I know where you have been last summer: Extracting privacy-sensitive information via forensic analysis of the Mercedes-Benz NTG52 infotainment system
Modern vehicles are equipped with In-Vehicle Infotainment (IVI) systems that offers different functions, such as typical radio and multimedia services, navigation and internet browsing. To operate properly, IVI systems have to store locally different types of data, reflecting user preferences and be...
Gespeichert in:
| Veröffentlicht in: | Forensic science international. Digital investigation (Online) Jg. 53; S. 301909 |
|---|---|
| Hauptverfasser: | , , |
| Format: | Journal Article |
| Sprache: | Englisch |
| Veröffentlicht: |
Elsevier Ltd
01.06.2025
|
| Schlagworte: | |
| ISSN: | 2666-2817 |
| Online-Zugang: | Volltext |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| Abstract | Modern vehicles are equipped with In-Vehicle Infotainment (IVI) systems that offers different functions, such as typical radio and multimedia services, navigation and internet browsing. To operate properly, IVI systems have to store locally different types of data, reflecting user preferences and behaviors. If stored and managed insecurely, these data might expose sensitive information and represent a privacy risk. In this paper we address this issue by presenting a methodology for the extraction of privacy-sensitive information from the popular NTG5 COMMAND IVI system (specifically, the NTG5⁎2 version by Harman), deployed in some Mercedes-Benz vehicles from 2013 to 2019. We show that it is possible to extract information related to geographic locations and various vehicles events (such as ignition and doors opening and closing) dating back to the previous 8 months, and that these data can be cross-referenced to precisely identify the activities and habits of the driver. Moreover, we develop a novel forensic tool to automate this task.1 Given the past usage of the NTG5 system, our work might have real life implications for the privacy of millions of drivers, owners and passengers. As a final contribution, we develop a novel technique for SQLite data carving specifically designed to identify deleted data. Comparison with existing state-of-the-art tools for SQLite3 data recovery demonstrates that our approach is more effective in recovering deleted traces than general purpose tools.
•Unencrypted disks used in IVI systems allow the extraction of privacy-sensitive information from GPS logs.•Proprietary formats used to encode GPS trails in IVI systems can be reverse engineered with some initial assumptions.•Cross-referencing extracted GPS trails with OSINT sources enable detailed reconstruction of daily usage of a vehicle. |
|---|---|
| AbstractList | Modern vehicles are equipped with In-Vehicle Infotainment (IVI) systems that offers different functions, such as typical radio and multimedia services, navigation and internet browsing. To operate properly, IVI systems have to store locally different types of data, reflecting user preferences and behaviors. If stored and managed insecurely, these data might expose sensitive information and represent a privacy risk. In this paper we address this issue by presenting a methodology for the extraction of privacy-sensitive information from the popular NTG5 COMMAND IVI system (specifically, the NTG5⁎2 version by Harman), deployed in some Mercedes-Benz vehicles from 2013 to 2019. We show that it is possible to extract information related to geographic locations and various vehicles events (such as ignition and doors opening and closing) dating back to the previous 8 months, and that these data can be cross-referenced to precisely identify the activities and habits of the driver. Moreover, we develop a novel forensic tool to automate this task.1 Given the past usage of the NTG5 system, our work might have real life implications for the privacy of millions of drivers, owners and passengers. As a final contribution, we develop a novel technique for SQLite data carving specifically designed to identify deleted data. Comparison with existing state-of-the-art tools for SQLite3 data recovery demonstrates that our approach is more effective in recovering deleted traces than general purpose tools.
•Unencrypted disks used in IVI systems allow the extraction of privacy-sensitive information from GPS logs.•Proprietary formats used to encode GPS trails in IVI systems can be reverse engineered with some initial assumptions.•Cross-referencing extracted GPS trails with OSINT sources enable detailed reconstruction of daily usage of a vehicle. |
| ArticleNumber | 301909 |
| Author | Stabili, Dario Valgimigli, Filip Marchetti, Mirco |
| Author_xml | – sequence: 1 givenname: Dario orcidid: 0000-0001-6850-334X surname: Stabili fullname: Stabili, Dario email: dario.stabili@unimore.it – sequence: 2 givenname: Filip orcidid: 0009-0009-2852-2461 surname: Valgimigli fullname: Valgimigli, Filip email: filip.valgimigli@unimore.it – sequence: 3 givenname: Mirco orcidid: 0000-0002-7408-6906 surname: Marchetti fullname: Marchetti, Mirco email: mirco.marchetti@unimore.it |
| BookMark | eNqFkM9OHDEMh3MAqRR4Ai55gdkmmU0mQeqhRfyTgF7oOQoeD-tlJ1MlYWF4D96X2d2eeqAny7I_W7_vK9uLQ0TGTqSYSSHNt-Wsy9TSTAmlZ7WQTrg9dqCMMZWysvnCjnNeCiFqJaVV-oC9X_OnOLzwlwUm5OPwzBdhjfwBMfJVyIXn577HdMrPX0sKUCg-8j-J1gHGKmPMVGhap9gNqQ-FhsjXFPjUbWbAQwyrMVPmQ8fLAvktJsAWc_UT4xu_u7_UaguXQLHHOL0bc8H-iO13YZXx-G89ZL8vzu_PrqqbX5fXZz9uKqjntlQddKANGA2I1mllQ2OVaxw41PNa6qYJUtfBgbW67YIB15oHYdu5DNKggvqQ1bu7kIacE3Z-ytaHNHop_EaoX_qtUL8R6ndCJ8r9QwGVbfhJEa3-w37fsTjFWhMmn4EwTlIoIRTfDvQp_wHhBpnk |
| CitedBy_id | crossref_primary_10_59395_ijadis_v6i2_1408 |
| Cites_doi | 10.1109/TIFS.2018.2870826 10.1007/s00779-011-0428-7 10.46386/ijcfati.v1i1-3.17 |
| ContentType | Journal Article |
| Copyright | 2025 The Author(s) |
| Copyright_xml | – notice: 2025 The Author(s) |
| DBID | 6I. AAFTH AAYXX CITATION |
| DOI | 10.1016/j.fsidi.2025.301909 |
| DatabaseName | ScienceDirect Open Access Titles Elsevier:ScienceDirect:Open Access CrossRef |
| DatabaseTitle | CrossRef |
| DatabaseTitleList | |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Social Welfare & Social Work |
| ExternalDocumentID | 10_1016_j_fsidi_2025_301909 S2666281725000484 |
| GroupedDBID | 0R~ 6I. AAEDW AAFTH AALRI AAXUO AAYWO ABJNI ACRLP AEBSH AEIPS AFJKZ AFXIZ AGCQF AGRNS AGUMN AIEXJ AIKHN AITUG ALMA_UNASSIGNED_HOLDINGS AMRAJ ANKPU AOUOD APXCP AXJTR BNPGV EFJIC FDB M41 ROL SPC SPCBC SSB SSH SSL SSV T5K AATTM AAXKI AAYFN AAYXX ABBOA ACLOT AIIUN BKOJK CITATION EFKBS EFLBG FYGXN |
| ID | FETCH-LOGICAL-c348t-fcfc56c65cee89528a782979c9e5431577a153a9c885dfa6c9d6b08d41a16e2c3 |
| ISICitedReferencesCount | 0 |
| ISICitedReferencesURI | http://www.webofscience.com/api/gateway?GWVersion=2&SrcApp=Summon&SrcAuth=ProQuest&DestLinkType=CitingArticles&DestApp=WOS_CPL&KeyUT=001448818600001&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| ISSN | 2666-2817 |
| IngestDate | Sat Nov 29 07:47:26 EST 2025 Tue Nov 18 21:03:53 EST 2025 Sat Jul 05 17:10:50 EDT 2025 |
| IsDoiOpenAccess | true |
| IsOpenAccess | true |
| IsPeerReviewed | true |
| IsScholarly | true |
| Keywords | Privacy exposure SQL database carving Privacy analysis of infotainment systems |
| Language | English |
| License | This is an open access article under the CC BY-NC-ND license. |
| LinkModel | OpenURL |
| MergedId | FETCHMERGED-LOGICAL-c348t-fcfc56c65cee89528a782979c9e5431577a153a9c885dfa6c9d6b08d41a16e2c3 |
| ORCID | 0009-0009-2852-2461 0000-0001-6850-334X 0000-0002-7408-6906 |
| OpenAccessLink | https://dx.doi.org/10.1016/j.fsidi.2025.301909 |
| ParticipantIDs | crossref_primary_10_1016_j_fsidi_2025_301909 crossref_citationtrail_10_1016_j_fsidi_2025_301909 elsevier_sciencedirect_doi_10_1016_j_fsidi_2025_301909 |
| PublicationCentury | 2000 |
| PublicationDate | June 2025 2025-06-00 |
| PublicationDateYYYYMMDD | 2025-06-01 |
| PublicationDate_xml | – month: 06 year: 2025 text: June 2025 |
| PublicationDecade | 2020 |
| PublicationTitle | Forensic science international. Digital investigation (Online) |
| PublicationYear | 2025 |
| Publisher | Elsevier Ltd |
| Publisher_xml | – name: Elsevier Ltd |
| References | Kwon, Wang, Jung, Lee, Perdisci (br0220) 2021 Gerhards (br0480) Mar. 2009 California State Legislature (br0640) GIS StackExchange (br0630) BERLA (br0410) 2022 SQLite - Database File Format (br0510) Gomez Buquerin, Corbett, Hof (br0420) 2021; 36 AUTOSAR (br0470) SysTools (br0540) DC3 - DoD Cyber Crime Center (br0590) 2024 Jacobs, Choo, Kechadi, Le-Khac (br0440) 2017 Read, Xynos, Sutherland, Bovee, Tamburro (br0050) 2024; 50 Whelan, Sammons, McManus, Fenger (br0400) 2018; 1 Bosch (br0010) 1991 Pawlaszczyk, Hummert (br0520) 2021; 1 SQLabs (br0560) Hannay (br0350) 2008 Radu, Garcia (br0160) 2016 Stabili, Marchetti (br0190) 2019 Salem, Hamarsheh (br0100) 2024; 51 Soni, Kaur, Aziz (br0090) 2024; 51 Gurbani, Burger, Anjali, Abdelnur, Festor (br0490) Feb. 2013 Karafili, Cristani, Viganò (br0240) 2018 ACEA (br0030) ForensicFocus (br0620) SQLite Consortium (br0120) Kulandaivel, Goyal, Agrawal, Sekar (br0290) 2019 TomTom Forum (br0610) Le-Khac, Roeloffs, Kechadi (br0380) 2014 Mazloom, Rezaeirad, Hunter, McCoy (br0330) 2016 McKinnon (br0550) Juma, Huang, Tripunitara (br0210) 2020 Hoppe, Kuhlmann, Kiltz, Dittmann (br0300) 2012 Hannay (br0370) 2017 Kang, Hur, Kim, Kim (br0080) 2024; 51 Lacroix, El-Khatib, Akalu (br0390) 2016 Groza, Popa, Murvay, Elovici, Shabtai (br0170) 2021 Marchetti, Stabili (br0270) 2019; 14 Pagani, Balzarotti (br0250) 2019 Contag, Li, Pawlowski, Domke, Levchenko, Holz, Savage (br0430) 2017 SQLite (br0500) Zeng, Liu, Shu, Wang, Li, Dou, Wang, Yang (br0340) 2018 Daniels (br0530) 2023 Lee, Lee, Lee (br0150) 2017; 11 Jeon, Bang, Byun, Lee (br0130) 2012; 16 Personal Information Protection Commission (br0650) Pesé, Stacer, Campos, Newberry, Chen, Shin (br0280) 2019 Ebbers, Gense, Bakkouch, Freiling, Schinzel (br0070) 2024; 48 LIN Consortium (br0020) 2010 bring2lite (br0580) Lab (br0450) Wu, Xu, Zhang, Xu, Ren, Zheng (br0140) 2013 Mattei, McLaughlin, Katcher, Votipka (br0260) 2022 De Grazia (br0570) Hannay (br0360) 2009 Dragonas, Lambrinoudakis, Nakoutis (br0060) 2024; 50 European Parliament and Council (br0460) Cho, Shin (br0180) 2016 Frassinelli, Park, Nürnberger (br0310) 2020 Babun, Sikder, Acar, Uluagac (br0230) NDSS 2022, San Diego, California, USA, April 24–28, 2022 ACEA (br0040) Stabili, Bocchi, Valgimigli, Marchetti (br0110) 2024 Checkoway, McCoy, Kantor, Anderson, Shacham, Savage, Koscher, Czeskis, Roesner, Kohno (br0320) 2011 Pollicino, Stabili, Marchetti (br0200) Jun 2023 TomTom Forum (br0600) Kang (10.1016/j.fsidi.2025.301909_br0080) 2024; 51 Radu (10.1016/j.fsidi.2025.301909_br0160) 2016 SQLite - Database File Format (10.1016/j.fsidi.2025.301909_br0510) Lee (10.1016/j.fsidi.2025.301909_br0150) 2017; 11 Hoppe (10.1016/j.fsidi.2025.301909_br0300) 2012 Kwon (10.1016/j.fsidi.2025.301909_br0220) 2021 Karafili (10.1016/j.fsidi.2025.301909_br0240) 2018 Gomez Buquerin (10.1016/j.fsidi.2025.301909_br0420) 2021; 36 Wu (10.1016/j.fsidi.2025.301909_br0140) 2013 BERLA (10.1016/j.fsidi.2025.301909_br0410) Pesé (10.1016/j.fsidi.2025.301909_br0280) 2019 AUTOSAR (10.1016/j.fsidi.2025.301909_br0470) Ebbers (10.1016/j.fsidi.2025.301909_br0070) 2024; 48 LIN Consortium (10.1016/j.fsidi.2025.301909_br0020) Le-Khac (10.1016/j.fsidi.2025.301909_br0380) 2014 Stabili (10.1016/j.fsidi.2025.301909_br0190) 2019 ACEA (10.1016/j.fsidi.2025.301909_br0030) Mazloom (10.1016/j.fsidi.2025.301909_br0330) 2016 Groza (10.1016/j.fsidi.2025.301909_br0170) 2021 SQLite Consortium (10.1016/j.fsidi.2025.301909_br0120) Lacroix (10.1016/j.fsidi.2025.301909_br0390) 2016 Read (10.1016/j.fsidi.2025.301909_br0050) 2024; 50 Daniels (10.1016/j.fsidi.2025.301909_br0530) bring2lite (10.1016/j.fsidi.2025.301909_br0580) Kulandaivel (10.1016/j.fsidi.2025.301909_br0290) 2019 De Grazia (10.1016/j.fsidi.2025.301909_br0570) Marchetti (10.1016/j.fsidi.2025.301909_br0270) 2019; 14 Stabili (10.1016/j.fsidi.2025.301909_br0110) 2024 Hannay (10.1016/j.fsidi.2025.301909_br0370) 2017 TomTom Forum (10.1016/j.fsidi.2025.301909_br0600) European Parliament and Council (10.1016/j.fsidi.2025.301909_br0460) Babun (10.1016/j.fsidi.2025.301909_br0230) 2022 Jeon (10.1016/j.fsidi.2025.301909_br0130) 2012; 16 Zeng (10.1016/j.fsidi.2025.301909_br0340) 2018 Gurbani (10.1016/j.fsidi.2025.301909_br0490) Juma (10.1016/j.fsidi.2025.301909_br0210) 2020 Checkoway (10.1016/j.fsidi.2025.301909_br0320) 2011 ForensicFocus (10.1016/j.fsidi.2025.301909_br0620) GIS StackExchange (10.1016/j.fsidi.2025.301909_br0630) SQLite (10.1016/j.fsidi.2025.301909_br0500) Hannay (10.1016/j.fsidi.2025.301909_br0360) 2009 Gerhards (10.1016/j.fsidi.2025.301909_br0480) Hannay (10.1016/j.fsidi.2025.301909_br0350) 2008 DC3 - DoD Cyber Crime Center (10.1016/j.fsidi.2025.301909_br0590) Dragonas (10.1016/j.fsidi.2025.301909_br0060) 2024; 50 McKinnon (10.1016/j.fsidi.2025.301909_br0550) Bosch (10.1016/j.fsidi.2025.301909_br0010) California State Legislature (10.1016/j.fsidi.2025.301909_br0640) Pagani (10.1016/j.fsidi.2025.301909_br0250) 2019 Salem (10.1016/j.fsidi.2025.301909_br0100) 2024; 51 SQLabs (10.1016/j.fsidi.2025.301909_br0560) Pollicino (10.1016/j.fsidi.2025.301909_br0200) 2023 Cho (10.1016/j.fsidi.2025.301909_br0180) 2016 ACEA (10.1016/j.fsidi.2025.301909_br0040) Pawlaszczyk (10.1016/j.fsidi.2025.301909_br0520) 2021; 1 Soni (10.1016/j.fsidi.2025.301909_br0090) 2024; 51 Contag (10.1016/j.fsidi.2025.301909_br0430) 2017 Lab (10.1016/j.fsidi.2025.301909_br0450) Frassinelli (10.1016/j.fsidi.2025.301909_br0310) 2020 Personal Information Protection Commission (10.1016/j.fsidi.2025.301909_br0650) Mattei (10.1016/j.fsidi.2025.301909_br0260) 2022 Jacobs (10.1016/j.fsidi.2025.301909_br0440) 2017 TomTom Forum (10.1016/j.fsidi.2025.301909_br0610) Whelan (10.1016/j.fsidi.2025.301909_br0400) 2018; 1 SysTools (10.1016/j.fsidi.2025.301909_br0540) |
| References_xml | – year: 2009 ident: br0360 article-title: Satellite navigation forensics techniques publication-title: Proceeding of the 7th Australian Digital Forensics Conference – ident: br0460 article-title: GDPR - general data protection regulation – start-page: 232 year: 2016 end-page: 243 ident: br0330 article-title: A security analysis of an in Vehicle Infotainment and App platform publication-title: Proceedings of the 10th USENIX Conference on Offensive Technologies, WOOT'16 – start-page: 295 year: 2013 end-page: 299 ident: br0140 article-title: A recovery approach for sqlite history recorders from yaffs2 publication-title: Information and Communication Technology – ident: br0040 article-title: Access to in-vehicle data - position paper – ident: br0640 article-title: CCPA - California consumer privacy act – year: Jun 2023 ident: br0200 article-title: Performance comparison of timing-based anomaly detectors for controller area network: a reproducible study publication-title: ACM Trans. Cyber-Phys. Syst. – start-page: 283 year: 2016 end-page: 300 ident: br0160 article-title: LeiA: a lightweight authentication protocol for CAN publication-title: Computer Security – ESORICS 2016 – start-page: 1044 year: 2016 end-page: 1055 ident: br0180 article-title: Error handling of in-vehicle networks makes them vulnerable publication-title: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '16 – ident: br0560 article-title: SQLite doctor – volume: 50 year: 2024 ident: br0050 article-title: Nintendo 3ds forensics: a secondhand case study publication-title: DFRWS APAC 2024 - Selected Papers from the 4th Annual Digital Forensics Research Conference APAC – start-page: 1533 year: 2020 end-page: 1550 ident: br0210 article-title: Forensic analysis in access control: foundations and a case-study from practice publication-title: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS '20 – ident: br0450 article-title: Mercedes-Benz MBUX security research report – start-page: 2283 year: 2019 end-page: 2300 ident: br0280 article-title: LibreCAN: automated CAN message translator publication-title: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS '19 – start-page: 1 year: 2019 end-page: 7 ident: br0190 article-title: Detection of missing CAN messages through inter-arrival time analysis publication-title: 2019 IEEE 90th Vehicular Technology Conference (VTC2019-Fall) – volume: 50 year: 2024 ident: br0060 article-title: Forensic analysis of openai's chatgpt mobile application publication-title: Forensic Sci. Int. Digit. Investig. – start-page: 699 year: 2017 end-page: 705 ident: br0440 article-title: Volkswagen car entertainment system forensics publication-title: 2017 IEEE Trustcom/BigDataSE/ICESS – volume: 1 year: 2018 ident: br0400 article-title: Retrieval of infotainment system artifacts from vehicles using iVe publication-title: J. Appl. Digit. Evid. – year: 2022 ident: br0410 article-title: Berla.co – ident: br0620 article-title: TomTom GPS encrypted triplog files – start-page: 1751 year: 2019 end-page: 1768 ident: br0250 article-title: Back to the whiteboard: a principled approach for the assessment and design of memory forensic techniques publication-title: 28th USENIX Security Symposium (USENIX Security 19) – ident: br0030 article-title: European automobile ManufacturersÁssociation – volume: 14 start-page: 1083 year: 2019 end-page: 1097 ident: br0270 article-title: READ: reverse engineering of automotive data frames publication-title: IEEE Trans. Inf. Forensics Secur. – start-page: 59 year: 2016 end-page: 66 ident: br0390 article-title: Vehicular digital forensics: what does my vehicle know about me? publication-title: Proceedings of the 6th ACM Symposium on Development and Analysis of Intelligent Vehicular Networks and Applications, DIVANet '16 – start-page: 619 year: 2022 end-page: 631 ident: br0260 article-title: A qualitative evaluation of reverse engineering tool usability publication-title: Proceedings of the 38th Annual Computer Security Applications Conference, ACSAC '22 – year: 2023 ident: br0530 article-title: Undark - sqlite3 database data recovery tool – volume: 51 year: 2024 ident: br0080 article-title: Forensic analysis and data decryption of tencent meeting in windows environment publication-title: Forensic Sci. Int. Digit. Investig. – ident: br0500 article-title: Sqlite database file format – ident: br0610 article-title: TripLoging enabled – ident: br0120 article-title: SQLite library – ident: br0510 article-title: SQLite - database file format – year: 2008 ident: br0350 article-title: Forensic acquisition and analysis of the TomTom one satellite navigation unit publication-title: Proceeding of the 6th Australian Digital Forensics Conference – start-page: 195 year: 2024 end-page: 210 ident: br0110 article-title: Finding (and exploiting) vulnerabilities on ip cameras: the tenda cp3 case study publication-title: Advances in Information and Computer Security – ident: br0570 article-title: SQLite-parser - GitHub repository – ident: br0600 article-title: TripLog - where did I go? – volume: 1 start-page: 27 year: 2021 end-page: 41 ident: br0520 article-title: Making the invisible visible - techniques for recovering deleted sqlite data records publication-title: Int. J. Cyber Forensics Adv. Threat Invest. – year: NDSS 2022, San Diego, California, USA, April 24–28, 2022 ident: br0230 article-title: The truth shall set thee free: enabling practical forensic capabilities in smart environments publication-title: 29th Annual Network and Distributed System Security Symposium – ident: br0630 article-title: How does TomTom stores trackpoint information on its internal drive – year: 2017 ident: br0370 article-title: A non-device specific framework for the development of forensic locational data analysis procedure for consumer grade small and embedded devices – year: 2010 ident: br0020 article-title: LIN specification package - rev. 2.2A – ident: br0540 article-title: SysTools SQLite database recovery – volume: 51 year: 2024 ident: br0100 article-title: Forensically analyzing iot smart camera using maoidff-iot framework publication-title: Forensic Sci. Int. Digit. Investig. – year: 2021 ident: br0220 article-title: C publication-title: 28th Annual Network and Distributed System Security Symposium – start-page: 267 year: 2014 end-page: 276 ident: br0380 article-title: Forensic analysis of the TomTom navigation application publication-title: Advances in Digital Forensics X – year: Mar. 2009 ident: br0480 article-title: The syslog protocol – start-page: 389 year: 2019 end-page: 405 ident: br0290 article-title: CANvas: fast and inexpensive automotive network mapping publication-title: 28th USENIX Security Symposium (USENIX Security 19) – ident: br0580 article-title: bring2lite - GitHub repository – volume: 16 start-page: 707 year: 2012 end-page: 715 ident: br0130 article-title: A recovery method of deleted record for sqlite database publication-title: Pers. Ubiquitous Comput. – ident: br0550 article-title: Autopsy plugins - GitHub repository – volume: 51 year: 2024 ident: br0090 article-title: Decoding digital interactions: an extensive study of teamviewer's forensic artifacts across windows and Android platforms publication-title: Forensic Sci. Int. Digit. Investig. – ident: br0470 article-title: Log and trace protocol specification – start-page: 4259 year: 2021 end-page: 4276 ident: br0170 article-title: CANARY - a reactive defense mechanism for controller area networks based on Active RelaYs publication-title: 30th USENIX Security Symposium (USENIX Security 21) – start-page: 231 year: 2017 end-page: 250 ident: br0430 article-title: How they did it: an analysis of emission defeat devices in modern automobiles publication-title: 2017 IEEE Symposium on Security and Privacy (SP) – year: 1991 ident: br0010 article-title: CAN specification version 2.0 – year: Feb. 2013 ident: br0490 article-title: The common log format (CLF) for the session initiation protocol (SIP): framework and information model – volume: 36 year: 2021 ident: br0420 article-title: A generalized approach to automotive forensics publication-title: DFRWS 2021 EU - Selected Papers and Extended Abstracts of the Eighth Annual DFRWS Europe Conference – year: 2024 ident: br0590 article-title: Sqlite dissect – volume: 48 year: 2024 ident: br0070 article-title: Grand theft api: a forensic analysis of vehicle cloud data publication-title: Dfrws EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe – start-page: 1527 year: 2018 end-page: 1544 ident: br0340 article-title: All Your GPS Are Belong to Us: Towards Stealthy Manipulation of Road Navigation Systems, in: 27th USENIX Security Symposium (USENIX Security 18) – start-page: 125 year: 2012 end-page: 136 ident: br0300 article-title: IT-forensic automotive investigations on the example of route reconstruction on automotive system and communication data publication-title: Computer Safety, Reliability, and Security – volume: 11 start-page: 1557 year: 2017 end-page: 1569 ident: br0150 article-title: Spare: efficient sqlite recovery using database schema patterns publication-title: KSII Trans. Int. Inf. Syst. – start-page: 281 year: 2018 end-page: 301 ident: br0240 article-title: A formal approach to analyzing cyber-forensics evidence publication-title: Computer Security – ident: br0650 article-title: APPI - act on the protection of personal information – start-page: 6 year: 2011 ident: br0320 article-title: Comprehensive experimental analyses of automotive attack surfaces publication-title: Proceedings of the 20th USENIX Conference on Security, SEC'11 – start-page: 1401 year: 2020 end-page: 1415 ident: br0310 article-title: I know where you parked last summer: automated reverse engineering and privacy analysis of modern cars publication-title: 2020 IEEE Symposium on Security and Privacy (SP) – ident: 10.1016/j.fsidi.2025.301909_br0630 – start-page: 2283 year: 2019 ident: 10.1016/j.fsidi.2025.301909_br0280 article-title: LibreCAN: automated CAN message translator – ident: 10.1016/j.fsidi.2025.301909_br0540 – ident: 10.1016/j.fsidi.2025.301909_br0480 – volume: 1 issue: 1 year: 2018 ident: 10.1016/j.fsidi.2025.301909_br0400 article-title: Retrieval of infotainment system artifacts from vehicles using iVe publication-title: J. Appl. Digit. Evid. – ident: 10.1016/j.fsidi.2025.301909_br0510 – volume: 36 year: 2021 ident: 10.1016/j.fsidi.2025.301909_br0420 article-title: A generalized approach to automotive forensics publication-title: Forensic Sci. Int. Digit. Investig. – year: 2008 ident: 10.1016/j.fsidi.2025.301909_br0350 article-title: Forensic acquisition and analysis of the TomTom one satellite navigation unit – ident: 10.1016/j.fsidi.2025.301909_br0030 – start-page: 125 year: 2012 ident: 10.1016/j.fsidi.2025.301909_br0300 article-title: IT-forensic automotive investigations on the example of route reconstruction on automotive system and communication data – start-page: 1044 year: 2016 ident: 10.1016/j.fsidi.2025.301909_br0180 article-title: Error handling of in-vehicle networks makes them vulnerable – ident: 10.1016/j.fsidi.2025.301909_br0590 – ident: 10.1016/j.fsidi.2025.301909_br0550 – ident: 10.1016/j.fsidi.2025.301909_br0470 – start-page: 231 year: 2017 ident: 10.1016/j.fsidi.2025.301909_br0430 article-title: How they did it: an analysis of emission defeat devices in modern automobiles – start-page: 267 year: 2014 ident: 10.1016/j.fsidi.2025.301909_br0380 article-title: Forensic analysis of the TomTom navigation application – ident: 10.1016/j.fsidi.2025.301909_br0560 – ident: 10.1016/j.fsidi.2025.301909_br0120 – start-page: 1751 year: 2019 ident: 10.1016/j.fsidi.2025.301909_br0250 article-title: Back to the whiteboard: a principled approach for the assessment and design of memory forensic techniques – ident: 10.1016/j.fsidi.2025.301909_br0460 – volume: 11 start-page: 1557 year: 2017 ident: 10.1016/j.fsidi.2025.301909_br0150 article-title: Spare: efficient sqlite recovery using database schema patterns publication-title: KSII Trans. Int. Inf. Syst. – ident: 10.1016/j.fsidi.2025.301909_br0610 – start-page: 4259 year: 2021 ident: 10.1016/j.fsidi.2025.301909_br0170 article-title: CANARY - a reactive defense mechanism for controller area networks based on Active RelaYs – ident: 10.1016/j.fsidi.2025.301909_br0620 – ident: 10.1016/j.fsidi.2025.301909_br0600 – volume: 48 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0070 article-title: Grand theft api: a forensic analysis of vehicle cloud data publication-title: Forensic Sci. Int. Digit. Investig. – volume: 51 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0100 article-title: Forensically analyzing iot smart camera using maoidff-iot framework publication-title: Forensic Sci. Int. Digit. Investig. – ident: 10.1016/j.fsidi.2025.301909_br0500 – ident: 10.1016/j.fsidi.2025.301909_br0410 – start-page: 232 year: 2016 ident: 10.1016/j.fsidi.2025.301909_br0330 article-title: A security analysis of an in Vehicle Infotainment and App platform – start-page: 281 year: 2018 ident: 10.1016/j.fsidi.2025.301909_br0240 article-title: A formal approach to analyzing cyber-forensics evidence – start-page: 389 year: 2019 ident: 10.1016/j.fsidi.2025.301909_br0290 article-title: CANvas: fast and inexpensive automotive network mapping – start-page: 1401 year: 2020 ident: 10.1016/j.fsidi.2025.301909_br0310 article-title: I know where you parked last summer: automated reverse engineering and privacy analysis of modern cars – ident: 10.1016/j.fsidi.2025.301909_br0020 – ident: 10.1016/j.fsidi.2025.301909_br0490 – start-page: 283 year: 2016 ident: 10.1016/j.fsidi.2025.301909_br0160 article-title: LeiA: a lightweight authentication protocol for CAN – ident: 10.1016/j.fsidi.2025.301909_br0530 – start-page: 59 year: 2016 ident: 10.1016/j.fsidi.2025.301909_br0390 article-title: Vehicular digital forensics: what does my vehicle know about me? – start-page: 619 year: 2022 ident: 10.1016/j.fsidi.2025.301909_br0260 article-title: A qualitative evaluation of reverse engineering tool usability – start-page: 1533 year: 2020 ident: 10.1016/j.fsidi.2025.301909_br0210 article-title: Forensic analysis in access control: foundations and a case-study from practice – year: 2021 ident: 10.1016/j.fsidi.2025.301909_br0220 article-title: C2SR: cybercrime scene reconstruction for post-mortem forensic analysis – ident: 10.1016/j.fsidi.2025.301909_br0570 – ident: 10.1016/j.fsidi.2025.301909_br0650 – ident: 10.1016/j.fsidi.2025.301909_br0040 – volume: 51 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0080 article-title: Forensic analysis and data decryption of tencent meeting in windows environment publication-title: Forensic Sci. Int. Digit. Investig. – ident: 10.1016/j.fsidi.2025.301909_br0450 – start-page: 699 year: 2017 ident: 10.1016/j.fsidi.2025.301909_br0440 article-title: Volkswagen car entertainment system forensics – start-page: 195 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0110 article-title: Finding (and exploiting) vulnerabilities on ip cameras: the tenda cp3 case study – ident: 10.1016/j.fsidi.2025.301909_br0640 – volume: 14 start-page: 1083 issue: 4 year: 2019 ident: 10.1016/j.fsidi.2025.301909_br0270 article-title: READ: reverse engineering of automotive data frames publication-title: IEEE Trans. Inf. Forensics Secur. doi: 10.1109/TIFS.2018.2870826 – ident: 10.1016/j.fsidi.2025.301909_br0580 – ident: 10.1016/j.fsidi.2025.301909_br0010 – volume: 51 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0090 article-title: Decoding digital interactions: an extensive study of teamviewer's forensic artifacts across windows and Android platforms publication-title: Forensic Sci. Int. Digit. Investig. – start-page: 6 year: 2011 ident: 10.1016/j.fsidi.2025.301909_br0320 article-title: Comprehensive experimental analyses of automotive attack surfaces – volume: 16 start-page: 707 year: 2012 ident: 10.1016/j.fsidi.2025.301909_br0130 article-title: A recovery method of deleted record for sqlite database publication-title: Pers. Ubiquitous Comput. doi: 10.1007/s00779-011-0428-7 – volume: 50 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0050 article-title: Nintendo 3ds forensics: a secondhand case study publication-title: Forensic Sci. Int. Digit. Investig. – start-page: 295 year: 2013 ident: 10.1016/j.fsidi.2025.301909_br0140 article-title: A recovery approach for sqlite history recorders from yaffs2 – year: 2022 ident: 10.1016/j.fsidi.2025.301909_br0230 article-title: The truth shall set thee free: enabling practical forensic capabilities in smart environments – year: 2017 ident: 10.1016/j.fsidi.2025.301909_br0370 – volume: 1 start-page: 27 issue: 1–3 year: 2021 ident: 10.1016/j.fsidi.2025.301909_br0520 article-title: Making the invisible visible - techniques for recovering deleted sqlite data records publication-title: Int. J. Cyber Forensics Adv. Threat Invest. doi: 10.46386/ijcfati.v1i1-3.17 – volume: 50 year: 2024 ident: 10.1016/j.fsidi.2025.301909_br0060 article-title: Forensic analysis of openai's chatgpt mobile application publication-title: Forensic Sci. Int. Digit. Investig. – year: 2009 ident: 10.1016/j.fsidi.2025.301909_br0360 article-title: Satellite navigation forensics techniques – start-page: 1 year: 2019 ident: 10.1016/j.fsidi.2025.301909_br0190 article-title: Detection of missing CAN messages through inter-arrival time analysis – start-page: 1527 year: 2018 ident: 10.1016/j.fsidi.2025.301909_br0340 – year: 2023 ident: 10.1016/j.fsidi.2025.301909_br0200 article-title: Performance comparison of timing-based anomaly detectors for controller area network: a reproducible study publication-title: ACM Trans. Cyber-Phys. Syst. |
| SSID | ssj0003211825 |
| Score | 2.2933824 |
| Snippet | Modern vehicles are equipped with In-Vehicle Infotainment (IVI) systems that offers different functions, such as typical radio and multimedia services,... |
| SourceID | crossref elsevier |
| SourceType | Enrichment Source Index Database Publisher |
| StartPage | 301909 |
| SubjectTerms | Privacy analysis of infotainment systems Privacy exposure SQL database carving |
| Title | I know where you have been last summer: Extracting privacy-sensitive information via forensic analysis of the Mercedes-Benz NTG52 infotainment system |
| URI | https://dx.doi.org/10.1016/j.fsidi.2025.301909 |
| Volume | 53 |
| WOSCitedRecordID | wos001448818600001&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| journalDatabaseRights | – providerCode: PRVESC databaseName: Elsevier SD Freedom Collection Journals 2021 issn: 2666-2817 databaseCode: AIEXJ dateStart: 20200301 customDbUrl: isFulltext: true dateEnd: 99991231 titleUrlDefault: https://www.sciencedirect.com omitProxy: false ssIdentifier: ssj0003211825 providerName: Elsevier |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwtV1Nj9MwELVKlwMXxKdYWJAPiEtJlab5sLktqIUibYVEEXuLHMfZzVLSVZotXf4Hf4RfyIwdJ1kVrQCJSxQ5sZN2XuLx5M0bQp6PMhR2Uq7jM57CAoWNHC7dyAkClqRukoAPLXSxiWg-Z8fH_EOv99PmwmyWUVGw7Zaf_1dTQxsYG1Nn_8LczaDQAPtgdNiC2WH7R4afDXR-2zcwhhpcri4Gp1hgKEEyFnjK1QDvRenikJNtpXOkdD56vhHy0lkjn12ziWpFVQ2PTS6QjojHUN21lTFBr_UIqTGpWjuvVfF9MF-8DTzduWEaGLHorhc8tWPZpKK8G5cc4lcvrGUCzY0IiAbpFWFUWwQZ2b2GnV8aTpmpH7Y8yb_mJ-bQFINGbewd5UsqQ2M4yku56kY-vKBlaJlwnE3JaflP8NYEhyN0PGYSQu0r3ugR78wWJnBxNswAC_kQLzEcY249byfHhrL4EQfGcb1AJ-L7N8ieFwWc9cne4Wxy_L6J7I09XLQhd7a5Fyt3pYmFO1f7vUvUcXMWd8jten1CDw2u7pKeKu6RA5PETT-rZSZKRV9Q27Aqv9wnP2YUIUc15ChAjiLkKEKOIuSogdwr2gKO7gCOdgBHAXDUAo5awNFVRgFw9ArgqAYc7QKOGsA9IJ-mk8Wbd05d7sORY59VTiYzGYQyDMBvYzzwmIgw75tLrlCwIYgiAdOz4JKxIM1EKHkaJi5L_ZEYhcqT44ekX6wK9YjQNB0LWPpnIhKZ744UT12e-eEIfH0GPz7ZJ579x2NZa-FjSZZlbEmPZ7E2U4xmio2Z9snLptO5kYK5_vTQmjKunybjpcYAv-s6Pv7Xjk_IrfYxOSD9qrxQT8lNuanydfmshukvQrnM5Q |
| linkProvider | Elsevier |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=I+know+where+you+have+been+last+summer%3A+Extracting+privacy-sensitive+information+via+forensic+analysis+of+the+Mercedes-Benz+NTG52+infotainment+system&rft.jtitle=Forensic+science+international.+Digital+investigation+%28Online%29&rft.au=Stabili%2C+Dario&rft.au=Valgimigli%2C+Filip&rft.au=Marchetti%2C+Mirco&rft.date=2025-06-01&rft.pub=Elsevier+Ltd&rft.issn=2666-2817&rft.volume=53&rft_id=info:doi/10.1016%2Fj.fsidi.2025.301909&rft.externalDocID=S2666281725000484 |
| thumbnail_l | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=2666-2817&client=summon |
| thumbnail_m | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=2666-2817&client=summon |
| thumbnail_s | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=2666-2817&client=summon |