The Electronic Control Unit, or Event Data Recorder, in modern vehicles saves crash data that can later be accessed in forensic investigations.

Current automobiles, light trucks, and heavy trucks commonly use Electronic Control Units (ECUs) to perform the logical control functions in subsystems which often include engine, antilock braking, traction control, stability control, front/side/roof/rear restraints control, and rollover protection control. When an ECU saves data related to a crash event, and that data can later be accessed for investigation purposes, the ECU is often referred to as an Event Data Recorder (EDR). Post crash-event investigations involving those vehicles now typically utilize such data, and such investigations now commonly reference data stored in various EDRs in both bullet and target involved vehicles. This article introduces the technology of EDRs, methods of data retrieval, and discusses forensic considerations when introducing EDR data in litigation. The forensic considerations of EDR data include: 1) scientific methodology, 2) repeatability by other investigators, 3) error rates, 4) consistency with industry standards, and 5) relevance to the instant case fact set.

Just as the last ten years of automotive technology have seen a steady growth of electronic controller applications in automobiles, the next ten years will see an increasing sophistication in automotive network interfaces and diagnostics. A good overview of automotive network diagnostics is found in Murthy.¹ To give the reader an immediate reference, a symbolic representation of distributed control ECUs on passenger vehicle diagnostic data bus, for contemporary passenger vehicles, is shown in Figure 1.

Incorporated within almost all vehicle control ECUs is some form of non-volatile memory technology. Non-volatile memory saves its data even when battery power is disconnected. Thus it is ideal for saving calibration, adaption, malfunction-history, and event-history data. Non-volatile memory is typically implemented as Electrically Erasable Programmable Read Only Memory (EEPROM), which is used to save active and history Diagnostic Trouble Codes (DTCs) and various event data. Dealer-level diagnostic scanners are typically limited to DTC retrieval while engineering level crash-event data typically requires a laptop computer and vehicle network interface. A schematic overview of a typical EEPROM hexadecimal data retrieval is shown in Figure 2.

When an ECU saves data related to a crash event, and that data can later be accessed for investigation purposes, it is often referred to as an Event Data Recorder (EDR). Thus, an additional aspect of the increased population of automotive and light truck ECUs is the use of saved non-volatile memory data within those ECUs as a component of post-crash investigations involving those vehicles (henceforth called EDR data). Such investigations now commonly reference data stored in various ECUs in both striking (bullet) vehicle, and in the struck (target) vehicle.

The most common method to access data in an EDR is via a standard vehicle network interface, the SAE J1962 port (also called the OBD-II connector or the Diagnostic Link Connector, DLC) on passenger vehicles and light trucks. However other, equally valid, methods can include direct umbilical-to-ECU interrogation and direct umbilical-to-EEPROM interrogation. When this is done as part of the litigation process, with either method, a key consideration is the reliability and consistency of output data and the preservation of the source data for other investigators.