Vehicle telematics and dashcam evidence: what the data can and cannot prove

A modern car is a distributed logging system. Engine control units, airbag modules, infotainment units, insurance telematics boxes, dashcams and the smartphone in the driver's pocket each record a partial picture of where a vehicle was, how fast it was moving, and in some cases what happened in the seconds around an impact. In road traffic disputes, insurance fraud claims, and criminal proceedings from careless driving to causing death by dangerous driving, that picture is increasingly the evidence a case turns on.

But vehicle data is frequently over-claimed by the party producing it and under-challenged by the party opposing it. A timestamp on a dashcam file, a GPS speed reading, a "black box" report from an insurer: each has specific, bounded evidential value, and each fails in specific, knowable ways. This article sets out what the main sources record, how a forensic examiner verifies their integrity, and the honest limits of what each can prove.

What each source actually records

Event data recorders and airbag modules. Most vehicles sold in the UK since the mid-2000s record a snapshot of vehicle dynamics in the seconds before an airbag deployment or similar threshold event. Typical captured parameters include vehicle speed, engine throttle position, brake switch status (on or off, not pedal force), seatbelt status, and delta-v, the change in velocity during the impact itself. The recording window is short, commonly five seconds of pre-crash data at fractions-of-a-second resolution. This is physical evidence from a hardened module, and it carries substantial weight when extracted correctly.

Insurance telematics. "Black box" policies log GPS position, speed, time of day, acceleration and braking events, usually at intervals of seconds or per-trip summaries rather than continuously. The data belongs to the insurer, is held on their servers, and is produced as a report rather than as raw logs. It is good for journey-level questions: where the car was, when, and roughly how it was driven. It is usually too coarse for second-by-second collision reconstruction.

Dashcams. Two distinct evidence streams live in one device. The video itself, and the metadata: embedded timestamps, GPS coordinates and speed overlays logged per frame or in a sidecar file. Many dashcams also store a "parking mode" buffer that captures events while the vehicle is off, and lock files protectively around detected impacts.

Smartphones and navigation units. Route history from navigation apps, location services and health-data step counts have all featured in vehicle-related proceedings. They are corroborative rather than primary: useful for placing a person or a route, weak on vehicle dynamics.

How integrity is verified

Vehicle and camera data share the fundamental problem of all digital evidence: it is easy to alter and hard to prove alteration. The verification workflow therefore matters as much as the extraction.

• Examination of originals. Video is examined from the camera's own storage or a forensically imaged copy, not from a file forwarded through WhatsApp, which strips metadata and in some cases re-encodes the video. The examination follows the same write-blocking and hash-verification principles applied to any other digital medium: the examiner works on a verified bit-copy, and the working copy's hash is recorded so any subsequent change is detectable.
• Container and codec analysis. Dashcam files are typically MP4 or MOV containers with H.264 or H.265 video. The examiner checks the container structure, frame counts, timestamp fields and encoding consistency. Re-encoded or edited files frequently show tell-tale signs: encoder metadata naming editing software, inconsistent GOP structure, or a creation date later than the footage purports to be.
• Clock verification. The device clock is compared against a reference. A dashcam whose internal clock drifts minutes per month, or that reset after a power loss, produces footage whose displayed time cannot be trusted without correction, and the correction must be evidenced, not asserted.
• Cross-referencing. The strongest vehicle evidence is corroborated: dashcam GPS trace matching telematics journey data, matching the EDR speed profile, matching ANPR camera captures or mobile cell site data along the route. Where two independent systems agree, the finding is robust. Where they conflict, the conflict itself is a finding that must be explained.

Documentation follows the same discipline described in our guide to chain of custody for digital evidence: who handled the device, when it was extracted, what tools were used, and hash values tying every working copy to the original. A brilliant extraction with a broken custody record is, for courtroom purposes, a broken extraction.

What the data can prove

Verified telematics and dashcam evidence can establish, with appropriate confidence: vehicle speed and braking status in the seconds before a collision (EDR); the route and timing of a journey (GPS, telematics, dashcam GPS); what was visible and audible from the camera's position at a stated time (video); and, in fraud claims, the geometry of an alleged incident that the physical damage does not support. Courts have accepted dashcam footage in private prosecutions and police have relied on public submissions for charging decisions, which makes the integrity question more, not less, important, because the provenance of publicly submitted footage is often the weakest link.

What it cannot prove

Identity of the driver. A camera pointing forward records the road, not the person behind the wheel. Telematics records the vehicle, not the human. Establishing who was driving requires other evidence, and this distinction decides real cases.

Absolute speed from GPS alone. Consumer GPS speed readings carry error of a few kilometres per hour under good conditions, more in urban canyons, tunnels and under heavy tree cover. GPS speed can corroborate an EDR reading; it should not be the sole basis for a precise speed finding.

What happened off-camera. A single forward-facing camera has no view of the rear, the sides below window height, or the cabin. The absence of a motorcyclist in frame may mean the motorcyclist was never there, or simply that they were in a blind spot at the relevant moment. Examiners report on what the footage shows, not on what the absence of footage implies.

That footage is complete. Overwriting is normal behaviour: dashcams loop-record and telematics boxes cap their event history. A gap is not automatically concealment, but distinguishing routine overwrite from selective deletion is part of the examination, and requires the device's logging configuration to be understood and documented.

Practical instructions to solicitors

Secure the vehicle and devices early. EDR data survives impact but does not survive scrapping; telematics data is retained by insurers for finite periods; dashcam loop buffers are overwritten within hours of the vehicle returning to service. Instruct the client to preserve the original SD card, obtain the insurer's raw telematics disclosure rather than accepting the summary report, and have any extraction performed before repair or disposal. The same early-preservation discipline that governs device imaging in email header and metadata analysis applies with a shorter clock.

And when opposing vehicle evidence, challenge on the specific, knowable failure modes: extraction without imaging, timebases left uncorrected, GPS speed over-claimed, completeness assumed rather than demonstrated. The data is often good. The claims built on top of it are where cases are won.