How Dashcams help and hinder forensics

• Dashcams are an important in-car accessory that record car journeys, the footage from them is important for evidence if an incident has occurred.

• However how the dashcam footage is submitted, managed and processed can be a problem for forensics investigating the case

• The recording mode, GPS data, speed, license plate and temporal data of seven different devices has been assessed by researchers from WMG, University of Warwick

Dashcams are vital for helping police investigate car incidents, however the way the footage is submitted to police, managed and processed can cause problems. A researcher at WMG, University of Warwick has assessed seven different types of dashcams’ SD storage systems to see how they help and hinder digital forensics.

Many cars now have dashcams, an in-vehicle mountable camera which records video and audio footage of journeys. They have significant evidential value in digital forensics as they provide GPS data, temporal data, vehicular speed data, audio, video and photographic images.

In the paper, ‘Dashcam forensic: A preliminary analysis of 7 dashcam devices’, published in the paper Forensic Science International: Digital Investigation, Dr Harjinder Lallie, from WMG, University of Warwick explores two aspects of dashcam evidence: the problems related to the management and processing of dashcam evidence, and an analysis of artefacts generated by dashcams.

The first dedicated UK dashcam evidence submission portal was established in 2018, called Nextbase, currently five police forces use Nextbase, whilst fourteen accept it to police sites, with seventeen more intending to active acceptance online and seven not accepting online submissions.

Seven different dashcams SD card systems were analysed for their:

• Recording mode

• GPS data

• Vehicular speed data

• License plate data

• Temporal data

It was found that all of the artefacts above are available in several different locations: NMEA files, configuration files, directory naming structures, EXIF metadata, filename structures, file system attributes and watermarks.

A number of tools were required to extract the artefacts needed from the different locations in the SD card, and to analyse them. It was also found that evidential artefacts can be synthesised using tools such as native video players, therefore better methods are required for extracting and synthesising metadata from dashcams.

Dr Harjinder Lallie, from WMG, University of Warwick explains:

“We are increasingly reliant on the evidence produced by dashcam devices. However, there exist no standard guidelines on how to investigate dashcams and this can have an impact on judiciary process and the outcome thereof. This research is the first step towards developing such guidance.”

Future research will look at

a. Formulating dashcam investigation guidelines for law enforcement.

b. Methods of automating the extraction of geospatial data and internally corroborating them.

c. Automating the extraction of evidence presented in watermarks in dashcam recorded videos.

###

High-res images available at:
https://warwick.ac.uk/services/communications/medialibrary/images/june2020/dashcam_view.png
A view of a road from a dashcam replayer.

Paper available to view at: https://www.sciencedirect.com/science/article/pii/S2666281720300317 Full paper available directly on request

Alice Scott

Media Relations Manager – Science

University of Warwick

Tel: +44 (0) 7920 531 221

E-mail: [email protected]