Vehicle Forensics Field Guide
A modern car is a rolling network of radios, computers, and memory. It records where it went, which phones it met, and when its doors opened, and it keeps talking after it is seized. This guide covers what vehicle digital forensics recovers, where the wireless exposure lives, the habits that quietly cost evidence between seizure and examination, and how Mission Darkness™ Faraday vehicle enclosures keep a seized vehicle isolated from the moment it reaches your examination bay until the work is done.
01 · The basics
Vehicle forensics is the recovery and analysis of digital evidence stored inside a vehicle's onboard electronics. It sits alongside mobile device forensics, and it often answers questions a phone cannot: where the car actually traveled, who was driving, which devices were present, and what the vehicle was doing in the seconds before an impact.
Not long ago, vehicle evidence meant paint transfer and skid marks. Today a typical vehicle carries dozens of networked modules, often a built-in cellular modem, and storage that can hold records for months.
The car is a witness. Like any witness, it can be influenced after the fact.
Why isolation comes firstWhere the evidence lives
Navigation history, saved places, synced contacts, call and message records from paired phones, media, and voice-command logs.
The vehicle's built-in cellular link. It handles connected services, crash notification, remote commands, and software updates.
Captures speed, braking, throttle, seatbelt, and steering data in the moments around a crash or near-crash.
Door, ignition, gear, and lighting events that can place people and actions on a timeline.
USB drives, SD cards, aftermarket dash cams and trackers, and the phones and key fobs found with the vehicle.
02 · Signal map
Most checklists stop at "the car has a cell modem." In practice a connected vehicle listens on at least seven different radio systems across several frequency bands. Select one to see what it does and what it can change if the vehicle is left unshielded.
Schematic only. Antenna and module locations vary by make, model, and year.
Log scale, 1 MHz to 40 GHz. The shaded band is the range CYPHERCYLENT™ enclosures are built to block, from low MHz through 40 GHz.
Swipe sideways to see the full spectrum.
03 · Costly habits
None of these feel risky in the moment. Each one is common, well intentioned, and able to change the state of a vehicle before an examiner ever connects to it.
Cutting power can clear volatile data, set new fault records, and change the state an examiner needs to capture. Many telematics units carry their own backup battery, so the radio may stay alive anyway.
Isolate the radios, not the battery. Leave power decisions to the examiner with a plan in place.
Sally ports, warehouses, and steel sheds have doors, windows, vents, and seams. Cellular and Wi-Fi signals get in. A building is not a Faraday enclosure.
Put a continuous conductive shell around the vehicle itself, and verify it with a phone test before relying on it.
A key in or near the vehicle can wake modules and write unlock, start, and proximity events that did not happen during the incident.
Bag fobs, phones, and any trackers found with the vehicle in separate, labeled Faraday bags at the scene.
Connected modules can stay reachable in a low-power listening state after the driver walks away, precisely so they can accept remote commands.
Assume the vehicle is online until it is shielded, regardless of what the dash shows.
New pairings and connections write new records into the head unit and can roll older, relevant entries out of the device history.
Keep personal devices out of range. Capture data through a forensic acquisition, not the touchscreen.
A seized vehicle can sit in a lot or open bay for days before anyone connects to it. Every connected hour is another chance for a queued update or remote command to land.
Keep an enclosure standing in the bay, drive the vehicle in as soon as it arrives, and log the time isolation began.
04 · How shielding works
A Faraday enclosure is a continuous conductive skin. Incoming radio waves induce currents in that skin that cancel the field inside, so a vehicle within it can neither receive nor send.
The fabric does most of the work. The engineering is in the three places where the skin has to break: the seams, the door, and the cables examiners need inside.
TitanRF™ materials are lab certified to IEEE 299-2006 and MIL-STD-188-125 standards. See our testing and certifications.
Radio energy that reaches a continuous conductive shell is reflected and absorbed. Performance is decided at the interruptions: (1) seams, (2) the door, and (3) cables passing through the wall.
Stitching puts thousands of needle holes through a shield. CYPHERCYLENT enclosures use non-stitched TitanRF Faraday Fabric bonded with conductive TitanRF Tape, so the shell stays continuous.
A door is only as good as whoever closed it last. The patent-pending RFMagLink™ door uses three rows of magnets that pull into a uniform seal on contact.
Examiners need power and data inside. Shielded filter plates pass power, Ethernet, USB, and other connections through the wall without opening a signal path. Connections are specified with your build, and modular plates can be reconfigured later.
Data already synced to a manufacturer or service provider lives on their servers. Preserve it separately through the appropriate legal process.
Shielding blocks new signals. A recording or log already underway inside the vehicle continues locally.
Record when isolation began, who entered the enclosure, and what was connected, and when.
05 · Vehicle enclosures
Both are built to stand in a dry indoor space, such as an examination bay, evidence garage, or lab, and stay deployed for as long as the case requires. Tow the vehicle to the facility, drive it in, and close the shell around it.
A vehicle bay, a double-door side vestibule so examiners can come and go while the bay stays sealed, and a rear chamber that isolates phones and other live devices found in the vehicle. Includes an AC power filter for the vestibule light. Recommended dimensions adjust to your vehicle and space.
A single shielded chamber on a carbon fiber frame, built to fit any vehicle at the size you specify. A straightforward way to hold a seized vehicle in isolation between sessions. Filter connections and lighting are added as options.
The standard build is a starting point. Add what your facility and examiners need to work comfortably inside for hours or days at a time.
Length, width, and height sized to the vehicle, the bay, or the building you are deploying into.
Shielded Ethernet, DC power, USB Type-C, fiber, and RF connections in the quantity and placement you specify.
LED rope lighting along the ceiling, powered through a shielded filter, so examiners can see the whole cabin and engine bay.
Shielded honeycomb air vents with blower fans move air through the shielding layer without opening a signal path.
An exterior cover that protects the shielding fabric from rain, snow, wind, and UV outside a controlled indoor space.
An exterior cover, an interior liner, or both, so conversations and briefings inside do not carry into the room.
An upgrade from the standard floor mat that adds comfort underfoot, abrasion resistance, and conductive ground continuity.
RF shielded viewing windows set into a door or wall, so supervisors can see in without opening the enclosure.
A power filter with an integrated EMP surge arrester on the AC line, where inbound pulse protection matters too.
TitanRF Flame Retardant Faraday Fabric in place of the standard layer, where facility fire codes call for it.
Vestibule and rear chamber sizes, door placement, and how the chambers connect, specified to your workflow.
Made to order. Contact us for current lead time, or browse the vehicle forensics collection.
06 · Field checklist
A practical order of operations for isolating a connected vehicle, from the scene to the examination bay. Adapt it to your agency's policy and your examiner's guidance, and check items off as you go.
This checklist is general guidance, not legal advice. Follow your agency's evidence-handling policy and applicable law.
07 · Glossary
No terms match that filter. Try a shorter word, such as "key" or "data".
FAQ
Have a question about a specific vehicle, facility, or workflow? Our team can help scope a build. Contact us.
Build yours
Tell us the vehicles you handle, the space you have, and how your examiners work. We will scope a Faraday vehicle enclosure built around it.
