BlackBag’s Partnership with Berla Expands Your Analysis Environment

In today’s investigations, it is now commonplace to have multiple digital devices associated to one case. As such, consolidating acquired devices is critical when reconstructing a sequence of events for a case. Whenever a mobile device is connected to a vehicle system via USB, Bluetooth, or Wi-Fi, some data from that device is stored in the vehicle. Potentially, device contacts, call logs, and SMS messages are stored and can thus be acquired in iVe, though the exact data types recorded will vary from one vehicle to another. As infotainment and telematics systems become increasingly prevalent, eventually just about every crime that necessitates digital analysis revolves around data stored on not only mobile devices but on vehicles as well.

The first step is to export information from iVe to the BlackBag format.

The .ivx database created from the export can then be imported into BlackLight.

All of the data exported from iVe is stored in the .ivx database and can viewed from the ‘Browser’ view in BlackLight.

All of the tables stored in the database can be seen on the left side.

These tables show the possible types of data, but the exact data types recorded will vary from one vehicle to another.

To assist with analysis and correlation of data between multiple devices, information is also parsed into other areas of BlackLight.

The Actionable Intel tab shows several items of interest to an investigation.  Device Connections reveals the devices that were connected to the vehicle system.

In Account Usage, Top Contacts are revealed.

The synergy is viewing the information along side the paired mobile devices supported by BlackLight.

Information parsed in Location Data can provide critical location data as well as a timeline of events.  In the sample below, you can see events such as when the driver door was opened and closed, gear shift events, and trackpoints all showing the location of the vehicle.

Information parsed in the Communication tab includes the Calls, SMS, and Contacts.

The beauty in BlackBag’s partnership with Berla is you are able to analyze the data from the extracted from the vehicle with iVe in BlackLight right beside the other digital devices in the case.  One analysis environment with all devices in the case.


BlackLight 2019 R2 is packed full of powerful features you’ve requested and need to complete your investigations more quickly. Join BlackBag’s Vice President of Engineering, Drew Fahey, and Director of Product, Ashley Hernandez, as they walk you through the partnerships to connect BlackLight with other tools in your toolkit, the expanded searching capabilities and long requested enhancements.

Digital Forensic Community