। OBD-II বা direct connection।

Chip-Off Forensics

Severely damaged বা physically destroyed module-এর জন্য last resort। Flash chip desolder, specialized programmer (UP-828, RT809H) দিয়ে read।

JTAG/Boundary Scan

Some ECU JTAG port expose করে। Specialized adapter দিয়ে read।

CAN Bus Capture

Driving scenario বা specific event reproduce-এ live bus traffic capture।

Cloud Data Request

OEM-এর forensic liaison contact, court order/subpoena।

Step 5 — Analysis

Tool-specific format (Berla iVe extraction → SQLite database, EDR → PDF report)। Custom parser, hex editor, SQLite browser দিয়ে deep analysis।

Timeline reconstruction critical — multiple data source-এর timestamp synchronize।

Step 6 — Reporting

Court-admissible report। Methodology, finding, limitation clear documentation।

Commercial

• Berla iVe: industry-standard IVI forensics। US, Europe, Asia coverage।
• Bosch CDR: EDR extraction। NHTSA-recognized।
• MSAB XRY Vehicle: mobile + vehicle forensics combined।
• Cellebrite Auto / Cellebrite Frontliner: integrated mobile-vehicle।
• Magnet AXIOM: cross-platform forensic suite।
• ZetX TraX: telematics-focused।
• DataPilot Vehicle: police/military application।

Open-Source / DIY

• SavvyCAN: CAN bus analysis।
• Wireshark: with CAN dissector plugin।
• CANtact: hardware adapter (USB-to-CAN)।
• OpenXC (Ford-supported): vehicle data API।
• Comma.ai openpilot: ADAS hacking context।

Boston Marathon Bomber Investigation (2013)

Mercedes-Benz GPS data and Bluetooth pairing log Tamerlan এবং Dzhokhar Tsarnaev-এর movement reconstruction-এ critical ছিল। OnStar-style telematics data investigators-কে suspects-এর route map করতে সাহায্য করেছিল।

Charlie Miller / Chris Valasek Jeep Cherokee Hack (2015)

UConnect head unit-এর Sprint cellular interface থেকে remote exploitation। Investigation post-mortem-এ TCU firmware analysis এবং CAN bus interaction reconstruction প্রয়োজন ছিল।

Multiple Tesla Autopilot Crashes

NHTSA investigation-এ Tesla Autopilot log critical — engagement state, driver intervention, sensor readings। ২০২১-২০২৪-এ multiple Autopilot-related fatality investigation।

Ride-Sharing Driver Murder Investigation (2022)

Uber driver-এর smartphone এবং vehicle infotainment-এর pairing log-এ suspect-এর identity confirm হয়েছিল।

Stolen Vehicle Recovery

OnStar, BMW ConnectedDrive, Tesla App — সব OEM-এর "Find My Car" feature law enforcement-এর সাথে cooperate করে stolen vehicle recover করে।

Cyber-physical attack scenarios-

Remote Exploitation

UConnect, Mercedes mbrace, BMW ConnectedDrive — multiple cellular interface-এর vulnerability historical। Investigation-এ-

• TCU firmware analysis।
• cellular log (carrier subpoena)।
• CAN bus injection trace।
• ECU memory snapshot।

CAN Injection Attack

Recent vehicle theft trend — CAN bus injection through headlight wiring (Toyota RAV4, Lexus, Range Rover thefts in UK)। Investigation-

• CAN bus log।
• damaged wiring inspection।
• aftermarket device detection।

Bluetooth/Wi-Fi Attack

In-cabin attack via paired smartphone or rogue hotspot। IVI log critical।

Keyless Entry Relay Attack

Passive Keyless Entry and Start (PKES) relay attack। Specific wireless event log।

EV Charging Attack

EV charger compromise (CCS, CHAdeMO, Tesla Supercharger)। Charging session log, OCPP communication।

Vehicle forensics privacy-sensitive। GDPR (EU), CCPA (California), Bangladesh-এর draft Personal Data Protection Act — সবগুলোই vehicle-generated personal data protection require করে।

Legal authorization-

• search warrant (criminal investigation)।
• subpoena (civil case)।
• vehicle owner consent।
• accident investigation context (legal driver responsibility)।

OEM-এর data sharing policy variable। Tesla relatively transparent। German manufacturer privacy-strict। Japanese OEM cooperative-with-warrant।

US-এ Electronic Communications Privacy Act (ECPA) এবং Stored Communications Act (SCA) applicable।

Chain of custody critical-

• evidence acquisition documentation।
• hash verification।
• transfer log।
• analyst credential।

Skilled adversary forensic artifact destroy করতে পারেন-

• factory reset infotainment।
• ECU re-flash।
• DCM (Data Communication Module) removal।
• battery disconnect to erase RAM।
• physical destruction of head unit।

Investigator-এর tools — chip-off, JTAG, cloud-side data recovery — অনেক ক্ষেত্রে data recovery-এ effective।

Software-Defined Vehicle

Tesla, Rivian, Lucid, এবং traditional OEM-এর software-defined platform। Frequent OTA update। Forensic capture moment-in-time-এর challenge — yesterday-এর firmware আজ-এর সাথে identical নাও হতে পারে।

Autonomous Vehicle

L3-L4-L5 autonomous vehicle-এর জন্য NHTSA-এর "Standing General Order 2021-01" — autonomous mode-এ crash-এর mandatory reporting। Comprehensive log, sensor data, decision log।

Cloud-Heavy Architecture

Modern vehicle-এর অনেক data কেবল cloud-এ persists। Vehicle-side data ephemeral। Cloud forensics increasingly important।

V2X Communication

DSRC, C-V2X — vehicle communication standard। Investigation-এ road-side unit log।

EV-Specific Evidence

Battery Management System (BMS) log। Charging history। Cell voltage anomaly।

Vehicle forensic readiness-

For Law Enforcement:

• specialized training (Berla, IACP automotive forensic course)।
• proper tool acquisition (Berla iVe, Bosch CDR)।
• OEM liaison contact establishment।
• evidence handling SOP।

For Insurance:

• standard EDR extraction protocol।
• fraud detection use case।

For OEM:

• forensic-friendly architecture (tamper-evident, log persistent)।
• security incident response capability।
• coordinated vulnerability disclosure program।
• regulatory cooperation framework।

For Owner/Privacy:

• understand what data is collected।
• review privacy setting।
• factory reset before selling।
• avoid persistent pairing if borrowed vehicle।

For Fleet Operator:

• driver awareness training।
• incident response plan।
• legal counsel on data privacy।

For Defender Community:

• ISAC participation (Auto-ISAC)।
• threat intelligence sharing।
• security research collaboration।