Apple Carplay / And...
 
Notifications
Clear all

Apple Carplay / Android Auto

4 Posts
4 Users
0 Reactions
1,655 Views
(@bellis)
New Member
Joined: 9 years ago
Posts: 1
Topic starter  

Hello,
I am currently in the process of completing a project regarding Apple CarPlay and Android Auto from a forensic point of view.
The aim is to find evidence of use of these systems during the time of an incident.

I have currently been able to find two key files
- Apple Carplay.plist - Which I believe to hold creation date and modified date as for when the phone was first registered with the carplay system.
- Apple Internal.carkitd.plist - Which stores a creation and modified date. These could be the date the mobile phone was used with CarPlay but I am unable to say this for definite.

I have not yet looked at an Android device but I assume I will find more relevant files than Apple devices.

If anyone has dealt with, or has further files worth investigating in regards to Apple Carplay then please let me know.

Thanks,
Ryan


   
Quote
(@eugenebelk)
Active Member
Joined: 6 years ago
Posts: 16
 

If it can help you, starting from v. 9.7. Belkasoft Evidence Center is capable of showing the following things when it comes to CarPlay
- a start and an end time of the CarPlay session
- last Siri request (in text)
- in addition, BEC shows the structure/contents of plist files


   
ReplyQuote
(@kenobyte)
Eminent Member
Joined: 9 years ago
Posts: 36
 

This may be of help from SANS presentation https://www.mac4n6.com/blog/2019/8/6/new-presentation-from-sans-dfir-summit-2019-they-see-us-rollin-they-hatin-forensics-of-ios-carplay-and-android-auto . I am doing a vehicle forensics capstone this had some information in it that was valuable.


   
ReplyQuote
(@josh_hickman1)
New Member
Joined: 6 years ago
Posts: 2
 

Android Auto

https://dfir.pubpub.org/pub/716tlra7

Apple CarPlay

https://thebinaryhick.blog/2019/05/08/ridin-with-apple-carplay/


   
ReplyQuote
Share: