Digital Forensics of Heavy Vehicle Event Data Recorders
Total Page:16
File Type:pdf, Size:1020Kb
Digital Forensics of Heavy Vehicle Event Data Recorders Jeremy S. Daily, Ph.D, P.E. Tony Becker Course Schedule and Topics Day 1 Day 2 Day 3 Introductions Hands-on J1708/J1587 Digital Forensics Demos Availability and J1939 Types of Data CAT Power Binary Data Schematics Loss Testing Field Kits Reading Reports Common Electronic OEM Software Control Units Crash Data Using the Forensic Link Adapter Attribution Downloads How Data Gets Networking FLA Preview Made FLA Portal August 2017 Digital Forensics of HVEDRs 2 Why are we here? Crash Reconstruction and investigation is based on evidence in all forms. Digital evidence is becoming more prevalent and understanding it makes you a better reconstructionist. Digital data has special considerations during its capture, preservation, and interpretation, especially for heavy trucks. New tools, the Synercon Technologies products, are now available an we need to learn how to use them. August 2017 Digital Forensics of HVEDRs 3 Synercon Technologies, LLC August 2017 Digital Forensics of HVEDRs 4 Example: IPTM School Bus Crash Test August 2017 Digital Forensics of HVEDRs 5 Transition to Practice Company started in August of 2013 in Jeremy’s garage in Broken Arrow, OK Deep roots in research at the University of Tulsa funded by the National Institute of Justice (DOJ) and the Defense Advanced Research Projects Administration (DARPA). We use your constructive feedback to continuously improve the products. August 2017 Digital Forensics of HVEDRs 6 About the Instructor: Jeremy S. Daily, Ph.D., P.E. Founder and CEO, Synercon Technologies, LLC. 2013-Present. Associate Professor of Mechanical Engineering, The University of Tulsa, 2006- Present VP Jackson Hole Scientific Investigations, Inc, 2001-Present Ph.D. in Engineering from Wright State University in Dayton, OH, 2006 Prediction of Fatigue Crack Growth Rate based on Plastic Dissipation Energy on Bimaterial Interfaces Aerospace Engineer, Contractor at Wright Patterson AFB, 2005-2006. Active Duty Air Force 1995-2002 Maintained Flight line Navigation and Meteorological Electronic Systems Other facts: Published 11 SAE papers on crash reconstruction Co-authored Fundamentals of Traffic Crash Reconstruction (IPTM 2006) Director of the TU Crash Reconstruction Research Consortium (2010-present) Given expert testimony in court Professional Engineer (Ohio, Oklahoma) SAE Ralph Teetor Award winner, 2012. Built an autopilot trolling system for a ski boat and caught 104 fish in Yellowstone Lake during the summer of 2017. August 2017 Digital Forensics of HVEDRs 7 About the Instructor: Tony Becker, MSCJ, ACTAR 354 Founder, Forensic Training Group, LLC 2016 to present Adjunct Instructor, The University of Tulsa, CESE Associate Staff Instructor, United States Department of Transportation, Transportation Safety Institute Institute of Police Technology and Management, University of North Florida, 1989-2015 25 years of law enforcement experience, 20 years as a traffic crash investigator Developed the Institute of Police Technology and Management course in Heavy Vehicle Electronic Control Module Data Use in Crash Reconstruction MS in Criminal Justice from University of North Florida in Jacksonville, FL, 2016 Certifications Illinois Local Governmental Law Enforcement Officers Training Board and Department, Division of Traffic Safety, Accident Reconstruction Specialist, Illinois No. 88061, December 1988 The Accreditation Commission for Traffic Accident Reconstruction, Full Accreditation as a Traffic Accident Reconstructionist, ACTAR No. 354, October 1993. Publications Simulations of Pedestrian Impact Collisions with Virtual Crash 3 and Comparisons with IPTM Staged Tests, By Tony Becker, Mike Reade, and Bob Scurlock, Published in the Accident Reconstruction Journal, March/April 2016. Fundamentals of Pedestrian/Cyclist Traffic Crash Reconstruction, by Mike Reade and Tony Becker, Publisher Institute of Police Technology and Management, 2016. August 2017 Digital Forensics of HVEDRs 8 About the Instructor: Scott E. Skinner, ACTAR 654 Idaho State Police, Civilian Consultant to their Collision Reconstruction Program 2015 to Current Adjunct Instructor of the University of Tulsa, 2015 to Current Adjunct Instructor for IPTM, University of North Florida, 2012 to Current Owner of Collision Consulting and Reconstruction LLC, 2012 to Current Private Civil Collision Reconstruction Business, Based in Ontario, OR ACTAR Governing Board of Directors, 2004 to 2015 Served as the Chairperson of the Continuing Education Unit Committee Served as the Chairman and Vice Chairman GBOD Oregon State Police 1985 to 2015, Retired as a Sergeant Accredited Collision Reconstructionist Since 1994 CVSA Level One Truck Inspector AS1333 Statewide Collision Reconstruction Program Manager Statewide Heavy Truck Collision Reconstruction Program Manager Attended 1496 hours of Technical Training in the field of Collision Investigation and Collision Reconstruction. Instructed Collision Investigation Topics for 1037 Hours Been Involved in the Investigation of More than 1,000 Crash Events Provided expert witness Testimony 53 Times in the States of Oregon, Idaho and Alaska Other facts: Published 2 papers on crash reconstruction related topics a third paper is awaiting publication. Authored training curriculum for both the Oregon State Police and the Idaho State Police Attended Detroit Diesel and Caterpillar training in the Field of Heavy Vehicle Event Data Recorders Presented at IPTM Special Problems 2013 and 2015, both on topics related to Heavy Vehicle Crash Investigation Presented at WREX 2016 on Heavy Vehicle Digital Forensics Built Dough Ball Jig and Caught a Carp in the Willamette River below the Wah-Chang Heavy Metal Plant near Albany, Oregon in 1978 August 2017 Digital Forensics of HVEDRs 9 Course Objective Provide students the skills, knowledge, and background to successfully download and interpret data from heavy vehicle event data recorders (HVEDRs). Enable an active learning environment where students can explore relevant topics and take advantage of unique learning opportunities in a relaxed setting. August 2017 Digital Forensics of HVEDRs 10 Class Introduction We can learn from our peers. Please share your Name Where you are from Job position and duties Experience with Event Data Recorders What you hope to get out of this class Please ask questions! August 2017 Digital Forensics of HVEDRs 11 Training Goals Become familiar with the Synercon equipment Learn the “buzz words” and acronyms Understand how data gets made Use SAE Standards to understand data Recognize different ECMs and how to connect to them Develop troubleshooting skills Appreciate the field of digital forensics August 2017 Digital Forensics of HVEDRs 12 Digital Forensics - Defined The application of computer science and investigative procedures for a legal purpose. The analysis of digital evidence involves the following: Proper search authority Proper chain of custody Validation with mathematics The use of validation tools Repeatability Reporting Expert presentation August 2017 Digital Forensics of HVEDRs 13 Digital Forensics Encompasses Lap top and desk top computers Mobile devices Event data recorders Networks Cloud based systems Digital images Digital Videos Digital Audios TMS Data, Scanner Cloud Data, Etc. August 2017 Digital Forensics of HVEDRs 14 Forensic Soundness Meaning is a term that denotes confidence in the interpretation of extracted evidence data. Error Detection denotes processes for detecting or predicting errors in the forensic process. Transparency means the forensic process is documented, known, and verifiable. Expertise is required for investigators examining digital data. Tampering detection involves processes to evaluate if this has occurred. August 2017 Digital Forensics of HVEDRs 15 Basic Forensic Principles in Dealing with Digital Evidence Any process or procedure of collecting, transporting, or storing of digital evidence should not incur any changes to the evidence If changes are inevitable, then they should be predictable. Only specifically trained experts should draw conclusions from examined digital evidence. Transparency during the operations of acquisition, transportation, and storage of digital evidence should be maintained. August 2017 Digital Forensics of HVEDRs 16 Responding to the call AVAILABILITY OF DATA FROM HEAVY VEHICLES August 2017 Digital Forensics of HVEDRs 17 Phone Conversation Caller: “Hi Jeremy. I’m working a big wreck, can you download this truck for me?” Jeremy: “Maybe. What year is it and what kind of engine does it have?” Caller: “It’s a 2005 Volvo tractor.” Jeremy: “Right… but I need to know what kind of engine it has.” Caller: “It’s a diesel.” August 2017 Digital Forensics of HVEDRs 18 Heavy Vehicle Event Data Recorders (HVEDRs) From http://www.heavytruckedr.org/acronyms.html: EDR (Event Data Recorder): A function that records vehicle performance data relating to an “event,” which has properties defined by the individual ECM’s programming (for example, when wheel speed slows by more than 7mph in one second). Most recorded events are not traffic crashes, but in many cases the circumstances surrounding a traffic crash will cause information to be recorded as an “event.” From SAE J2728: An event is a point in time, during the operation of a heavy vehicle, in which one or more threshold trigger criteria are met causing the HVEDR to log data surrounding the event. The