# Android-Based Audio Video Navigation System Forensics: A Case Study
###### Abstract  
Vehicle digital forensics includes the process of collecting and analysing digital data stored in vehicles to find evidence related to traffic accidents or crime scenes. Through this process, we can reconstruct digital events by recognizing various information such as driver behaviour, driving patterns, vehicle destinations, and smartphones connected to a vehicle. Recently, many vehicle digital forensic studies have been conducted, but few of them have dealt with Android-based infotainment (or audio video navigation, AVN) systems. While many AVN systems adopt Android as the operating system, digital forensics of Android-based AVN systems is not easy. This is because Android-based AVN systems support various storage devices and data formats and have various data sources, making consistent data collection or analysis difficult. In this article, we perform digital forensics on four AVN systems: two Android 4.2.2 Jellybean-based and two Android 4.4.2 KitKat-based, aiming to develop a data acquisition and analysis method appropriate for each Android version. As a data collection method for the AVN system forensics, logical data acquisition is performed on the Jellybean-based systems and physical data acquisition on the KitKat-based systems. For the collected data, we identify and analyse Bluetooth data, navigation data, and system logs individually. Next, we investigate the differences in the storage structure and file location of major digital artefacts depending on the Android versions and show the limitations of the individual data analysis. Finally, we construct a timeline for the driver's activities by integrating and analysing the diverse artefacts which consist of Bluetooth data, navigation data, and system logs. vehicle digital forensics; infotainment system; AVN system; Android; autopsy 20231647633  
can be matched against statements about accidents or crimes. The results can also be used to determine the cause of an accident or to identify a suspect. A digital forensic tools can extract and analyse data stored in the infotainment system of a vehicle. For example, Berla Corporation, a vehicle forensic company, released a vehicle forensic toolkit iVe. It provides a tool to extract and analyse various vehicle data such as driving records, location information, phone call records, music playback records, etc. [7, 8]. The iVe supports data acquisition from the infotainment and telematic systems of over 4600 vehicle models. However, it does not support data acquisition from Android-based infotainment systems [9, 10]. Through several experiments, we found that it is difficult to conduct a digital forensic investigation on an Android-based infotainment system. * Android-based infotainment systems may have a different operating system version and hardware configuration. It is necessary to identify the characteristics of a target infotainment system to collect and analyse data of the system. * Android-based infotainment systems use various data formats for driving records, music playback records, radio reception records, and so on. * In Android-based infotainment systems, there are various sources of data such as Bluetooth, navigation, system logs, OBD-II, telematics, Wi-Fi connection, Android apps, etc. * There is a lack of tools to perform digital forensic investigations of Android-based vehicle infotainment systems. * Android-based infotainment systems have different data storage methods depending on each Android version. We also found that a data protection technique was applied in some versions [11]. * Therefore, it is difficult to make consistent forensic data collection as well as forensic analysis for Android-based infotainment systems. There is an abundance of research on infotainment system forensics [3, 5, 6, 8, 9, 10, 12]; however, only a few study Android-based vehicle infotainment systems. In particular, to the best of our knowledge, there has been no research collecting data from various sources, including Android operating systems, to construct a timeline of user activities.