Hello everyone. Thank you for being at this presentation. My name is Kukheon Lee from Digital Forensic Research Center at Korea University. It is an honor to present. Thank you to the DFRWS committee for inviting us here. My presentation is Your Car is Recording. Today I talk about analysis for dashcam.
Everybody knows dashcam. Dashcam is an onboard camera is recording 24 hours and seven days. It is also called car black box, car digital video recorder and event data recorder. The dashcam is a moving surveillance camera. So that is useful as a source of potential digital evidence. So dashcam stores a variety of additional information in the storage device. We know that additional information is metadata. Metadata is a useful resource for analysis in digital forensics.
Next, let’s talk about motivation for our research. Nowadays, the dashcam is an essential element of the vehicles, according to related laws and regulations. For example, in the US commercial vehicles, such as police cars, buses and taxis, installed to comply with commercial motor vehicle safety laws. Private vehicles like Uber and Lyft use it to prepare evidence of accident investigation and resolve disputes on insurance claims.
In Korea, if installed a dashcam then insurance company offers a discount on insurance rate. So for this reason market analytics predicted that the global dashcam market is expected to reach a compound annual growth rate of 15.4%.
And I already said the dashcam is useful as a potential source of digital evidence, not only to reveal the truth of a traffic accident, but also to explain the situation of a crime scene as a moving [inaudible].
In general, dashcam stores proprietary multimedia data in remote storage device, such as SD card and micro SD card. Major manufacturers usually provide dedicated viewer, so examiners to analyze the visual data along with non-visual information, including time, location and speed and et cetera.
But they may have difficulty in responding to issues such as bankruptcy of manufacturer and corruption of files using proprietary format. Under these circumstances, various studies have been conducted for dashcam forensics, but most of them focused mainly on extracting, recovery and visual frames. In other words, existing research cannot analyze non visual metadata. So we identified and classified various metadata within 14 dashcam devices.
We have to know basic operations of dashcam. First data storage, which mainly uses flash memory and nowadays dashcams are connected to the cloud, that can be uploading multimedia files via LTE or 5G. Second file management. Dashcams usually delete the oldest multimedia file before creating new ones when a storage device is full.
So dashcam stocks various recording modes. Basically there are two modes, normal and parking. It is based on whether start engine of the vehicle. There is also event mode for recording when a shock is detected from the axis censor. Also manual mode can be used to begin recording manually whenever user need it.
Our multimedia container component is used to store multiple objects in a single file, such as video, audio, subtitles and location. This video device uses CODEC for efficient compression. Popular standards of CODEC for dashcams are H264 and H265.
This picture shows the structure of H264, and also that is for standard or proprietary data like speed and location. MP4 and AVI are the most popular file format to have the multimedia data. The left is MP4 file format. At the right is an example of AVI file format.
Most formats store multiple types of data using a specific unit that is called chunk. In general, multiple chunks have a hierarchical structure for managing different types of data. And each chunk consist of type and size and a data part because those are the perfect pictures to select on paramount device.
