Hello,
I am currently in the process of completing a project regarding Apple CarPlay and Android Auto from a forensic point of view.
The aim is to find evidence of use of these systems during the time of an incident.
I have currently been able to find two key files
- Apple Carplay.plist - Which I believe to hold creation date and modified date as for when the phone was first registered with the carplay system.
- Apple Internal.carkitd.plist - Which stores a creation and modified date. These could be the date the mobile phone was used with CarPlay but I am unable to say this for definite.
I have not yet looked at an Android device but I assume I will find more relevant files than Apple devices.
If anyone has dealt with, or has further files worth investigating in regards to Apple Carplay then please let me know.
Thanks,
Ryan
If it can help you, starting from v. 9.7. Belkasoft Evidence Center is capable of showing the following things when it comes to CarPlay
- a start and an end time of the CarPlay session
- last Siri request (in text)
- in addition, BEC shows the structure/contents of plist files
This may be of help from SANS presentation https://
Android Auto
https://
Apple CarPlay
https://