Field Telemetry: Interpreting Live Vehicle Data

Theory meets reality in this session on field telemetry. We transition from static diagrams to the dynamic, high-speed environment of a live vehicle bus. You will learn how to interpret the constant stream of hex values flowing through the OBD-II port. We focus on the "Human-Machine Interface" (HMI) data—how a physical action, like pressing a button on the steering wheel, translates into a specific CAN ID and data payload.

We will discuss the "reverse engineering" mindset required for automotive forensics. This involves observing "State Changes" on the bus. By monitoring the bus in real-time, we can correlate specific hex changes with vehicle events. This is the foundation of digital forensics: creating a timeline of events based on the recorded telemetry. We will also touch upon the differences between powertrain CAN and body CAN, teaching you where to look for the most relevant forensic artifacts depending on the goals of your investigation.