Advanced Acquisition Vehicle Forensics

Vehicle-Forensics-Training-Hero.jpg

This in-depth 5-day training course will provide students with an elevated understanding of advanced acquisition and decoding techniques of data recovered from vehicle infotainment and navigation systems, as well as other electronic control units, using advanced data recovery and decoding techniques like Chip-off and ISP.

5 days, 09:00 AM - 05:00 PM

Victoria, BC
  • 759 Vanalaman Ave.
  • Victoria
  • Saanich
  • BC
  • V8Z 7X7
  • Canada
  • $3,950.00 excl. Tax

Description

Join us and discover the vast amounts of data that can be recovered from automotive infotainment and navigation systems and learn how your findings can be applied to your case or investigation.

The course curriculum consists of:

  • Instructor Lectures
  • Hands-On Demonstrations
  • Student Practical Exercises

Our goal is to maximize your experience by providing you with hands-on exercises that include:

  • The removal of memory chips from circuit boards and performing the non-destructive In-System Programming (ISP) to recover data for decoding,
  • Demonstrate Chip-Off data acquisition techniques for vehicles and systems that may have been damaged due to collision, fire, or water damage.
  • The Chip-Off and ISP processes that are featured in this training will offer students a basic understanding of how to perform these techniques, however, it is recommended that students take further training in order to perfect these skills.

The intent of this course is to provide options to forensics examiners that go above and beyond the scope of the vehicles supported by Berla iVe.

Target Audience:

Digital Forensic Examiners, Automobile Theft Detectives, Crash Investigators Individuals and teams looking to learn the skills required to recover and analyze data from automobile navigation and infotainment systems

Individuals and teams looking to gain the hands-on skills to remove chips from boards, as well as solder to perform ISP and other extraction methods

Individuals and teams looking to get a better understanding of how to decode the proprietary file formats obtained from automobiles for analysis using X-ways and other digital forensic tools.

Prerequisites

This class is open to all digital forensic professionals. 

  • A fundamental understanding of digital forensics background is useful.
  • Willingness to learn concepts and techniques to recover data.
  • Patience and a steady hand!

*While not a prerequisite, it is recommended that students have a basic understanding of JTAG, Chip-Off, and ISP processes, as it will assist them in grasping some of the techniques covered in this fast-paced class.

Due to the sensitive nature of our curriculum, and industry, all potential students are subject to vetting prior to enrollment. We reserve the right to refuse registration to any person that does not meet our established criteria.

Course Itinerary

Day 1 Overview

  • Vehicle electronic control units
  • Introduction to flash memory
  • In-System programming data extraction process

Day 2 Overview

  • Reading memory via ISP
  • Using Kali Linux
  • Recognizing QNX file systems

Day 3 Overview

  • Chip removal and reattachment process
  • Reading memory with a programmer

Day 4 Overview

  • Disassembly tools
  • Automated extraction tools
  • Connected cars
  • Vehicle Data

Day 5 Overview

  • Unsupported vehicles

Evaluation Procedures:

Students will be asked to complete several practical exercises that will provide the instructor with an idea of their understanding of the course material. No formal exam will be given. All students receive a certificate of completion.

Included with Training


  • 1 x 3 month Sanderson Forensics SQLite Forensic Toolkit License
  • 1 x 3 month X-Ways Forensics License
  • AAVF  Toolkit

Due to frequent updates and changes in equipment, actual training and class giveaways may change.

Laptop Requirements


Digital Forensics Google Group

  • Windows PC with two (2) USB A ports.
  • Windows OS
  • macOS with Bootcamp Windows
  • macOS alone will not work (No Virtual Machines)
  • 8GB RAM (minimum)
  • 100GB storage (minimum)
  • You must have admin rights or have the admin password for software installation.
  • NOTE: ALL Windows updates should be done prior to class.