In some instances, a particular vehicle will have not one but two iVe-supported ECUs. Examples of such a situation could include many Ford and GM vehicles, as well as the newly supported Mercedes COMAND systems that entail acquisition of two separate hardware components.
What if an investigator wanted to analyze data from a vehicle’s separate, supported ECUs in one case? Well, beginning with version 1.12.4, users have just such an option, and this blog entry will focus on how the process works.
For purposes of this example, we have already acquired a GM HMI module. When viewing the case in the main workspace window, note that an ‘Add’ button is displayed in the upper left for the other ECU that MAY potentially be included in the vehicle – in this case, an OnStar module.
Note: The presence of the ‘Add’ button does not necessarily mean with absolute certainty that the other ECU is included in the vehicle. Keep in mind that in some instances the original vehicle owner may have had multiple system options to choose from at build time.
To add the other ECU to the case, select the ‘Add’ button, and the acquisition wizard opens to the ‘Configure’ screen. On the ‘Configure’ screen, simply select the acquisition type (i.e., physical, logical, or import), and proceed as with any other acquisition.
After the second ECU has been added to the case, a second green checkmark is displayed where the ‘Add’ button was previously seen, and the two ECUs are displayed under separate nodes in the ‘Systems’ section tree.
Whenever a second ECU is added to a case, a ‘Partial Acquisitions’ subfolder is created in the case folder (as shown above). Within the ‘Partial Acquisitions’ subfolder, iVe creates backup files of the separate ECU acquisitions.
Wondering if it is possible to tell where a particular item came from after data from two ECUs has been blended together? Not to worry. To make this determination go to the ‘Content’ section grid, right-click the item in question, select ‘Show Source File(s),’ and click on the path that appears.
When the user clicks the path, the workspace switches to the ‘Systems’ section, and the source file’s folder is highlighted in the tree, indicating which of the two ECUs is the source for the parsed content.
It is hoped that iVe’s new functionality for merging data from two supported ECUs into one case can prove highly useful in relevant instances. Not only does this merging option save time from having to run separate searches on two ECUs, but it also allows for combining items in iVe’s timeline, tags, and reports.
If you have not already done so, upgrade your copy of iVe today by visiting our support page.