World-First SEM-based Recovery of Crash EDR Data from the EEPROM of a Severely Damaged SRS Module Using CrashScan

This paper introduces a fully working and affordable approach to data recovery from automotive SRS (airbag control) modules after permanent failure of their data storage memory chip. All essential information was successfully extracted with 100% success rate from a real SRS module after a severe accident which resulted in both its Processor and Flash EEPROM chip being electrically damaged with visible holes in their packages. Further investigation revealed that the damage was likely caused by overvoltage and subsequent high-current-flow through the silicon die of the chips. This not only caused some internal metal wires to melt and evaporate but also caused partial evaporation of the silicon substrate, with the created cavity filled with melted gold from a bonding wire. This reveals the nature of the failure with local temperatures exceeding 3000°C. Despite the fact that the on-chip EEPROM array was only a few hundred micrometers away from the damaged area, it did not lose any single bit of information. This proved the approach to be resilient for successful data recovery from severely damaged devices in the future.

The module in question was a Bosch SRS ACM from a 2021 Mercedes-Benz Sprinter. The vehicle’s ACM was non-functional, and standard diagnostic extraction using CrashScan had confirmed that no communication could be established. Rather than concluding that the EDR data was irrecoverable, the authors initiated a hardware-level forensic investigation. Two components on the PCB had noticeable damage: an SPI EEPROM in SOIC8 marked 95128RT K114K (identified as M95128 from STMicroelectronics with SPI bus and 16 KB of EEPROM memory) and a Processor in TQFP80 marked 10643 2122KXR02 (identified as a Renesas R7F701025 microcontroller from the RH850/F1L family). The memory chip had damaged pins including pin 2 (Q) with low resistance to pin 4 (Vss), pin 6 (C) with no connection, pin 7 (H) with low resistance to pin 4 (Vss), and pin 8 (Vcc) with low resistance to pin 4 (Vss). The processor had damaged pins including pin 10 (EVCC) with lower than usual resistance to pin 16 (EVSS), pin 11 (P0 4) with no connection, pin 13 (P0 6) short circuited to pin 14 (P0 11), pin 15 (P0 12) with low resistance to pin 16 (EVSS), pin 72 (P11 1) with no connection, and pin 76 (EVCC) with no connection.

The likely cause of damage was an electromagnetic pulse inducing high voltage on a floating pin 17 of the processor, causing a latch-up resulting in short circuiting power supply to ground. This overloaded the power supply IC resulting in a very high current flow. When this current overheated the wires and caused significant damage to the area between pins 10 and 16, the supply was interrupted by a burned wire, causing an overrun in the power supply IC resulting in a high voltage spike up to the input of above +12 V. This second wave caused the actual damage to the SPI EEPROM because its maximum supply voltage is 6.5 V.

To avoid damaging the original SPI EEPROM with data, blank samples were tested first to choose the best sample preparation methodology. Different types of M95128 chips were ordered from an electronics distributor, which helped determine the full name of the original device as M95128-DRMN3. Two blank samples were programmed with different test data to reveal the physical address allocation and error correction encoding. Both samples went through full sample preparation procedure, were fully imaged and digitised. By analysing the correlation between the cell charge images and the programmed data, a map of the EEPROM memory array was built, annotating allocations for individual data bits in each block, addresses along memory rows, and addresses along memory columns. The EEPROM array in M95128 has error correction feature (ECC) with 6 error correction bits for every 32 bits of data. The required 6 polynomials were reconstructed by processing 32 discrete mathematical equations.

After carrying out successful sample preparation of a blank M95128-DRMN3 device, the memory chip from the SRS module was prepared in the same way. The polishing process went from exposing the copper heatsink carrier down to 10 µm of remaining bulk silicon substrate. When the thickness of silicon substrate was reduced to 50 µm, it became possible to observe the internal structure using NIR camera. At the substrate thickness of 5 µm, it was possible to see the damaged area near pin 2, which caused not only the metal layers to burn but also melted and evaporated part of the silicon substrate. The cavity was filled by melted gold from the nearby bonding wire. The major concern during the removal of the remaining silicon substrate was about the mechanical strength of the active chip areas, but the severe damage near pin 2 did not affect other chip structures. After chemical removal of the remaining silicon, all damages to the pins 2, 6, 7 and 8 areas were clearly visible, but no damage could be seen around the EEPROM memory array.

After successful testing of the blank samples, all data was extracted from the damaged SPI EEPROM device. The whole image of the memory array was first digitised into a bitmap, then verified against error correction bits with no single error found. After that, the data bits were combined according to the physical map of addresses to produce the resulting HEX file. SEM imaging reflected the raw memory contents of the EEPROM as stored by the original module’s firmware. The M95128 EEPROM uses a proprietary binary encoding scheme defined by the Bosch SRS firmware, encompassing not only the EDR data records but also module configuration data, calibration parameters, security access credentials, and system state information.

Two approaches were successfully used to recover the actual crash data. The first involved using a donation SRS module with same part number from the same car model. Its SPI EEPROM chip was removed and reprogrammed with the extracted HEX file, then soldered back. In this case a standard SRS data analysis software was able to read all the data correctly. Another approach involved reverse engineering of the data structure inside the SPI EEPROM, which allowed better understanding of the information stored inside the memory chip and allowed its exact interpretation. The successful data transfer required expert-level understanding of the Bosch SRS EEPROM memory map — identifying and preserving the forensically relevant crash event records and EDR data structures while appropriately handling module-specific configuration parameters that are not subject to forensic transfer.

Following the data transfer, the donor ACM unit was verified for basic electrical functionality and prepared for bench-top diagnostic extraction. EDR data extraction from the donor ACM was performed using the bench-top methodology with the CrashScan EDR Lab Kit. Communication was established successfully on the first attempt. The CrashScan application identified the module, confirmed the part number and software version, and completed the full EDR data download without errors. The resulting report documents two recorded crash events stored in the ACM at the time of the data extraction.

The CrashScan EDR report documents data from the ACM. The module download was performed at ignition cycle 50,449. Two crash events are recorded: the 1st Prior Event (historical) at ignition cycle 21,877 with odometer 451,211 km, peak longitudinal delta-V of −2 km/h, and airbag warning light OFF; and the Most Recent Event (accident) at ignition cycle 26,577 with odometer 562,311 km, peak longitudinal delta-V of −20 km/h, and airbag warning light ON. The crash pulse for the forensically relevant Most Recent Event is characterised by a progressive longitudinal deceleration developing smoothly from 0 km/h at trigger time, reaching a plateau at approximately −20 km/h between 170 ms and 250 ms. The shape of this pulse is consistent with progressive structural engagement in a frontal or predominantly frontal collision. The lateral delta-V remains modest throughout, with a maximum of 3 km/h recorded at 100–120 ms, confirming a predominantly longitudinal (frontal) impact character with only a minor lateral component.

The occupant restraint status recorded at −1.0 second prior to trigger shows the Passenger Seat Belt Status as Buckled, while the Driver Seat Belt Status is recorded as Unavailable. No airbag deployments were recorded for either driver or passenger positions across all airbag stages. The Airbag Warning Light status recorded at −1.0 second was ON, indicating that the SRS system had a pre-existing fault condition registered prior to the collision event. The investigation established that the seat belt pretensioners from a previous collision had not been replaced during subsequent repairs, and the available evidence indicates that this fault condition was the reason why the driver’s airbag was not deployed during the investigated collision.

The pre-crash data records vehicle dynamics over the 5.0 seconds immediately preceding the collision trigger, sampled at 0.5-second intervals. The vehicle was initially travelling at 54 km/h and underwent progressive deceleration throughout the recorded interval. Braking commenced approximately 4.5 seconds before the impact and remained continuously applied until the collision. The recorded speed decreased to 19 km/h at the trigger point, corresponding to a total speed reduction of 35 km/h. The ABS system became active during braking, indicating that the available tire-road adhesion limit had been reached. Significant steering inputs were recorded in the final two seconds before impact, consistent with an evasive or corrective steering manoeuvre. At the moment of collision, both ABS and ESC were actively engaged. The recorded data indicate that the driver combined intensive braking with steering corrections in an attempt to avoid the collision.

The 1st Prior Event is a low-severity frontal event with a peak longitudinal delta-V of −2 km/h — well below the airbag deployment threshold and forensically consistent with a minor impact or aggressive braking event. The airbag warning lamp was OFF at the time of this event, and both driver and passenger pretensioners deployed at 4 ms. The pre-crash data for this event shows the vehicle accelerating from 38 km/h to 45 km/h under full throttle (100%), followed by rapid deceleration with a steering input reaching −254° (extreme left). ABS was engaged for the final 2 seconds.

The successful recovery of forensically usable EDR crash data from a physically destroyed, non-communicative ACM via SEM charge imaging represents a significant advance in the capabilities of forensic accident reconstruction. To the authors' knowledge, this is the first documented case in which this complete workflow — from SEM imaging of a damaged automotive EEPROM through binary data transfer to a donor unit and final EDR report extraction using a standard forensic tool — has been executed successfully in a real criminal investigation context. The forensic implications are substantial. Until now, a non-communicative ACM represented an absolute barrier to EDR data recovery. This case demonstrates that this barrier is not absolute — it is instead a function of the state of analytical technology and the availability of specialist expertise. Modules previously considered to contain irrecoverable data may be candidates for SEM-based recovery, provided their Flash EEPROM memory arrays have not been directly damaged.

The laboratory infrastructure required for this work — high-resolution SEM, precision polishing equipment, NIR microscopy, and semiconductor failure analysis expertise — represents an investment exceeding several hundred thousand euros and demands a level of specialist training that falls well outside standard forensic laboratory provision. In the present investigation, Collision Sciences CrashScan served as an independent forensic decoding platform, converting the recovered EEPROM contents into a standardised EDR report. The successful generation of a complete CrashScan report independently confirmed that the recovered binary data were authentic, internally consistent and fully compatible with the original ACM. The consistency and reliability of the data acquired using CrashScan have been repeatedly validated in previous studies involving Mercedes-Benz vehicles through comprehensive comparative analyses against data retrieved with the Xentry diagnostic platform.

Although Collision Sciences CrashScan was ultimately used to generate the final EDR report, the recovered EEPROM binary can also be analysed directly without the use of proprietary decoding software. Through many years of forensic examination of Mercedes-Benz Airbag Control Modules and detailed reverse engineering of their EEPROM memory organisation, the author has developed the capability to identify and interpret the principal EDR parameters directly from the raw hexadecimal memory image. Although Mercedes-Benz distributes EDR-related information across numerous non-contiguous memory locations to increase the complexity of data interpretation, the underlying structure can be reconstructed through detailed knowledge of the memory architecture. Consequently, essential crash parameters — including vehicle speed, braking status, steering angle, delta-V values, restraint system status and other key EDR variables — can be extracted directly from the EEPROM image without the use of proprietary decoding software. In the present case, the manually interpreted hexadecimal data corresponded with the EDR report independently generated by Collision Sciences CrashScan, providing an additional level of technical verification.

Although the data stored inside the EEPROM array were not encrypted at the hardware level, neither scrambling nor encryption would stop the recovery. The presence of error correction helps not only to increase the success rate but also proves that no data were lost because of damage to the silicon chip. The SPI EEPROM chip described in this work was fabricated with 130 nm process. Smaller fabrication process could pose more challenges and would require more sophisticated sample preparation and imaging process. Also, relatively small memory array of 16 kilobytes made the extraction process faster. For large memory arrays not only more advanced imaging techniques would be required, but also some form of automation to speed up the process. However, as long as all memory cells inside the array are not physically damaged there is a good chance to recover all the data without any errors.

This paper documents, for the first time in the forensic literature, the complete end-to-end recovery of automotive Event Data Recorder (EDR) crash data from a physically destroyed, non-communicative Airbag Control Module (ACM) using Scanning Electron Microscope (SEM) charge imaging of the EEPROM silicon die as the primary data extraction technique. This could find applications not only in automotive but also in medical, aviation and aerospace industries if semiconductor devices were mechanically, electrically or fire damaged.

Improvements to AI Systems:

1. Automated Forensic Data Recovery Pipeline: Train an AI model to automate the SEM charge-imaging-to-binary conversion process. The AI can learn to segment memory arrays, detect damaged vs. intact cells, and reconstruct bitmaps from raw SEM images, reducing manual polishing and imaging time from days to hours. This system could handle larger memory arrays (e.g., >1 MB) by auto-focusing on regions of interest and stitching images.

2. Resilient Memory Decoding with Error Correction: Develop an AI that infers the ECC polynomial structure (like the 6 polynomials for 32 data bits) directly from raw bit patterns without prior knowledge of the chip’s ECC scheme. This enables recovery from unknown or undocumented EEPROMs, and can validate data integrity by predicting and correcting bit errors in partially damaged arrays.

3. Cross-Platform Data Interpretation Engine: Build a neural network that maps raw hexadecimal EEPROM dumps to standardized EDR parameters (speed, delta-V, steering, belt status) across multiple vehicle manufacturers and firmware versions. This AI would learn the non-contiguous memory layout patterns (as seen in Bosch SRS modules) and generate human-readable crash reports without proprietary tools like CrashScan, making forensic analysis accessible to smaller labs.

4. Damage Propagation Prediction: Train a model on failure analysis data (e.g., overvoltage-induced latch-up, melted bonding wires, silicon evaporation) to predict which memory regions are likely intact based on physical damage location and current flow paths. This allows forensic teams to prioritize imaging of high-value data areas and estimate recovery confidence before starting destructive sample preparation.

5. Adaptive Sample Preparation Advisor: Create an AI assistant that recommends optimal polishing thickness, imaging parameters (NIR vs. SEM), and chemical etch steps based on chip type, fabrication process (e.g., 130 nm vs. smaller), and observed damage patterns. This reduces trial-and-error on blank samples and improves success rates for novel or obsolete chips.

6. Automated Data Transfer to Donor Units: Develop a system that automatically identifies module-specific configuration parameters (e.g., VIN, calibration) vs. forensic crash data in the recovered binary, then generates a patched HEX file for a donor ACM. The AI can validate compatibility by simulating the donor module’s firmware boot and communication handshake, ensuring the donor unit passes diagnostic checks.

7. Real-Time Crash Pulse Reconstruction: Use the recovered EDR data (e.g., delta-V vs. time) to train a generative model that reconstructs full vehicle dynamics (position, yaw, acceleration) during the pre-crash and crash phases. This could assist accident reconstructionists by filling gaps in sparse EDR samples (e.g., 0.5-second intervals) and estimating impact severity with confidence intervals.

8. Cross-Industry Failure Recovery AI: Generalize the approach to other domains (medical devices, aviation black boxes, aerospace memory) by training a meta-model on diverse semiconductor failure modes (electrical, mechanical, fire) and memory types (EEPROM, Flash, MRAM). This AI could suggest recovery strategies and predict success probability based on chip architecture and damage extent, enabling rapid deployment in new forensic contexts.

What the Improved AI System Can Do:

• Recover crash data from severely damaged ACMs in under 24 hours with minimal human intervention, even for chips with unknown ECC or memory maps.

• Generate court-admissible EDR reports directly from raw silicon images, eliminating reliance on proprietary software and enabling independent verification.

• Predict data loss risk and prioritize recovery efforts for multi-chip modules, saving time and resources in mass-casualty or fleet-wide investigations.

• Automatically adapt to future chip technologies (e.g., 5 nm processes) by learning from simulated damage and imaging datasets, ensuring long-term forensic capability.