Enabling Collaborative Forensic-by-Design for the Internet of Vehicles

1. Introduction

Modern vehicles have evolved into advanced technological platforms capable of exchanging data with other vehicles, infrastructure, pedestrians, and networks within the Internet of Vehicles (IoV). The term "Internet of Vehicles" (IoV) refers to the interconnected network of modern vehicles and its supporting infrastructure, enabling communication between road vehicles. The degree of connectedness may precipitate a significant transformation in vehicles and transportation. IoV technology allows the collection of real-time information about the surrounding environment, including traffic patterns, vehicle maintenance requirements, and weather conditions. Furthermore, it facilitates remote diagnostics and maintenance, making it easier for drivers to ensure their vehicles operate at peak performance. This technology provides advanced safety features, such as collision avoidance systems and automatic emergency braking. The Internet of Vehicles marks the beginning of a transformative era in transportation technology, with significant implications for individuals and society. The integration of automotive and communication technologies has significantly enhanced the role of personal vehicles in our daily lives. The development of Internet of Vehicles (IoV) technology—which enables vehicles to perceive their surroundings and navigate with minimal human input—has significantly enriched this data landscape. The vast amount of data generated in the IoV ecosystem serves as a substantial source of digital artefacts, including detailed records like recent destinations, frequently visited locations, routes, and personal information such as call logs, contacts, text messages, photos, and videos. It is well acknowledged that vehicles function as a significant repository of digital evidence that can yield essential insights into certain road crimes. This data is particularly valuable for investigating transportation incidents, where preserving human life and conducting thorough post-incident analyses are crucial. However, the fields of Internet of Things (IoT) and vehicle forensics are still relatively new compared to other areas of digital forensics. Researchers stress the need for innovative methodologies grounded in the "forensic-by-design" principle to enhance forensic capabilities in future vehicles.

The collection and management of digital evidence in intelligent vehicles is a highly complex process that may involve multiple stakeholders with varying expertise. To ensure complete confidence in the obtained digital evidence, most cases necessitate human involvement in both the seizure and subsequent handling of evidence. Digital Forensic Readiness (DFR) focuses on proactive planning and strategy development to ensure efficient and cost-effective digital forensic investigations when incidents occur. Implementing DFR requires comprehensive planning, including risk assessments, staff training, tool deployment, and metric evaluations. Studies highlight that access to security data and the protection of digital evidence are key factors in achieving forensic readiness. Some theoretical frameworks suggest that aspects like legal considerations, governance, policies, processes, personnel, and technology should be integrated to attain a state of readiness. For example [1] formulated a methodology that facilitates the assessment of DFR in organisations within Industry 4.0 and IIoT. The challenges posed by IoT devices compel digital forensic vendors to adapt and remain aligned with technological progress. Consequently, the authors discerned five indicators that underpin the DFR model. Furthermore, they offer potential practices and recommendations. The model development incorporated multiple standards, such as NIST SP800-86 [2]. Building on these concepts, this paper addresses the challenges of integrating collaborative forensics-by-design within the Internet of Vehicles (IoV) ecosystem and introduces the Collaborative Forensic Platform for Electronic Artefacts (CFPEA). The CFPEA framework is designed to securely collect, store, and share artefacts within the IoV environment. It ensures prompt access to critical forensic data through continuous monitoring and analysis of digital artefacts from connected and intelligent vehicles and their control units. Additionally, the CFPEA framework facilitates the collaborative exchange and analysis of digital artefacts derived from the IoV. It enables law enforcement agencies, forensic specialists, researchers, and other stakeholders to securely and swiftly search for artefacts detected by intelligent vehicles to resolve road crimes or investigate incidents across multiple locations, while maintaining chain-of-custody through secure data collection protocols. The platform utilises innovative technology to automate operations such as evidence authentication, metadata extraction, multimedia sharing, document indexing, and enables real-time collaboration on complex cases. This platform can enhance the efficiency and precision of investigations by facilitating the exchange of artefacts across various jurisdictions or agencies, while simultaneously reducing the costs associated with conventional forensic methods and mitigating the risks of corruption or information loss. Furthermore, CFPEA supports a rewards programme wherein each node in the IoV intelligently provides its artefacts in exchange for benefits. The paper proceeds by reviewing related research, identifying gaps in the literature, discussing the challenges of integrating digital forensics into the IoV, the role of the proposed framework in overcoming these challenges in IoV investigations, the implementation of a collaborative forensics-by-design approach within CFPEA, CFPEA’s features as a collaborative forensic platform, the operational flow of CFPEA's core components, digital artefact workflows in CFPEA, discussions and implications, and concludes with potential directions for future work.

2. Related Work

Over the past decade, digital forensics has attracted significant research attention, leading to various approaches for describing forensic readiness strategies for traditional computing environments, but the emergence of new architectures—such as cloud computing, Internet of Things (IoT), and the Internet of Vehicles (IoV)—requires adapting forensic readiness strategies to these novel contexts. Implementing forensic readiness strategies enables organizations to maximize their ability to collect credible digital evidence while minimizing the costs associated with incident response [3]. The ISO/IEC 27043:2015 [4] standard further defines forensic readiness strategies within the readiness process class, guiding organizations to optimize the collection of potential digital evidence by capturing and storing potentially useful forensic data in a manner that facilitates future investigations. Additionally, it's crucial to avoid interruptions in business processes during an incident. The ISO/IEC 27043:2015 [4] standard objective is to save time and reduce costs during investigations by emphasizing the importance of pre-defined, implemented, and optimized processes before an incident occurs. It involves three key processes—planning, implementation, and assessment—that organizations can use to deploy digital forensics readiness. [5] introduced a model for implementing digital forensics readiness framework for for software-defined networks. The research proposes utilising a collection mechanism driven by IDS triggers to enhance the efficiency of evidence acquisition and hence minimise storage demands. The suggested framework utilises attack detection mechanisms through Snort IDS policies. The authors assert that the deployment of the chosen IDS in the existing infrastructure posed considerable scalability issues. To unify encryption and digital forensic readiness within a comprehensive security framework, researchers in [6] suggested a novel method to cloud security assurance and preparedness. Their study clarified the synergistic relationship between encryption systems and digital forensic preparedness measures, calling for a comprehensive digital forensic strategy that integrates data protection measures with proactive incident response capabilities.[7] highlight the absence of established digital forensics frameworks that facilitate investigations in an IoT-based context. The authors suggest a general Digital Forensic Investigation Framework for IoT (DFIF-IoT) that can enhance future IoT investigative capabilities with a measure of assurance. The suggested framework adheres to ISO/IEC 27043:215 [4]. Facilitating and enhancing digital forensics investigations in IoT infrastructures, contingent upon successful integration into future digital forensics tool development. [8] devised a forensic-by-design approach that incorporates forensic techniques into the development of a cyber-physical cloud system (CPCS). This feature inside the framework allows organisations to achieve forensic readiness strategy and to recover from cyber-physical attacks, such as those involving connected IoT systems. The conceptual framework can be utilised in a CPCS or other IT systems to enhance future forensic investigations. The framework comprises six components: risk management principles and practices, forensic readiness concepts and practices, incident-handling principles and practices, legal and regulatory requirements, CPCS hardware and software specifications, and industry-specific criteria. [9] propose a framework comprising five components: the organisational level, readiness, IoT security, and reactive and concurrent processes. The readiness process groups are incorporated into the framework and pre-incident strategies as stated in ISO/IEC 27043:2015 [4] The authors assert that these processes and techniques are relevant across all layers of the IoT architecture (device, network, support, and application layer), and the framework may be employed throughout an entire organisation. [10] created a risk assessment methodology known as Forensic Readiness IoT Implementation (FRIoTI). They contend that forensic readiness strategies for IoT are crucial in addressing the issues present inside IoT ecosystems. To tackle current issues and leverage the potential of IoT devices during incidents, they propose that their model be designed for future forensic investigation. Risk assessment is crucial for anticipating the unforeseen. This methodology is founded on ISO/IEC 27043:2015 [4]. [11] established a conceptual paradigm for shadow IoT to enhance forensic readiness strategies for organisations. The Internet of Things (IoT) is a network of tangible items. However, if any of these devices join to the network without the organization's awareness, they may become shadow IoT devices. This may result in multiple security issues. Consequently, their model ought to facilitate the visualisation of shadow IoT, thereby aiding digital forensic investigations through IoT device identification, monitoring, digital evidence capturing, and preservation. The prototype adheres to the ISO/IEC 27034:2011 [12].

Various digital forensic principles and standards can be utilised for automotive forensics, including the ACPO Good Practice Guides for Digital Evidence [13], ISO 17020, ISO 17025, ISO 27037[14], and the PACE Practical Guide to the Police and Criminal Evidence Act 1984 [15]. The Best Practices for Vehicle Infotainment and Telematics Systems were developed by the Scientific Working Group on Digital Evidence (SWGDE) [16]. However, this document lacks legal enforceability and provides only the essential information required for digital artefact collection and analysis. The concept of an electronic witness is introduced in [17], which involves a method that utilises blockchain technology to verify the authenticity and spatio-temporal characteristics of digital evidence obtained via a smartphone. The digital artefacts collected from sensed data must be gathered and safeguarded by a device before being transmitted to other authorised entities in the chain. While existing models focus on proposing digital forensic frameworks primarily for cloud environments and the Internet of Things (IoT), the Internet of Vehicles (IoV) presents a new frontier. The IoV is an emerging ecosystem where data is collected and shared within vehicles, between vehicles (vehicle-to-vehicle), with infrastructure (vehicle-to-infrastructure), and with various entities (vehicle-to-everything). The heterogeneity of standalone computing devices—including different electronic modules, configurations, and interactions—that operate together in a network underscores the necessity for a collaborative forensics-by-design model tailored to this domain. This model would be particularly useful in the field of IoV forensics, where investigators need to gather and analyze evidence from multiple nearby vehicles at crime scenes or in the field. Implementing such a model is essential for proactively preparing for forensic investigations and ensuring that critical forensic data can be collected efficiently without disrupting ongoing operations. This approach complements frameworks like the Collaborative Forensic Platform for Electronic Artefacts (CFPEA), which aims to enhance forensic capabilities within the IoV ecosystem by securely collecting, storing, and sharing artefacts. By adopting a collaborative forensics-by-design model, the collection of essential forensic information is enabled. This information is useful not only for generating forensic reports for road crimes but also for building a knowledge base on cyberattacks in the broader IoV ecosystem.

The CFPEA introduced in this paper is utilized to tackle the unique challenges of integrating collaborative forensics-by-design within the IoV. The CFPEA framework is designed to securely collect, store, and share artefacts from the IoV environment, enhancing forensic capabilities in intelligent vehicles. By facilitating immediate access to relevant forensic data through continuous monitoring and analysis of network traffic from connected and autonomous vehicles, CFPEA contributes to the security and reliability of the IoV ecosystem. This includes monitoring internal communications, internet-bound traffic, and interactions between physical and virtual hosts, as well as virtual workloads. The development of such a framework is essential for effective incident investigation and for building a robust defense against road crimes and cyber threats in modern vehicular networks.

7. Digital Artefacts Workflows in CFPEA

In the Collaborative Forensic Platform for Electronic Artefacts (CFPEA), the various modules work in unison through a collaborative forensic-by-design mechanism as presented in Fig. 4.

This process orchestrates the identification and investigation of road crimes or anomalies in the Internet of Vehicles (IoV) ecosystem, ensuring that digital artefacts are gathered, preserved, and assessed securely and efficiently. Below is a detailed step of the collaborative forensic-by-design modules and how they interlink within the CFPEA framework:

Incident Assignment and Assessment: The anomaly detection subsystem within the CFPEA flags suspicious activity or confirmed road crimes. These alerts are sent, along with the corresponding risk assessment, to the Incident Assignment Module. The incident assignment module collates crucial metadata from the IoV infrastructure—such as affected vehicles, local sensor information, and the GPS data.

The Incident assignment module profiles the incident by identifying type of Incident (e.g., sensor manipulation, road traffic incident), compromised IoV components (vehicles, roadside units, or pedestrians) and propagation potential (whether the incident threatens other vehicles or parts of the network).

These findings are shared with the response plans subsystem, enabling immediate mitigation measures (e.g., containment, traffic diversion).

Simultaneously, the collaborative forensic-by-design planner (CFbDP) is informed to commence the appropriate digital forensics strategy.

Through these initial steps, CFPEA rapidly pinpoints the nature and scope of each road crime or anomaly before launching a full-scale forensic plan.

Collaborative Forensic-by-Design Planner

Retrieving and Composing Plans: The collaborative forensic-by-design planner (CFbDP) draws upon a repository of predefined forensic strategies—each tailored to specific attack types or IoV scenarios. It then composes a customised plan matched to the incident profile provided by the Incident assignment module. These strategies include types of data collection (telemetry, dashcam footage, vehicle event logs), order of collection (which nodes must be queried first) and secure storage requirements (e.g., encryption, chain-of-custody procedures).

The final forensic plan is converted into mobile code, comprising scripts or executable instructions describing exactly how to gather the needed data and from which roadside units. Once the mobile code is verified, it is handed over to the forensic intelligence coordinator at the vehicle execution container (VEC) for orchestration and execution within the IoV environment. This planning phase ensures that the forensic response is methodical, efficient, and seamlessly translatable into automated tasks that run within the CFPEA.

Execution of Forensic Plan: The Forensic Intelligence Coordinator takes the mobile code generated by the CFbDP and directs it throughout the CFPEA network to collect digital artefacts. Edge service discovery (ESD) is leveraged to find roadside units (RSUs) in the relevant geographical areas that hold or sense the required data RSUs then process the requests, reading the subqueries and determining what artefacts they can supply.

Once the correct RSUs are identified, artefacts acquisition sub-module sends out data requests, tailored to the incident type (e.g., searching for logs from a specific time window or sensor readings in a certain location). The RSUs respond with the requested digital artefacts, which can include camera feeds, network logs, or sensor data relating to a road crime. User/Driver Consent is critical at this stage, ensuring that only data from drivers who have opted in (or provided permissible consent) is collected.

Once artefacts arrive in artefacts preservation, they are time-stamped and stored within secure repositories, maintaining chain-of-custody. Preserved data is transmitted to the VEC or equivalent safe container, ensuring integrity before subsequent analysis. Secure logging mechanisms document every step, preventing tampering or unauthorised access.

In this phase, CFPEA bridges plan execution and data collection, securing artefacts in a forensically sound manner.

Evidence Reconstruction: The Artefacts assessment module can initiate evidence reconstruction—a systematic process of correlating and organising collected artefacts into a coherent timeline or chain of events. By merging data from multiple RSUs, vehicles, and time-stamped logs, investigators obtain a clear picture of how the incident or road crime unfolded. This stage is vital for building a prosecutable case or for subsequent insurance claims or litigation.

The assessment sub-module also appraises each RSU’s performance—did it provide accurate, complete data? Were there inconsistencies?.

Outcomes of the assessment may revise the relevance or confidence level assigned to each RSU in the wider CFPEA infrastructure. Reliable contributors see their standing improved; questionable or malicious nodes may face penalties or reduced trust ratings.

By combining reconstruction with RSU evaluation, CFPEA ensures the highest standard of data integrity and continuously refines its trust model for future forensic actions.

Delivering Digital Evidence to the Investigator: Once the artefacts assessment is complete, consolidated digital evidence is delivered to the law enforcemt Investigators. Investigators may use this evidence to proceed with charging suspects, settling insurance claims, or launching more targeted follow-ups if new leads emerge.

Throughout this process, CFPEA confirms that each party—drivers, investigators, and roadside units—adheres to strict collaborative forensic-by-design principles: preserving data authenticity, protecting driver privacy, enabling timely data collection, and producing legally sound digital evidence in the IoV environments.