Multi-party demands-based digital forensics solution of the accident data from the in-vehicle devices

In recent years, with the increasing number of automobile safety incidents, automobile forensics has received widespread attention. With the deep integration of automobiles and information technology, the amount of data generated by in-vehicle devices has proliferated, and how to effectively acquire, analyze, and preserve these data has become a key problem that needs to be solved urgently. Based on this, this paper proposes a digital forensics solution for in-vehicle devices oriented to multi-party demands, covering the whole process of demand analysis, forensics preparation, evidence extraction and analysis. Through empirical research on three different types of Telematics BOX, five data types including firmware data, communication data, user data, vehicle identification data, and vehicle event data are extracted and analyzed to form demand associations with multiple stakeholders, such as vehicle users, insurance companies, and automobile manufacturers. The results show that the proposed digital forensics scheme is feasible and practical, can accurately identify and extract data that are closely related to accident investigation, fills in the gaps of existing work on forensics methods for in-vehicle devices, and provides a practical framework and theoretical basis for the continuous development of intelligent connected vehicles.