Establishing Vehicle Occupant Actions & Involvement Through Vehicle Data

Determining who was inside a vehicle, when they entered or exited, and what role each person played are common questions investigators use vehicle data to answer. When multiple individuals are associated with a vehicle under investigation, can occupant interaction events truly answer the question, “Who was involved?” In a recent home invasion turned homicide in Baltimore, Maryland, two victims were shot and killed and witnesses identified the vehicle involved but provided conflicting reports of how many individuals entered the home. Three suspects were later apprehended. One of the suspects claimed that he only drove the vehicle and never entered the house. Investigators used the vehicle data to determine the sequence of events which confirmed the suspect’s story. Ultimately, this was the difference between a capital murder charge and an accessory to murder. In this article, we will demonstrate how vehicle door and seat events can be used to establish a sequence of events and help determine level of involvement, to answer questions such as: How many people were in the vehicle at a given time? Did occupants remain in the vehicle during a stop? Did additional occupants enter the vehicle? To demonstrate this, our team independently drove a route to an unknown location, deciding how many people would be in the vehicle and what actions each would take. They chose one of our test vehicles, a 2026 Hyundai Kona with a ccNC system for this scenario. Get The Latest DFIR News Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month. Unsubscribe any time. We respect your privacy - read our privacy policy. This particular system provides high fidelity event data, but the objective was to focus the door and seat events to try and reconstruct occupant activity. The team acquired the data after they returned to Berla’s Headquarters, and proceeded with an analysis. Establish Timeframe The process of identifying the number of occupants at any given time begins with establishing the timeframe and identifying relevant vehicle events within that timeframe. What we know is that the vehicle left Berla HQ at approximately 08:40 and returned at 09:15.  What we don’t know is how many individuals were inside the vehicle during this period, or whether that number changed at any point along the route. To begin, we isolate all recorded door and seat events and plot them using their associated geolocations and timestamp data. We see two concentrated areas of activity – the first is our known start/end location, Berla HQ, and another approximately six miles south. Based on this, we can establish that the vehicle made a stop at approximately 08:54 before returning to Berla HQ. From this data, we can break the overall journey into three distinct segments of activity. 08:38:37 a.m. – 08:39:16 a.m.  Departing Berla HQ 08:54:21 a.m. – 08:59:03 a.m. Stop Location “Tavern” 09:15:00 a.m. – 09:15:47 a.m. Returning to Berla HQ Analyzing Occupant Activity Now that the activity segments have been identified, we can focus on establishing how many occupants were present during each trip and if there were any occupant changes at stop locations. To do this, we will begin by analyzing door events, seat occupancy statuses, and seat belt events. These event types help identify opportunities where changes in occupant numbers may have occurred. Next, we will look at the timing between events and end destination events to determine if the previous activity resulted in an occupant change. Trip Analysis Starting at Berla HQ, at 08:38:37, the data shows a Driver Door Open event followed by a Driver Door Closed event. We then see a Passenger Door Closed event. Although no Passenger Door Open event was recorded, we know this can occur if the vehicle network is not fully awake or if simultaneous events prioritize logging of the driver’s door. We can corroborate this against other events to verify if this is what actually occurred. Taking a look at Seat events, we see a Front Passenger Seat is Occupied event at 08:38:46.  This is followed by a Driver Seat Belt Buckled event, and a Front Passenger Seat Belt Buckled event at 08:39:16. No additional door events occur during this time. This strongly suggests a driver and one or more passengers entered the vehicle through the front two doors. At 08:39:12, all four doors show lock events simultaneously. This is consistent with an automatic locking safety feature, which engages all locks once the vehicle reaches a predefined speed threshold – indicating forward vehicle movement leaving Berla HQ. We’ll look for the next set of activities to determine their next stop location. The next series of events occurred at the Dark Horse Tavern, approximately six miles south of Berla HQ. At this location, there are two distinct sets of activity. The first occurring in the southeast area of the parking lot and the second in the southwest. At 08:54:21, we see a Front Passenger Seat Belt Unbuckled event. Three seconds later, a Passenger Door Open event occurs, followed by a Passenger Door Closed event. No other doors or seat belt events were triggered in this activity set. This sequence is consistent with a passenger exiting a vehicle and the driver remaining. In this case, the sequence is confirmed by the vehicle being driven to the southwest parking area of the tavern. The next set of activities is seen in the southwest parking lot of Dark Horse Tavern, approximately 90 feet from the previous stop location. At 08:58:38 a Right Rear Door Open event occurs, and at 08:58:41 there are two simultaneous events – Passenger Door Open and Right Rear Door Closed. At 08:58:47, we see an event for Front Passenger Seat is Occupied. As with the previous stop, the driver’s door did not open, indicating the driver remained inside the vehicle. The near-simultaneous front passenger and right rear door activity strongly suggests two or more individuals interacted with the vehicle within seconds of each other. Given the timing, it would be unlikely for a single individual to open and close both doors in that sequence. This vehicle system does not record rear seat belt or occupancy events, so rear occupancy analysis needs further corroboration to determine if two or more individuals got into the vehicle. As a result, we will look at the activity at the next stop location. The final set of activity occurs upon the vehicle’s return to Berla HQ at approximately 09:15. Door activity recorded as the occupants exit provides an opportunity to assess whether a third passenger had entered the vehicle at the previous location and occupied the right rear seat. Reviewing the door events, we observe three doors opening within a short time frame: the Passenger Door, Right Rear Door, and Driver Door. At 09:15:14, both the Passenger Door and Right Rear Door open simultaneously. The Driver Door opens seven seconds later, at 09:15:21. Here, timing is critical. The front passenger and right rear doors opening at the exact same timestamp strongly indicates two separate individuals exiting the vehicle. From a practical standpoint, it would be highly unlikely, if not physically impossible, for a single person to open both doors simultaneously. While we do not have rear seat occupancy or seatbelt status events to definitively confirm, the synchronized door activity strongly suggests a third occupant. This observation further corroborates with the earlier Right Rear Door Open event at the Dark Horse Tavern, reinforcing that the rear seat was in fact occupied. Using the combined data, we can reasonably conclude the following: 08:38 – Driver + at least 1 passenger depart Berla HQ 08:54 – Front passenger exits vehicle at Dark Horse Tavern (southeast) 08:58 – At least two passengers enter vehicle at Dark Horse Tavern (southwest) 09:15 – Driver + at least 2 passengers exit vehicle at Berla HQ When we reviewed the findings with the team, they confirmed that a driver and one passenger departed Berla HQ. The passenger exited the vehicle at the front of Dark Horse Tavern in the southeast parking lot and the driver moved the vehicle to the southwest parking lot. The passenger returned to the vehicle with an additional person and they both got into the car. All three people drove back to Berla HQ and then exited the vehicle. The driver remained in the vehicle the entire time it was at the Tavern. Conclusion Overall, vehicle events can provide meaningful insight into what occurred. In our example, we intentionally used terms like “more than one person” or “more than two passengers.” Without other evidence like rear seat occupancy, rear seat belt events or CCTV, it is hard to know exactly how many additional people could have entered or exited the vehicle. However, within the established timeframe, there are definitive events that help prove what did or did not happen. Just like in the home invasion turned homicide, mentioned in the beginning, what was clear was that the driver remained in the vehicle the entire time. Through systematic analysis of event data with logical activity patterns, you can gain key insights to move your investigations forward.