Forensic cases: custody of forensic reads

Where: Diagnostics › More tests › Forensic cases

Important: Read and custody only: nothing here writes to the vehicle, erases crash data or extracts keys from the modules. The report attests who read what, when and with which tool; it does not attest the cause of the accident.

1. Press “Open a case”. Choose the legal basis (court order, owner's consent, an insurer's mandate, documented legitimate interest or a safety investigation), write down its reference and confirm that it exists. Without a legal basis no case is opened.
2. Enter the chassis number if you have it. By default only an irreversible fingerprint is kept: the number cannot be recovered. Only with a court order, the owner's consent or a safety investigation can you choose to keep it encrypted as well.
3. Attach the legal basis document (PDF, PNG or JPEG up to 3 MB). It is optional, but the report warns if it is missing.
4. Add the reads: choose a finished read of your organization, what was read and where you were. Each one is joined to the previous one with a fingerprint and can no longer be changed or removed.
5. Press “Check the whole chain” whenever you like: it recalculates the fingerprints and checks the stored data again.
6. Close the case (the PIN, Face ID or one-time code is needed) and issue the signed report. You can view it on screen, print it or download it as signed JSON or as a printable page.

• Crash data (EDR): it can be read next to the vehicle and, if the settings allow it, also remotely through the tunnel. It is noted on every read and the report flags it. The Emergency center can pause remote reading at once.
• The tool always reads through the diagnostic connector, never through the vehicle's wireless interfaces.
• Only the expert who opened the case changes it. Other people with diagnosis read permission see it, and every view, check and download is kept in the custody log.
• A read of the platform that coincides with a tunnel session is recorded as remote, even if you say you were next to the vehicle.
• A case is not erased: it is voided with a reason and kept until the chosen date. The stored chassis number can be erased whenever needed.

While the case file is open for a tool, that unit is in forensic mode and only reads. An order that writes, runs a routine or erases is refused until you close the case file or register an intervention with its reason; the intervention goes into the chain of custody and the report. More in “Forensic mode and diagnosis mode”.

Important: If any data changed after the case was closed, the chain check points it out. Only the platform can check the chassis number fingerprint; whoever receives the report cannot recalculate it.

Open the platform See it in the help centre