Retrieval of Infotainment System Artifacts from Vehicles Using iVe

The analysis of mobile devices and hard drives has been the focus of the digital forensics world for years, but there is another source of potential evidence not often considered: vehicles. Many of today’s “connected cars” have systems that function like computers, storing information they process including user data from devices synced to the system. There has been little to no research done regarding what types of user artifacts can be found on the system, how long these artifacts remain, whether or not the user can remove those artifacts, and whether certain systems provide more information than others. For this study, two different makes and models of vehicle infotainment systems were used for data acquisition: a Uconnect® system and a Toyota™ Extension Box. It was found that the Toyota™ system provided a significant amount of user information (contacts, call logs, media file information, and locations), while the Uconnect® system provided only locations. This indicates valuable user data can be obtained in this manner.