Table of Contents

    Topic review

    Vehicle Forensics

    View times: 14
    Submitted by: Cheolhee Yoon


    Traffic accident investigation has been used to reconstruct the cause and condition of the accident by using images and driving record data that introduce IT technology, and to analyze both sides of the accident, skid marks, and vehicle damage to identify the perpetrators and victims. However, level 3 self-driving vehicles are the most important factor in determining the cause and imputation of the accident by the driver or manufacturer with control information at the time of the accident. It is also developing into a network and connected vehicle with various restrictions such as the burden of the price of sensors equipped with self-driving cars and climate and rapidly changing road traffic information. In addition, network and connected vehicle driving data are stored on the outside, or various devices and sensors are installed to store information on the outside for convenience in operation, and efforts to enact laws are continuing.

    1. Introduction

    When a traffic accident is reported to the police station in the vicinity, the on-site officer and the traffic accident investigator identify the cause of the accident based on various types of evidence (e.g., skid marks, a vehicle’s damaged parts, simulation etc.) and identify the perpetrator and the victim, with many refusing to acknowledge that they themselves are the perpetrator. Recent traffic accident investigation involves the use of video records and driving records (EDR, DTG) to identify the cause of the accident and distinguish the perpetrator from the victim. When there are no video records or driving records, however, there are difficulties in determining the exact cause of the accident when the investigation is based on statements from both parties.

    Self-driving cars should be designed and developed considering a variety of cases, including vehicle structure, various sensors, actuators, communication failures, potential software errors, inadequate control, potential collision possibilities, off-road, loss of stability, violations of traffic laws, and abnormal driving. Among the matters considered in the design of self-driving cars, the Ministry of Land, Infrastructure, and Transport recommends that mode data should be traceable in the final report of the 2018 self-driving car convergence future forum. In addition, the early self-driving vehicle was equipped with sensors in the vehicle to recognize the surrounding environment and drive autonomously based on the collected information. However, to overcome various constraints such as the price burden of sensors and limitations of perception by weather or road environment, we are developing them by sharing various information through communication with roads and infrastructure. In advanced countries such as the U.S., Germany, and the U.K., Cooperative ITS (C-ITS), which focuses on the exchange of information between combined vehicles and road infrastructure, is actively promoting in advanced countries such as the U.S. and Europe [1].

    Referring to Figure 1, Digital data collected by sensors for autonomous driving is stored within a vehicle, but numerous IT companies and motor companies such as Samsung, Harman, Microsoft, and Baidu are developing ways to store data in a cloud because of the large amount of data. South Korea, in particular, defined the method of transmitting and storing vehicle operation data to the center in real time, as in the figure below, based on location (track) information for safe driving and operation status information based on the location of the RSU by way of wireless communication. When a vehicle equipped with telematics service transmits CAN or ECU information, vehicle status information (direction, speed etc.) obtained through OBD-II, location (track) information calibrated by correcting the GPS received information within the vehicle, and information on vehicle events to a nearby roadside device (RSU), the location-based vehicle data for each vehicle collected by the roadside device is automatically sent to a center at regular intervals or when it occurs and stored in a database (DB) within [2].

    Figure 1. Location-Based Vehicle Data Collection Service.

    Countries leading the development of self-driving cars such as the U.S., the U.K., Germany, and Japan are pushing for laws to identify the attribution of responsibility for accidents in Level 3 self-driving vehicles from drivers to manufacturers or software developers [1]. However, there is no way to prove the cause of the accident. Even if the law is enacted, the law is useless. Therefore, in order to prove the cause and responsibility of the accident, the integrity of the accident data must be ensured, among other things, for accuracy and fairness. Therefore, using blockchain technology, a technology that has proven the accuracy and integrity of current data, it is possible to identify the exact cause of the accident.

    2. Forensic of Digital Data Collected from the Accident Vehicle

    2.1. Forensic of ECU(Electronic Control Unit) Vehicle Sensor, ADAS Vehicle Sensor, and LIDAR

    Per Diverse technology is being applied to vehicles along with advancements in IT. As vehicles become more advanced, the use of ECUs (Electronic Control Unit) is also on the rise. An ECU has control over various aspects like playing a key role in driving involving the engine, brakes, and steering system as well as devices for user convenience such as air bags, the audio system, and the air conditioner. As vehicles become more advanced, more ECUs are being installed in them. Although there are some differences according to vehicle type and specifications, electric parts can be divided into the powertrain, chassis, body, infotainment, safety, and security parts. The powertrain is in charge of engine control, the self-diagnosis device, and cruise control, the chassis is in charge of steering, brakes, and suspension, while infotainment is in charge of voice recognition, the navigation system, and multimedia. The safety and security parts include self-parking, anti-collision, radio remote locking, and tire air pressure. Data on vehicle speed, acceleration, and deceleration status, wearing or not wearing a seatbelt, and airbag deployment before and after the accident is collected from vehicle sensors and stored in the EDR. Vehicle sensor data usually occurs in real time during operation of a vehicle, so it is expected to be stored on an external server through an external storage device or communications. A method of determining curved lanes by combining a direction sensor and an acceleration sensor was presented [3]. Two sensors were attached to a vehicle, which was driven on a road, and the data obtained was used to detect straight lanes and curved lanes. In this study, curved roads were not detected when driving at nighttime or in the rain and curved lanes were not detected when they were disconnected, which were existing limitations. However, it was presented that analysis is possible without being affected by the environment when using both sensors. Research and development of a system for storing data generated during driving on high-speed imaging-based smart cameras was conducted. Using inter-vehicle communication functions, we have announced how to collect and store video records obtained from cameras included in the device, RPM, vehicle speed, information on the positions of the acceleration pedal, the gear, the steering wheel, and the deceleration pedal [4]. And ADAS (Advanced Driver Assistance System) is a system that uses various advanced sensors, GPS, communications and intelligent imaging equipment to enable a vehicle itself to perceive its surroundings, assess the situation, and then control the vehicle or use warning sounds, lights, or vibrations to alert the driver of risk factors, thereby helping a driver to drive safely. Vehicles recently released by manufacturers (e.g., Mercedes, Aud, Hyundai etc.) which are equipped with high tech functions and most of the functions enabling safe driving are ADAS technology [5]. With the development of ADAS technology and when connected to a network (like 5G or DSRC) to conduct V2X (Vehicle to everything) service, which means object communication, Level 4 automotive driving will be possible by using information on surrounding road conditions (e.g., nearby vehicles, ADAS maps, precision maps etc.) as s Visualization of ADAS sensor information.

    Sensors used in ADAS use Inertial Measurement Unit (IMU), Global Positioning System (GPS), cameras, and LIDAR for location recognition, while cameras, LIDAR, and RADAR are used for identifying objects. Cameras enable accurate identification of form information, including traffic sign recognition, blind spot detection, and lane departure. RADAR (RAdio Detection And Ranging) sends out electromagnetic waves into the air and uses the waves that bounce off the objects to detect their direction and speed. Because laser uses microwaves, it can measure distance with stability night and day and complements the camera. LiDAR (Light Detection And Ranging) works on the same principle as RADAR but uses high-powered pulse laser so the distance information it gains is different. It sends out millions of laser beams in one second to measure distance, so it combines all the collected information and can reconstruct it in 3D. RADAR and image sensors create approximately 100 MB of data per second, and the internal ECU creates 50 MB of fusion sensor data per second. For example, the data collected by 5 RADAR sensors and 2 image cameras per second is estimated to be about 1 GB. If an autonomous driving vehicle were to drive for one day with a generated data rate of 1 GB per second, the total amount of data needed would be approximately 30 TB [6]. Advances in ADAS technology are made with the goal of fully autonomous driving, and since the amount of data collected by cameras and various sensors for fully autonomous driving is increasing, it would be difficult to store it within the vehicle. Therefore, Samsung Electronics-Harman is developing autonomous driving technology based on cloud serving without a computer within the vehicle while Microsoft Corp. is developing a cloud and AI-based autonomous driving service (e.g., Volkswagen Automotive Cloud, Baidu’s Apollo Alliance etc.). As such, there is a tendency to shift to external storage without storing driving data internally. Accordingly, the collection of vehicle data for vehicle digital forensics also needs to change to a method of analysis that utilizes external data.

    2.2. Forensic of Digital Sensor Data Stored in Infotainment and Log Data

    A vehicle’s infotainment system (e.g., navigation system, TPEG, assisted parking etc.,) supports driving convenience (e.g., OBD, ADAS, communication between vehicle and the infrastructure, communication between vehicles), safe driving, and infotainment (e.g., DMB, audio system, games, mobile office etc.). Table 1 shows The table below lists the basic infotainment functions of a Ford Fiesta, which does not have a navigation system. It is possible to see the information used by the user, such as the call record, the information of the connected device, information on texts, and Internet use, and the information stored in the system [7].

    Table 1. Forensic data of infotainment.

    Data Type Location Meaning
    Device Lists User Data MediaCache/ Names
    Device Serial
    User Data MediaCache/  
    Device playlist User Data MediaCache/  
    Contact Names User Data GrammarFSM/
    iVe Report
    Arbitrary files
    SMS User Data TxtMsgApp/ Potential SMS information
    Registry System Documents and Setting  
    User Activity User Data Windows/LogFiles/  
    System Windows/LogFiles/ Windows memory dump
    System Events System Windows/ LogFiles/  
    Internet History Application Cookies/ Temporary  

    VMDS (Vehicle Mounted Data System) monitors vehicle information in real time and also analyzes and stores information pertaining to the vehicle and the driver. This system obtains vehicle and location information from the terminal installed in the vehicle at regular intervals and then stores and analyzes it on the control server and keeps information on driving characteristics, operation statistics, and operation history. Also, it provides real time vehicle diagnostic information, making it easy for the driver or vehicle manager to respond in the event a failure occurs, and an operation log is created automatically to improve bad driving habits and reduce vehicle maintenance costs [8]. The information collected for vehicle information analysis includes vehicle speed, RPM, mileage, and vehicle location information using fuel injection time and GPS, which is transmitted to the server in real time. By utilizing time and driving information related to an accident like GPS information, which is data collected in the VDMS, vehicle speed, and RPM, it is possible to determine the speed at collision and whether speed was reduced when an accident occurs to identify the possibility of avoiding the accident. Probe Data Service on Location is closely linked to autonomous driving vehicles. The collection of Probe Data on Location is based on WAVE Communication and is a service where all vehicles and roadside base stations collect location (track) information and driving status in real time from the device installed on the vehicle and transmit it to the traffic control center where it is stored. When Probe Data Service on Location is supported, collection of driving records will become much faster and investigation using more objective data is expected. As shown in [9][10], it is possible to identify the location of the accident by using the collected information, and more accurate accident investigation is possible through the use of driving-related information such as speed at the time of the accident and RPM.

    The entry is from 10.3390/app11031268


    1. Ministry of Land Infrastructure and Transport. 2018 Final Report on Self-Driving Automobile Convergence Future Forum Operation Services; Ministry of Land Infrastructure and Transport: Sejong, Korea, 2018.
    2. ITSKorea. Part 1. Function and Performance Requirement Specification; Ministry of Land, Infrastructure and Transport: Sejong, Korea, 2017.
    3. Kim, G.; Jeong, S.; Mun, H.; Kim, C. Design of Curve Road Detection System by Convergence of Sensor. J. Digit. Convergence 2019, 14, 253–259.
    4. Son, S.; Kim, T.; Jeon, Y.; Baek, Y. Smart Camera Technology to Support High Speed Video Processing in Vehicular Network. J. Korean Inst. Commun. Inf. Sci. 2015, 40, 152–164.
    5. Back, S.; Jang, J. Using OBD2 Protocol, a Implement of Blackbox with Vehicle State Data and the External Video; Korea Institute of information and Communication Engineering: Seoul, Korea, 2010; pp. 97–100.
    6. Andres, P. Data recording for ADAS development—Scalable recording of sensor and ECU data. Elektronik Automot. 2017, 2–3.
    7. Jesse, L. Vehicular Infotainment Forensics: Collecting Data and Putting It into Perspective; University of Ontario Institute of Technology: Oshawa, ON, Canada, 2017.
    8. Korea, Transportation Safety Authority, Digital Tachograph Analysis System. Available online: (accessed on 12 November 2019).
    9. Choi, J.; Yoon, D.; Kim, H.; Park, J. Vehicle and Driver Management System Through Vehicle Information Analysis. J. Korean Inst. Commun. Sci. 2008, 25, 3–9.
    10. Kwon, O. Specification Part 1. Function and Performance Requirement Specification. ITS KOREA 2017, 1, 1–23.