I wanted to let everybody know, since it isn't commonly known, that pretty much all cars past 2005 contain a hard drive which records location, acceleration, and other data. They are commonly used in car theft cases and insurance claims. From the forensics guys I've talked to, they noted that some modern systems phone home to the manufacturer, but that data is rarely made available to the police. You pretty much cannot buy a modern car without one of these hard drives. Stay safe and if you have questions I can try and answer.
I haven't heard of anyone using this to prove that someone was at a protest ect, but I would expect it in the future. The cops do need a warrant for this and because getting to the drive is a fairly destructive process, they will (generally) actually get one.
I think you must be getting some things confused.
An Event Data Recorder is built into every new car, as part of the airbag module. It only has memory for 60 seconds of recording or so, and is triggered by airbag deployment.
There are telematic systems like OnStar or those plug-in insurance dealies that can transmit data. But that doesn’t require a hard drive; they just read data off the CAN bus. (EDIT: clarification, there are two types of telematics. There's real-time, which doesn't need any hard drive space. Then there are more detailed telematics like for development vehicles, which are stored on the device so they can be compressed and uploaded all at once to save on data bills. I imagine this would also be useful for a taxi fleet or delivery trucks or whatever, so OnStar can do this too.)
I’ve never heard of any kind of long-term telematics storage built-in to every car. I’ve had to put telematics systems in development vehicles, too, so it would have been useful.
I can't give exact details as it's not something I do regularly, but this link is to an example group of what can be extracted from these devices. Here is a link to one of the groups which does the trainings. They have descriptions of the data they are able to recover.
Huh. So what's happening here is that various infotainment systems keep caches and logs. Actual telematic systems (OnStar etc. for luxury vehicles, fleet vehicles, whatever) have to keep full data logs so they can upload the data more efficiently (they compress the log before sending it), and they only clear them as needed. There's usually not a whole lot of space dedicated to that. The normal infotainment systems just have whatever caches they use for performance or random debug logs the developer forgot to turn off. I saw one where they were able to recover the last few text messages, some phone logs, the last few GPS destinations, maybe key-on timestamps, but not really anything else. That's about what you'd expect an infotainment connected to your phone to cache. All the infotainment systems run Linux, so if you yank the storage and poke around you might find something juicy. Nobody working at a car company cares enough to encrypt anything, but knowing car company politics I doubt that's due to influence from the cops.
I think the hard drives were mostly a weird thing in the late 2000s, where GM and a few others had a system to rip CDs or otherwise load MP3s onto your car's crappy little 40 GB hard drive. It didn't last very long, but it makes for good pictures on those websites (although it looks like BMW still does that for some reason). Most stuff should be just whatever's cheapest within the warranty period and provides enough space, which is probably flash storage now ($2 per vehicle is massive at the big carmakers).
Excellent clarification! Thanks for expanding. I was mainly only aware of how they used the data, and what it resulted in. I appreciate your look at the more technical aspects.