Vehicle Forensics: A Rapidly Growing Source of Evidence
Written by KRISTI MAYO   

AUGUST 2017: IN THE EARLY HOURS of the morning, several individuals get into an altercation at a bar. The incident moves outside to the streets where an 18-year-old throws a bottle, damaging the side-view mirror of a red Ford Mustang belonging to one of the antagonists. The 18-year-old flees with a companion on a moped. Meanwhile, the Mustang owner, in a rage, pursues them at high speed, until moments later the Mustang crashes into the moped from behind, leaving one rider dead, another severely injured, and a homicide case for detectives to investigate.

Photo Credit: Metropolitan Police

There were differing stories from witnesses, gaps in the evidence gathered from closed-circuit cameras, forensics from two vehicles and the crime scene itself. All left key questions about precisely what had happened during the chase. Prosecutors and police were pursuing a charge of “death by dangerous driving” instead of murder, based on the initial investigation by the Metropolitan Police Service in London.


But a relatively new source of digital evidence—the data stored inside the vehicle systems—revealed that the driver of the Mustang was accelerating as his car approached and at the precise moment of impact with the moped. Additional data was found on the vehicle systems that showed deliberate actions taken by the driver of the vehicle to harm the riders of the moped, as well as pinpointing the precise route taken from the bar to the location of impact. With this new evidence in hand, the charge was elevated to murder, and the prosecution argued decisively that, “It was rapid, it was brutal, and it was unrelenting. He pursued the moped down a straight stretch of road at speed. Not to apprehend the two people on it, but to mow them down for daring to damage his prized vehicle.” (Sharman, 2018)

A jury convicted the driver of murder as well as attempting to inflict grievous bodily harm. He received a 23-year sentence. "It quickly became apparent that the assailant had targeted the moped,” said the police detective assigned to the case.

Over the last five years, the data stored in vehicle systems has become a rich source of key evidence for investigators and prosecutors. Modern vehicles in particular are a complex network of highly integrated electronic systems. According to Berla Vehicle Forensics, typical vehicles contain more than 75 computer systems, run over 150 million lines of code, and generate more that 25 gigabytes of data per hour.

Much of the critical data that can be acquired from vehicles comes from the infotainment and telematics systems. The data provides a wealth of information, and falls into three main categories: Event Data (speed, acceleration, braking, shifting, doors opening/closing, etc.), Location Data (destinations, routes, and tracklogs) and data from Connected Devices, such as mobile phones, that have been physically or wirelessly connected to a vehicle (calls, texts, contact lists, apps, images, etc.)

Recognizing the value and potential of vehicle-system forensics, the U.S. Department of Homeland Security Science and Technology Directorate’s (S&T’s) Cyber Security Division initiated a partnership in 2013 with the Berla Corporation, a U.S.-based company, to accelerate this technology. The partnership has resulted in the development of a collection of vehicle-system forensic tools that is being adopted by more and more law enforcement agencies worldwide. In 2017, Berla entered into a strategic partnership with MSAB in order to enable investigators to analyze the data acquired from vehicle systems side-by side with the data acquired from mobile phones. In July 2018, Berla celebrated five years in the vehicle system forensics market. The company has grown from supporting less than 100 models of vehicles when they first started in 2013, to well over 12,000 models worldwide.

Two of the biggest challenges for law enforcement agencies conducting vehicle system forensics are identifying the systems installed in a vehicle and knowing where those systems are located within the vehicle. There are other challenges such as knowing what data may be contained in those systems. In response to these challenges, Berla developed the iVe-Mobile app that gives investigators the ability to look up vehicles and determine what data may be stored in the systems as well as provide instructions for removing and accessing the vehicle systems. The iVe-Mobile app is available on iOS and Android and is currently free for law enforcement agencies.

With more than 1.6 billion vehicles on the road worldwide, the field of vehicle-system forensics is maturing at a rapid rate. More and more law enforcement agencies are using this technology to uncover key evidence to help investigators determine what happened, where it occurred, and who was involved.

About the Authors

Ben LeMere is the CEO and Co-Founder of Berla Corporation, a provider of hardware and software solutions for forensically acquiring and analyzing user data and event history from vehicle systems. He is a widely recognized subject-matter expert in cyber security and digital forensics with more than 20 years of military and federal government service. Under his leadership, Berla continues to support the Department of Defense, Homeland Security, and the global intelligence and law enforcement communities.

Joel Bollö is the CEO of MSAB, a global leader in mobile forensic technology and the makers of XRY, XAMN and XEC software, used by police, law enforcement, military, government intelligence agencies, and forensic labs in more than 100 countries worldwide to investigate crime, gather intelligence, and help make the world safer.


Sharman, Jon. “Driver chased moped rider after wing mirror broken, ran him down then beat him as he lay dying,” The Independent (May 2, 2018). Retrieved online:

This article appared in the Winter 2018 issue of Evidence Technology Magazine.
Click here to read the full issue.

< Prev   Next >

Digital-Image Management at Mass Gravesites

SKELETONIZED REMAINS that were carefully unearthed from the desert sands of Iraq tell their own story: the bones of an adult, still dressed in a woman’s apparel, lie supine. The skull is perforated by a bullet hole. Tucked in the space between the ribs and the left humerus is a much smaller skeleton, bones in the skull un-fused, and the fully clothed body partially swaddled in a blanket.