Digital Forensics of Heavy Vehicle Event Data Recorders
Jeremy S. Daily, Ph.D, P.E. Tony Becker Course Schedule and Topics
Day 1 Day 2 Day 3 Introductions Hands-on J1708/J1587 Digital Forensics Demos Availability and J1939 Types of Data CAT Power Binary Data Schematics Loss Testing Field Kits Reading Reports Common Electronic OEM Software Control Units Crash Data Using the Forensic Link Adapter Attribution Downloads How Data Gets Networking FLA Preview Made FLA Portal
August 2017 Digital Forensics of HVEDRs 2 Why are we here?
Crash Reconstruction and investigation is based on evidence in all forms. Digital evidence is becoming more prevalent and understanding it makes you a better reconstructionist. Digital data has special considerations during its capture, preservation, and interpretation, especially for heavy trucks. New tools, the Synercon Technologies products, are now available an we need to learn how to use them.
August 2017 Digital Forensics of HVEDRs 3 Synercon Technologies, LLC
August 2017 Digital Forensics of HVEDRs 4 Example: IPTM School Bus Crash Test
August 2017 Digital Forensics of HVEDRs 5 Transition to Practice
Company started in August of 2013 in Jeremy’s garage in Broken Arrow, OK
Deep roots in research at the University of Tulsa funded by the National Institute of Justice (DOJ) and the Defense Advanced Research Projects Administration (DARPA).
We use your constructive feedback to continuously improve the products.
August 2017 Digital Forensics of HVEDRs 6 About the Instructor: Jeremy S. Daily, Ph.D., P.E.
Founder and CEO, Synercon Technologies, LLC. 2013-Present. Associate Professor of Mechanical Engineering, The University of Tulsa, 2006- Present VP Jackson Hole Scientific Investigations, Inc, 2001-Present Ph.D. in Engineering from Wright State University in Dayton, OH, 2006 Prediction of Fatigue Crack Growth Rate based on Plastic Dissipation Energy on Bimaterial Interfaces Aerospace Engineer, Contractor at Wright Patterson AFB, 2005-2006. Active Duty Air Force 1995-2002 Maintained Flight line Navigation and Meteorological Electronic Systems Other facts: Published 11 SAE papers on crash reconstruction Co-authored Fundamentals of Traffic Crash Reconstruction (IPTM 2006) Director of the TU Crash Reconstruction Research Consortium (2010-present) Given expert testimony in court Professional Engineer (Ohio, Oklahoma) SAE Ralph Teetor Award winner, 2012. Built an autopilot trolling system for a ski boat and caught 104 fish in Yellowstone Lake during the summer of 2017.
August 2017 Digital Forensics of HVEDRs 7 About the Instructor: Tony Becker, MSCJ, ACTAR 354
Founder, Forensic Training Group, LLC 2016 to present
Adjunct Instructor, The University of Tulsa, CESE
Associate Staff Instructor, United States Department of Transportation, Transportation Safety Institute
Institute of Police Technology and Management, University of North Florida, 1989-2015
25 years of law enforcement experience, 20 years as a traffic crash investigator
Developed the Institute of Police Technology and Management course in Heavy Vehicle Electronic Control Module Data Use in Crash Reconstruction
MS in Criminal Justice from University of North Florida in Jacksonville, FL, 2016
Certifications
Illinois Local Governmental Law Enforcement Officers Training Board and Department, Division of Traffic Safety, Accident Reconstruction Specialist, Illinois No. 88061, December 1988
The Accreditation Commission for Traffic Accident Reconstruction, Full Accreditation as a Traffic Accident Reconstructionist, ACTAR No. 354, October 1993.
Publications
Simulations of Pedestrian Impact Collisions with Virtual Crash 3 and Comparisons with IPTM Staged Tests, By Tony Becker, Mike Reade, and Bob Scurlock, Published in the Accident Reconstruction Journal, March/April 2016.
Fundamentals of Pedestrian/Cyclist Traffic Crash Reconstruction, by Mike Reade and Tony Becker, Publisher Institute of Police Technology and Management, 2016.
August 2017 Digital Forensics of HVEDRs 8 About the Instructor: Scott E. Skinner, ACTAR 654
Idaho State Police, Civilian Consultant to their Collision Reconstruction Program 2015 to Current
Adjunct Instructor of the University of Tulsa, 2015 to Current
Adjunct Instructor for IPTM, University of North Florida, 2012 to Current
Owner of Collision Consulting and Reconstruction LLC, 2012 to Current
Private Civil Collision Reconstruction Business, Based in Ontario, OR
ACTAR Governing Board of Directors, 2004 to 2015
Served as the Chairperson of the Continuing Education Unit Committee
Served as the Chairman and Vice Chairman GBOD
Oregon State Police 1985 to 2015, Retired as a Sergeant
Accredited Collision Reconstructionist Since 1994
CVSA Level One Truck Inspector AS1333
Statewide Collision Reconstruction Program Manager
Statewide Heavy Truck Collision Reconstruction Program Manager
Attended 1496 hours of Technical Training in the field of Collision Investigation and Collision Reconstruction.
Instructed Collision Investigation Topics for 1037 Hours
Been Involved in the Investigation of More than 1,000 Crash Events
Provided expert witness Testimony 53 Times in the States of Oregon, Idaho and Alaska
Other facts:
Published 2 papers on crash reconstruction related topics a third paper is awaiting publication.
Authored training curriculum for both the Oregon State Police and the Idaho State Police
Attended Detroit Diesel and Caterpillar training in the Field of Heavy Vehicle Event Data Recorders
Presented at IPTM Special Problems 2013 and 2015, both on topics related to Heavy Vehicle Crash Investigation
Presented at WREX 2016 on Heavy Vehicle Digital Forensics
Built Dough Ball Jig and Caught a Carp in the Willamette River below the Wah-Chang Heavy Metal Plant near Albany, Oregon in 1978 August 2017 Digital Forensics of HVEDRs 9 Course Objective
Provide students the skills, knowledge, and background to successfully download and interpret data from heavy vehicle event data recorders (HVEDRs).
Enable an active learning environment where students can explore relevant topics and take advantage of unique learning opportunities in a relaxed setting.
August 2017 Digital Forensics of HVEDRs 10 Class Introduction
We can learn from our peers. Please share your
Name
Where you are from
Job position and duties
Experience with Event Data Recorders
What you hope to get out of this class
Please ask questions!
August 2017 Digital Forensics of HVEDRs 11 Training Goals
Become familiar with the Synercon equipment Learn the “buzz words” and acronyms Understand how data gets made Use SAE Standards to understand data Recognize different ECMs and how to connect to them Develop troubleshooting skills Appreciate the field of digital forensics
August 2017 Digital Forensics of HVEDRs 12 Digital Forensics - Defined
The application of computer science and investigative procedures for a legal purpose. The analysis of digital evidence involves the following: Proper search authority Proper chain of custody Validation with mathematics The use of validation tools Repeatability Reporting Expert presentation
August 2017 Digital Forensics of HVEDRs 13 Digital Forensics Encompasses
Lap top and desk top computers Mobile devices Event data recorders Networks Cloud based systems Digital images Digital Videos Digital Audios TMS Data, Scanner Cloud Data, Etc.
August 2017 Digital Forensics of HVEDRs 14 Forensic Soundness
Meaning is a term that denotes confidence in the interpretation of extracted evidence data.
Error Detection denotes processes for detecting or predicting errors in the forensic process.
Transparency means the forensic process is documented, known, and verifiable.
Expertise is required for investigators examining digital data.
Tampering detection involves processes to evaluate if this has occurred.
August 2017 Digital Forensics of HVEDRs 15 Basic Forensic Principles in Dealing with Digital Evidence
Any process or procedure of collecting, transporting, or storing of digital evidence should not incur any changes to the evidence
If changes are inevitable, then they should be predictable. Only specifically trained experts should draw conclusions from examined digital evidence. Transparency during the operations of acquisition, transportation, and storage of digital evidence should be maintained.
August 2017 Digital Forensics of HVEDRs 16 Responding to the call AVAILABILITY OF DATA FROM HEAVY VEHICLES
August 2017 Digital Forensics of HVEDRs 17 Phone Conversation
Caller: “Hi Jeremy. I’m working a big wreck, can you download this truck for me?” Jeremy: “Maybe. What year is it and what kind of engine does it have?” Caller: “It’s a 2005 Volvo tractor.” Jeremy: “Right… but I need to know what kind of engine it has.” Caller: “It’s a diesel.”
August 2017 Digital Forensics of HVEDRs 18 Heavy Vehicle Event Data Recorders (HVEDRs)
From http://www.heavytruckedr.org/acronyms.html: EDR (Event Data Recorder): A function that records vehicle performance data relating to an “event,” which has properties defined by the individual ECM’s programming (for example, when wheel speed slows by more than 7mph in one second). Most recorded events are not traffic crashes, but in many cases the circumstances surrounding a traffic crash will cause information to be recorded as an “event.” From SAE J2728: An event is a point in time, during the operation of a heavy vehicle, in which one or more threshold trigger criteria are met causing the HVEDR to log data surrounding the event. The Heavy Vehicle Event Data Recorder (HVEDR) is an electronic system that captures and records electronic information related to an event during vehicle operation.
August 2017 Digital Forensics of HVEDRs 19 Electronic Control Module (ECM)
Electronic Control Modules exist for many systems
Many ECMs have special names
Electronic Brake Controller (EBC)
Body Controller
Electronic Transmission Controller
Engine Control Modules are also ECMs
With no qualification, ECM usually refers to the engine controller.
August 2017 Digital Forensics of HVEDRs 20 Determining if Data Exists
ECM Field Guide
Complete with pictures and expected data
Wisconsin Highway Patrol (Tim Austin) Online Resources
http://www.ataassociates.com/ECM.htm
Gates VIN Decoder: http://www.gates.com/catalogs-and-resources/resources/repository/engineering-business-applications/vin-decoder/vin-decoder iPhone App
http://www.vintrucks.com/ Visual inspection of the ECM is the best way.
August 2017 Digital Forensics of HVEDRs 21 Many Combinations
Truck Make Engine Make
Freightliner Caterpillar
International Cummins
Kenworth Navistar
Mack Mack
Volvo Mercedes-Benz
Sterling Paccar
Western Star Volvo
August 2017 Digital Forensics of HVEDRs 22 Rules of Thumb
Most Trucks can have Cummins Engines
Freightliners, Sterling, and Western Star (Daimler brands) usually have Detroit Diesel or Mercedes Engines.
Peterbilt and Kenworth (Paccar brands) usually have Cat, Cummins, or Paccar Engines.
Mack, Volvo, and Navistar engines are usually not on other brands.
August 2017 Digital Forensics of HVEDRs 23 If data is known to exist, then we can ask: WHAT TYPES OF DATA ARE STORED ON ECMS?
August 2017 Digital Forensics of HVEDRs 24 Categories of Heavy Vehicle Data
Event Data
Configuration Data
Historical Data
Fault Data
The speed records from Event data are often the most interesting to a crash investigator, but other data may be useful.
August 2017 Digital Forensics of HVEDRs 25 Event Data
Time history data surrounding an event that triggers recording, which may include:
Sudden changes in speed (Hard Brake, Sudden Deceleration, Quick Stop, etc)
The Last Stop Event
Setting a fault code (i.e. a Diagnostic Record)
Driver activated (i.e. External Trigger)
Each manufacturer implements these features in different ways or not at all.
August 2017 Digital Forensics of HVEDRs 26 Configuration Data
Data that does not change with time (other than reprogramming)
Sometimes referred to as:
Features
Parameters
Calibration Settings
Uses to support and corroborate event data
August 2017 Digital Forensics of HVEDRs 27 Example Calibration Data
Rear Axle Ratio QuickStop Threshold
Governed Speed Limit (CAT Only)
Tire Size (rev/mile)
Speed Sensor Tone Ring Teeth
Speed pulses per mile
Power Rating
Cruise Set Limits
Maximum Engine RPM
August 2017 Digital Forensics of HVEDRs 28 Historical Data
Data that is acquired as a result of using the truck. Things that can be counted:
Time (usually in seconds or hours)
Fuel use
Distances Audit trails (records of changes) Histograms (Speed vs Duration) Engine Usage Logs
August 2017 Digital Forensics of HVEDRs 29 Fault Data
Diagnostic messages and associated freeze frame data indicating vehicle operation when the fault code was set.
Some ECMs record fault codes like event data (Cat and DDEC).
Fault data can contain engine RPM and Speed.
August 2017 Digital Forensics of HVEDRs 30 Mack and Volvo Engines
Volvo Tractors can have different engines
Cummins
Detroit Diesel Volvo http://hvedr.com Mack Tractors
Mack
Cummins
Caterpillar All event data goes to Mack and Volvo designated shops
August 2017 Digital Forensics of HVEDRs 31 https://www.dropbox.com/s/0rihdmai9gu3tni/ECM%20Field%20Guide.pdf?dl=0 REVIEW HVEDR FIELD GUIDE
August 2017 Digital Forensics of HVEDRs 32 Schematics
Visual tools engineers use to communicate system operation and design.
Connected symbols and language to demonstrate interactions.
Provide insight into the operation of the system.
Helps crash experts communicate how data is produced.
August 2017 Digital Forensics of HVEDRs 33 Component Location Information
Schematics may also references to component locations.
A Mercedes VCU is pictured here under the dash.
August 2017 Digital Forensics of HVEDRs 34 August 2017 Digital Forensics of HVEDRs 35 Online Resources
Cummins Quick Serve Online
https://qsol.cummins.com/qs3/portal/service/index.html
Cummins Fault Information System (FIS)
DDDL8 Reference manuals
August 2017 Digital Forensics of HVEDRs 36 Horizontal Integration
Component parts come from many different suppliers
Brakes: Bendix, Haldex, Wabco
Engines: Cummins, Paccar, Cat
Transmission: Allison, Eaton
Opposite of Vertical Integration
Henry Ford’s vision
Standardization leads to interoperability
Communicated with schematics
August 2017 Digital Forensics of HVEDRs 37 Caterpillar Vehicle Schematic
August 2017 Digital Forensics of HVEDRs 38 Detroit Diesel CPC Overview
August 2017 Digital Forensics of HVEDRs 39 Please work on PROJECT: TRACING SCHEMATICS
August 2017 Digital Forensics of HVEDRs 40 FIELD KITS AND RECOGNIZING ECMS
August 2017 Digital Forensics of HVEDRs 41 Preserving Evidence on Scene
1. Turn off engine and secure the keys in an evidence bag.
2. Remove the drive line or unplug the VSS prior to towing
3. Advise the tow operator that the vehicle ignition is not to be turned on.
Event Record is that of moving the truck out of the way.
August 2017 Digital Forensics of HVEDRs 42 August 2017 Digital Forensics of HVEDRs 43 This might be your truck…
August 2017 Digital Forensics of HVEDRs 44 Bringing the Electrical System Back On-line
August 2017 Digital Forensics of HVEDRs 45 Field Work Duties
Reconstructionist
Electrician
Mechanic
Body Shop
Tow Driver
EMS
August 2017 Digital Forensics of HVEDRs 46 Allen Wrenches
5/32” hex for Cummins and CAT
August 2017 Digital Forensics of HVEDRs 47 Sockets
August 2017 Digital Forensics of HVEDRs 48 Deep and Shallow
August 2017 Digital Forensics of HVEDRs 49 Torx
T30 for DDEC V
August 2017 Digital Forensics of HVEDRs 50 Screwdrivers
August 2017 Digital Forensics of HVEDRs 51 Prying Tools
August 2017 Digital Forensics of HVEDRs 52 Multimeter
August 2017 Digital Forensics of HVEDRs 53 Battery Jumper Pack
August 2017 Digital Forensics of HVEDRs 54 Power Inverter
August 2017 Digital Forensics of HVEDRs 55 Wire Leads
August 2017 Digital Forensics of HVEDRs 56 Fuses
Check these if the FLA doesn’t power up.
August 2017 Digital Forensics of HVEDRs 57 Connecting to the in-cab Diagnostic Port
August 2017 Digital Forensics of HVEDRs 58 Diagnostic Port Locations
August 2017 Digital Forensics of HVEDRs 59 Deutsch 6 & 9 Pin
J1708 Only J1939 @ 250k J1939 @ 500k Older Vehicles Most Common 2016 and newer
August 2017 Digital Forensics of HVEDRs 60 Pinouts
https://www.dgtech.com/wp- content/uploads/2016/04/Pinouts_ICR.pdf
August 2017 Digital Forensics of HVEDRs 61 Pinouts
August 2017 Digital Forensics of HVEDRs 62 Field Testing
Check for +12 V on pin B with Pin A to ground
Check for 60 Ohms between Pin C and D on J1939 enabled vehicles with vehicle off.
August 2017 Digital Forensics of HVEDRs 63 Power Distribution Switch
August 2017 Digital Forensics of HVEDRs 64 Power Distribution Switch
August 2017 Digital Forensics of HVEDRs 65 Finding Fuse Panels
August 2017 Digital Forensics of HVEDRs 66 Finding Fuse Panels
August 2017 Digital Forensics of HVEDRs 67 Fuse Panels
August 2017 Digital Forensics of HVEDRs 68 Cummins
August 2017 Digital Forensics of HVEDRs 69 Cummins Celect
August 2017 Digital Forensics of HVEDRs 70 Cummins CM570
August 2017 Digital Forensics of HVEDRs 71 Cummins CM850, CM870, CM871
August 2017 Digital Forensics of HVEDRs 72 Cummins CM2250
August 2017 Digital Forensics of HVEDRs 73 Cummins CM2350
August 2017 Digital Forensics of HVEDRs 74 Detroit Diesel
August 2017 Digital Forensics of HVEDRs 75 DDEC IV
August 2017 Digital Forensics of HVEDRs 76 DDEC IV with SSS2
August 2017 Digital Forensics of HVEDRs 77 DDEC V
August 2017 Digital Forensics of HVEDRs 78 DDEC 6 Common Powertrain Motor Control Module Controller (CPC) (MCM)
August 2017 Digital Forensics of HVEDRs 79 DDEC Three Module System
Motor Control Module Common Powertrain Aftertreatment Control Controller (CPC) Module (ACM) (MCM)
August 2017 Digital Forensics of HVEDRs 80 DDEC 10/13 MCM & ACM
August 2017 Digital Forensics of HVEDRs 81 DDEC 10/13 ACM
August 2017 Digital Forensics of HVEDRs 82 DDEC 10/13 ACM
August 2017 Digital Forensics of HVEDRs 83 DDEC 10/13 Engine MCM
August 2017 Digital Forensics of HVEDRs 84 DDEC CPC
August 2017 Digital Forensics of HVEDRs 85 DDEC CPC
August 2017 Digital Forensics of HVEDRs 86 DDEC CPC
August 2017 Digital Forensics of HVEDRs 87 DDEC 13 CPC
A CPC4 is a DDEC 13 The CPC2 is from a DDEC 10 A CPC is in a DDEC 6
August 2017 Digital Forensics of HVEDRs 88 DDEC Reports Data is in the CPC
The Smart Sensor Simulator 2 provides the signals from the MCM and ACM to preserve fault code data in the CPC for DDEC Reports.
August 2017 Digital Forensics of HVEDRs 89 Mercedes Benz Engines (DDEC)
Vehicle Control Unit (VCU) German for MCM = PLD
August 2017 Digital Forensics of HVEDRs 90 Caterpillar
August 2017 Digital Forensics of HVEDRs 91 Caterpillar ADEM 2
August 2017 Digital Forensics of HVEDRs 92 Caterpillar ADEM 2000/ADEM3
August 2017 Digital Forensics of HVEDRs 93 Caterpillar ADEM 4
August 2017 Digital Forensics of HVEDRs 94 PACCAR MX
August 2017 Digital Forensics of HVEDRs 95 Navistar MaxxForce
August 2017 Digital Forensics of HVEDRs 96 Bendix Brake Controller
August 2017 Digital Forensics of HVEDRs 97 USING THE FORENSIC LINK ADAPTER
August 2017 Digital Forensics of HVEDRs 98 Synercon Technologies
Forensic Link Adapter (FLA)
TruckCRYPT Software
FLA Preview
FLA Portal
Smart Sensor Simulator 2
August 2017 Digital Forensics of HVEDRs 99 Example Download
August 2017 Digital Forensics of HVEDRs 100 Forensic Link Adapter User Manual
http://synercontechnologies.com/wp-content/uploads/2016/10/FLA-User-Manual-v1.3.pdf
August 2017 Digital Forensics of HVEDRs 101 Demonstration and Practice
Connecting the Forensic Link Adapter Understand and Use the Menu System Download an ECM TruckCRYPT Software OEM Software (DDEC Reports/Cummins Powerspec) Examine Data with FLA Preview Upload Data Package Login to https://fla.synercontechnologies.com User: guest Password: UniversityOfTulsa
August 2017 Digital Forensics of HVEDRs 102