How to Write Forensic Report on Changing the Battery of a Remote? Case Study

forensic report

Case Summary

 

Overview

 

In February, 2015, Mr. Sam Johnson had bought a new car that came in with a remote control for different functions like controlling stereo, alarm and turning lights on/off etc. He was a salesman who spent most of his time on the road. So he had to used the remote a lot. By the start of 2016 he felt that the range of remote was reduced and at times it stopped working too. He had been using it for different purposes like locking/unlocking the car but he was facing difficulties in doing that.

 

Investigation Request

 

So fearing that he won’t be able to properly lock his car or perform different functions on-the-go and the fact he had to spend money on a new compatible remote, he sought help at the internet. With a few hours of research, he came to the conclusion that remote itself wasn’t damaged but the battery had worn out. He started off with the basics like firstly he looked for his remote model which was named ‘Harmon 606’, and found out its details on Maker’s website “myHarmon.com”. Remotes of similar makes and newer models were also available, he browsed through but couldn’t find his exact model. He sought out online help section from their web. He posted his problem on web in their online help section and he got reply to his problem after a few minutes.

 

 

Summary of Findings

 

The reply from the web help staff contained a detailed procedure of how to change his remote’s batteries, and it also warned him about recent threats like any kind of “blocking” of a remote control should be regarded as suspicious as well as car thieves might use it to gain mechanical access and unlock your car. However, in his case causes for such behavior were due to an empty battery, environmental RF noise or short range.

Evidence

 

His claim was supported by Harman Inc. The below table outlines the details confirming his model/make and which battery to use. His Remote and Battery Details are as:

 

Remote Model Serial No. Battery Model Description
HN-606B 4764126678C3 CR2032/DL2032 Car-GPS/FTK Remote Black/Metallic

 

Table 1: Remote Details

Forensic Analysis

 

By analyzing the details and obtaining the right battery for the remote with help of details provided by the helpdesk from website, Sam was ready to replace battery from his remote.

To replace battery, he had to follow these steps:

 

  1. Flip the remote and look for the rounded shape opening at the back i.e. battery cover.
  2. Take a coin and place it on the battery cover

a. Using the coin, rotate the battery cover counterclockwise slightly

 

forensic report

Figure 1: Remote Control

  1. Get rid of the used battery and replace it with the new battery (either DL2032 or CR2032), the plus symbol (+) should be facing up

forensic report

Figure 2: Battery Placement

  1. After new battery is correctly placed, put the cover back onto it and using the coin again turn it clockwise till it is locked

forensic report

Figure 3: Final Step

 

Conclusion

 

Normally the cell depletion, battery faults and low range or RF noise can cause a car remote control to stop working which leaves us open to certain threats. The same happened with Sam but his investigative approach to get to root of the problem helped him in avoiding a possible loss or loss of money which he would’ve spent on a new remote which was not needed to begin with. He assessed his options and found out via internet that people had been facing same problem and most of the time a new battery did the trick. With a few hours of research, he came to the conclusion that remote itself wasn’t damaged but the battery had worn out. He started off with the basics like firstly he looked for his remote model which was named ‘Harmon 606’, and found out its details on Maker’s website “myHarmon.com”. Remotes of similar makes and newer models were also available, he browsed through but couldn’t find his exact model. He sought out online help section from their web. He posted his problem on web in their online help section and he got reply to his problem after a few minutes. The reply from the web help staff contained a detailed procedure of how to change his remote’s batteries, and it also warned him about recent threats like any kind of “blocking” of a remote control should be regarded as suspicious as well as car thieves might use it to gain mechanical access and unlock your car. However, in his case causes for such behavior were due to an empty battery, environmental RF noise or short range. Following all steps told by Harmon Inc. staff, he successfully replaced the battery and got his remote to working like new again.

 

 

References

Coalfire Systems Inc. Team. (2015). Digital Forensics Analysis Report. Alliance Defending Freedom. Retrieved from http://www.adfmedia.org/files/CoalfireCMPvideosReport.pdf

Kasper T., Oswald D., Paar C. (2011). Wireless security threats: Eavesdropping and detecting of active RFIDs and remote controls in the Wild. 19th International Conference on Software, Telecommunications and Computer Networks. SoftCOM’11.

Moradi A., Kasper T. (2009). A new remote keyless entry system resistant to power analysis attacks. ICICS 2009, pp. 1-6.

 

 

 

Appendices

 

Appendix A: Examiner Workstation Specifications

 

  • Remote Name: Harmon 600-Series
  • Model Name: HN-606B
  • Remote’s Serial Number: 4764126678C3
  • Correct Battery: CR2032/DL2032
  • Description: Car-GPS/FTK Remote Black/Metallic
  • All details of remote are consistent with the details provided, verified by http://myHarmon.com/.

Appendix B: Tools

 

  • Simple Coin (Any Coin)

 

 

 

Appendix C: Forensic Acquisition and Verification

 

The remote in the picture is consistent with original piece and details provided exactly match the make/model and battery type

forensic report

 

Appendix D: Glossary

Coin: Any Coin or Object that Can fit into Shape Behind Remote Cover to Rotate It

LEAVE A REPLY

Please enter your comment!
Please enter your name here