Forensic analysis of the infotainment system of BMW vehicles

The automotive industry is undergoing a significant transformation driven by digitization. Modern cars are transitioning to digital and are now sophisticated computers on wheels. This digital revolution is driven by the integration of various computerized systems. One of the most noticeable systems, at least for drivers and occupants, is the In-Vehicle Infotainment (IVI) system. This system offers features such as radio, music playback and streaming, navigation, hands-free calling, and, in some cases, smartphone and internet connectivity. Data generated from user interactions with the vehicle information system can be valuable for digital forensics, providing artifacts such as call logs, contacts, GPS location history, and diagnostic data. However, acquiring and analyzing these data is challenging, as there are no universal standards for IVI systems. In this paper, we study the infotainment systems of four BMW vehicles from a digital forensic perspective. Specifically, we focus on two Computer-in-Car (CIC) BMW 3 Series systems, one from 2010 and another from 2012. We also analyze the Next Big Thing Evolution (NBT EVO) systems of two 2017’s BMWs, a 5 Series and a 7 Series. For this purpose, data from the infotainment hard disks were acquired and forensically analyzed. To overcome the lack of specific open-source tools to process these datasets, we developed two modules for the well-known Autopsy forensic software. The most relevant data recovered from the hard disks of the analyzed infotainment systems include phone call history, text messages, and linked smartphone IDs, such as Bluetooth addresses, International Mobile Equipment Identity (IMEI) and International Mobile Subscriber Identity (IMSI). The results indicate that the newer NBT EVO systems have more forensically meaningful data than the older CIC ones. • Description of BMW’s CIC and NBT EVO infotainment systems. • In-depth examination of the digital forensic artifacts present in these infotainment systems’ storage. • Exploration of the benefits of carving BMW’s NBT EVO infotainment hard disk, including the recovery of deleted SQLite 3 databases. • Development of Autopsy modules to extract, process and display information from CIC and NBT EVO’s forensic images.