<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-vehicle-forensics
description: >-
  Vehicle digital forensics covering infotainment system extraction,
  CAN bus data analysis, GPS/navigation history recovery, event data
  recorder (EDR) readout, OBD-II diagnostic data, and telematics
  module analysis for accident reconstruction and criminal investigations.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - vehicle-forensics
  - can-bus
  - obd-ii
  - edr
  - infotainment
  - gps-history
  - telematics
  - accident-reconstruction
  - automotive-forensics
  - black-box
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1005", "T1200"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "SAE J1979", "ISO 15765"]
---

# Performing Vehicle Forensics

## Overview

Modern vehicles contain multiple digital evidence sources: infotainment
systems store Bluetooth pairings, call logs, and navigation history; CAN
bus networks log diagnostic events; EDRs capture crash data; and telematics
modules record GPS coordinates. This skill covers forensic extraction and
analysis of these vehicle data sources.

## Prerequisites

- OBD-II diagnostic interface (ELM327 or professional scanner)
- `can-utils` for CAN bus interaction, `python-can` library
- CDR (Crash Data Retrieval) tool for EDR readout
- `iVe` or `Berla iVe` for infotainment extraction (commercial)
- Physical access to vehicle OBD-II port (under dashboard)

```bash
sudo apt install can-utils
pip install python-can obd cantools
```

## Key Concepts

### Vehicle Evidence Sources

| Source | Data Type | Access Method |
|--------|-----------|---------------|
| Infotainment | Contacts, calls, SMS, nav history | USB/JTAG extraction |
| EDR / Black Box | Pre-crash speed, braking, seatbelt | CDR tool via OBD-II |
| CAN Bus | Real-time vehicle signals | OBD-II adapter |
| Telematics (TCU) | GPS tracks, remote commands | Cellular/OBD-II |
| Dashcam | Video/audio recordings | SD card extraction |
| Key Fob | Pairing history, last use time | RF analysis |

### CAN Bus Protocols

| Protocol | Standard | Use |
|----------|----------|-----|
| CAN 2.0A | ISO 11898 | Standard 11-bit IDs |
| CAN 2.0B | ISO 11898 | Extended 29-bit IDs |
| OBD-II | SAE J1979 | Diagnostic PIDs |
| UDS | ISO 14229 | Unified diagnostic services |

## Workflow

### Step 1: OBD-II Diagnostic Data Extraction

```bash
# Connect ELM327 adapter and read DTCs
python3 -c "
import obd
connection = obd.OBD('/dev/ttyUSB0')
print('VIN:', connection.query(obd.commands.VIN).value)
print('Speed:', connection.query(obd.commands.SPEED).value)
print('RPM:', connection.query(obd.commands.RPM).value)
print('DTCs:', connection.query(obd.commands.GET_DTC).value)
print('Fuel:', connection.query(obd.commands.FUEL_LEVEL).value)
"

# Read freeze frame data (state at time of DTC)
python3 -c "
import obd
conn = obd.OBD('/dev/ttyUSB0')
dtcs = conn.query(obd.commands.GET_DTC).value
for code, desc in dtcs:
    print(f'DTC: {code} — {desc}')
    print(f'  Freeze Frame Speed: {conn.query(obd.commands.SPEED).value}')
"
```

### Step 2: CAN Bus Traffic Capture

```bash
# Set up CAN interface
sudo ip link set can0 type can bitrate 500000
sudo ip link set up can0

# Capture CAN traffic
candump can0 -l -f candump.log

# Filter for specific arbitration IDs
candump can0,7DF:7FF    # OBD-II requests only

# Replay captured traffic (for analysis — not on live vehicle)
canplayer -I candump.log vcan0=can0

# Decode CAN frames using DBC file
cantools decode evidence.dbc candump.log
```

### Step 3: Infotainment System Extraction

```bash
# If infotainment runs Android Automotive
adb connect <infotainment_ip>
adb pull /data/data/com.android.bluetooth/ ./bt_data/
adb pull /data/data/com.google.android.apps.maps/ ./maps_data/

# Extract paired Bluetooth devices
sqlite3 bt_data/databases/bluetooth.db \
  "SELECT address, name, timestamp FROM devices;"

# Extract navigation history
sqlite3 maps_data/databases/gmm_storage.db \
  "SELECT * FROM destinations ORDER BY timestamp DESC;"

# USB storage mount history
adb shell dumpsys usb > usb_history.txt
```

### Step 4: GPS and Navigation History Recovery

```bash
# Parse GPS track files (GPX format from dashcam/nav)
python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('track.gpx')
ns = {'gpx': 'http://www.topografix.com/GPX/1/1'}
for pt in tree.findall('.//gpx:trkpt', ns):
    lat = pt.get('lat')
    lon = pt.get('lon')
    time = pt.find('gpx:time', ns)
    print(f'{time.text if time is not None else \"N/A\"}: {lat}, {lon}')
"

# Convert NMEA sentences from GPS module
grep 'GPRMC\|GPGGA' gps_raw.log | head -20
```

## Detection

```yaml
title: Vehicle Forensics Detection
id: 331a13c3-0943-48e9-a97b-b2853bbecb23
status: experimental
description: Detects suspicious activity related to performing vehicle forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*vehicle*"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.t1200
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Vehicle VIN documented and verified
- [ ] OBD-II diagnostic data extracted (DTCs, freeze frames)
- [ ] CAN bus traffic captured during relevant time window
- [ ] Infotainment data extracted (contacts, calls, navigation)
- [ ] GPS/navigation history recovered and mapped
- [ ] EDR data retrieved (if crash investigation)
- [ ] All extractions timestamped and hashed

## References

- [SAE J1979 — OBD-II Diagnostic PIDs](https://www.sae.org/standards/content/j1979/)
- [python-obd — OBD-II Library](https://github.com/brendan-w/python-OBD)
- [can-utils — Linux CAN Utilities](https://github.com/linux-can/can-utils)
- [cantools — CAN DBC Parser](https://github.com/cantools/cantools)
- [Berla iVe — Vehicle Forensics](https://berla.co/)
