Vehicle sources, methods and limits

Start with the vehicle and the disputed question

A vehicle is a network of possible evidence sources. A crash event, a software change, a disputed journey and an account interaction may require different records. One download should not be treated as the complete vehicle history.

GDF begins with the question, the vehicle and the sources already available. The agreed scope identifies which records may answer the question, which acquisition methods are supported and which specialist roles are needed before work begins.

Different records answer different questions

EDR and crash-event records

An event data recorder may retain a brief event window when the vehicle has an EDR and the relevant recording conditions occurred. Available values can include speed, brake or throttle status and restraint or deployment information. The exact fields and their meaning depend on the vehicle and module. This is event evidence, not a continuous trip history. NHTSA's May 2026 rule phases in expanded pre-crash recording from September 2028. It does not enlarge records already stored in an older vehicle. We check the available fields for the specific model and module.

NHTSA 2026 event data recorder rule.

ECU and diagnostic records

Electronic control units may retain trouble codes, freeze-frame values, counters, configuration or event history. Supported records can be compared with known configurations, repair information and other evidence. A changed setting or diagnostic code does not, by itself, establish unauthorized activity or its cause.

Infotainment, navigation and telematics

Depending on the system and retention, these sources may contain pairing identifiers, destinations, recent locations, communications or service events. Related records may remain on a paired phone or authorized account. A paired phone does not prove who drove; a destination does not prove arrival; a coordinate needs its source and meaning explained.

Vehicle-network evidence

Controller Area Network communications can be examined when an appropriate capture or retained log is available. A new live capture shows its own observation window. It does not reconstruct earlier journeys simply because the messages travel over CAN. Existing module records and a live capture are separate evidence sources.

Confirm support before relying on a download

Support is checked against the exact make, model year, build date, market, module identifiers, software and condition. The plan also records damage, power state, custody and known prior scans, downloads or repairs. Manufacturer documentation, current tool coverage and method limitations are reviewed before acquisition.

EDR retrieval and access to other ECU data are different tasks. A diagnostic scanner is not automatically a crash-data retrieval tool. An OEM procedure may require different equipment and qualified handling. Electrical, bench or laboratory work is separately scoped with the appropriate specialist; unsupported or destructive access is not assumed.

Work included in an agreed examination

  • Map the vehicle modules, related devices and authorized account records relevant to the question.
  • Record source condition, handling, prior activity and any proposed step that could change evidence.
  • Use the specifically confirmed, authorized acquisition method and retain its original output where available.
  • Interpret supported fields using the applicable system and method documentation, recording gaps and uncertain values.
  • Compare available vehicle records with supplied inspection records, photographs, video, phone or account evidence. Explain clock offsets and competing interpretations.

Not every matter includes every source or method. Feasibility, qualifications, authority and reporting needs determine the written scope.

Receive documented findings and supporting records

  • Source inventory and coverage record: vehicle and module identifiers, sources examined and sources unavailable.
  • Acquisition and handling log: method, software version, relevant interface, steps, source changes and integrity checks.
  • Original retrieval files or acquired copies where the method provides them, with decoded records and documented interpretation.
  • Source-linked findings, a correlated timeline or maps where the records support them, and the basis for each material conclusion.
  • A technical report identifying observations, inferences, missing data, alternative explanations and any separately agreed expert support.

A supported download may produce a proprietary retrieval file and decoded report rather than a complete binary memory image. The deliverables describe what the actual method obtained.

Understand missing data and interpretation limits

Model support does not guarantee that a usable event was recorded or remains available. Damage, encryption, storage state, subscriptions, account access and prior activity can limit the result. Some sources require a separate feasibility decision or cannot be obtained.

Vehicle clocks and event triggers may not align with another source. We distinguish a recorded value from an opinion about the driver, route or cause. EDR data does not replace a crash reconstruction; physical reconstruction and other specialist opinions require their own qualified scope.

What helps us scope your matter

Start with the event or disputed question, deadline, make, model, year, general vehicle condition and the sources you already hold. Identify who controls the vehicle, modules and accounts and who can authorize access. Detailed identifiers and evidence can be exchanged through an agreed secure channel.

Tell us about repairs, scans or downloads already performed. Discuss preservation before experimenting with a module, account, firmware or power state, while leaving vehicle safety decisions with qualified personnel. Do not send credentials or sensitive evidence through the general inquiry form.

Primary vehicle references

Support is checked for the vehicle, module and method. Official documentation describes possible retrieval paths; it does not establish our equipment ownership or qualifications for every vehicle.