Vehicle Forensics Course

The five-day vehicle forensics class provides examiners with a complete education into how to obtain data from automobiles using advanced techniques, such as chip-off and ISP. The class teaches examiners the proper techniques for chip removal and reading, as well as using ISP techniques to recover valuable data from automobile infotainment systems.

The five (5) day course covers the vast amount of data that can be recovered from vehicles and how it can be applicable to your case or investigation. The curriculum is a mix of instructor lectures, demonstrations, and several student practical’s. This course was designed to maximize the student experience with applicable hands-on exercises, including the removal of memory chips from circuit boards and performing the non-destructive in-system programming to recover data for decoding.

Our goal is to maximize your experience by providing you with hands-on exercises that include:

• The removal of memory chips from circuit boards and performing the non-destructive In-System Programming (ISP) to recover data for decoding
• Demonstrating Chip-Off data acquisition techniques for vehicles and systems that may have been damaged due to collision, fire, or water damage

Attendees will be instructed on the following:

• Overview of data stored in vehicles
• Common OEM and aftermarket navigation and infotainment systems, as well as electronic control units
• Flash memory and its characteristics, identification of flash memory, and researching support for data extractions
• Best practice methods and proper use of workbench gear and equipment to increase student proficiency
• ISP/ Direct eMMC as a non-destructive advanced data extraction method
• Chip Off as a destructive advanced data extraction method
• Various hardware and software including Medusa Pro II, UP828P, ATOLA, PC-3000, and more
• Automated data decoding using the industry standard for vehicle forensics
• Introduction of software applications to assist examiners with manual decoding of data for unsupported memory chips, file systems, files and unallocated data

Who Should Attend:

• Digital Forensic Examiners, Automobile Theft Detectives, Crash Investigators
• Individuals and teams looking to learn the skills required to recover and analyze data from automobile navigation and infotainment systems
• Individuals and teams looking to gain the hands-on skills to remove chips from boards, as well as solder to perform ISP and other extraction methods
• Individuals and teams looking to get a better understanding of how to decode the proprietary file formats obtained from automobiles for analysis in X-ways and other digital forensic tools.

Prerequisites

• A fundamental understanding of digital forensics background is useful
• Willingness to learn concepts and techniques to recover data
• Patience and a steady hand!
• An understanding or experience in chip off, ISP or JTAG processes will assist students in grasping there techniques during this fast paced class.

Laptop Requirements:

• Windows OS
• macOS with Bootcamp Windows
• macOS alone will not work (No Virtual Machines)
• 8GB RAM (minimum)
• 100GB storage (minimum)
• You must have admin rights or have the admin password for software installation.
• NOTE: ALL Windows updates should be done prior to class