As far as I know most vehicle infotainment systems are run on a customized Linux system built with Yocto. Forensic toolkits such as Berla iVe allows to extract information such as GPS data, call log, door events, gear changes, etc. (see https://digital-forensics.sans.org/blog/2017/05/01/digital-forensics-automotive-infotainment-and-telematics-systems-2/)
I did some research but I am still wondering how exactly this data extraction is carried out. Some older car models seem to have open telnet/ssh ports which allowed access to the file system (e.g. VW models from 2014). Newer models seem to have these simple attack vectos eradicated.
- How exactly is the Berla iVe toolkit working? Does it rely on flaws like an open root shell?
- Where would the personal data be stored inside an infotainment system and in which format?
- Are there any images of infotainment storage online available? Was any of you able to create an image of the infotainment system in your car?
I know these are very specific questions but maybe someone out there can help me out here.