Authors: Joshua Hickman
DFRWS USA 2019
This presentation will cover Google’s Android Auto, an application that allows for hands-free use of Android-based mobile phones within an automobile, and Google Assistant, Google’s virtual personal assistant. Worldwide, forty-one (41) different automobile manufacturers natively support Android Auto with ten (10) more manufacturers expected to offer support in the coming year. Additionally, six (6) after-market stereo manufacturers support Android Auto, with another fourteen (14) expected to support it. With this proliferation, it is important to understand how Android Auto behaves so digital forensic examiners can locate and successfully interpret the artifacts it leaves behind. In addition to learning about Android Auto, attendees will also learn about how Android Auto interacts with Google Assistant. Google Assistant is the mechanism behind Android Auto that allows for hands-free operation. Understanding the artifacts left behind by Google Assistant can provide digital forensic examiners with a holistic view of how Android Auto was used within an automobile. Covered artifacts from Android Auto include location data (location last used), last run time, and information about the vehicle(s) to which the mobile phone has been connected. Covered artifacts from Google Assistant include vocal input from users, time stamps, embedded audio data, and the structure of binary protocol buffer files that are generated as a result of Google Assistant invocation via Android Auto.