An Investigation into Retrievable PII Data from a Mercedes Benz NTG6 IVI Module

Richard Harding
Digital Forensics Student, University of South Wales

This presentation explores the technique employed to perform a forensic acquisition of a publicly obtained Mercedes-Benz NTG6 infotainment module, the methods used to analyse data, revealing Personally Identifiable Information (PII) such as connected devices, phonebook records, call logs, and navigation data, stored without encryption or authentication, resulting in the extraction of vehicle user information using custom Python programming, highlighting privacy concerns in connected vehicles, where PII information such as location history, driving behavior, contact lists and more could be misused. This project identifies the types and extent of PII retrievable from modern vehicles, analyses manufacturer practices, and assesses adherence to regulations. Finally, it recommends measures to enhance privacy safeguards in connected vehicles.