SAFE: a Standardized Automotive Forensic Engine for Law Enforcement Agencies

Modern automotive infotainment systems offer a substantial source of evidence for digital forensic practitioners. However, due to lack of guidance and supporting validation tools, forensic analysts struggle with both data acquisition, analysis and reporting. There are general digital forensic frameworks and legislative acts that can be applied to automotive forensics. However, processing vehicles may prove challenging due to analysis of proprietary automotive systems and on-site crime scene dynamics, including cross-functional investigation with physical forensic teams. To gain an insight into emerging challenges, the present work surveyed current automotive forensics practices across law enforcement agencies (LEAs) in the EU, NA and AP region. The result of this survey enabled a qualitative evaluation, exposing an overall limited capability along with prevalence of invasive data retrieval methods and lack of standardized investigation trajectories. Based on this evaluation, a predominant set of recommendations were derived and streamlined in SAFE: a standardized automotive forensic engine. SAFE utilizes preliminary information from the crime-scene and presents a best-practice step-by-step investigation guide for front-line vehicle forensic analysts. The engine captures analyst rating on the validity of each investigation trajectory and KNN-based content filtering is employed to improve future recommendations. SAFE, therefore, aims to optimize vehicle forensic processing from initial crime scene to the courtroom.