The existing data forensics methods based on Telematics BOX(T-BOX)are mainly aimed at the network data flow between T-BOX and mobile APP,etc.,and no evidence analysis and forensics methods for the underlying data of T-BOX have been found.A vehicle behavior forensics algorithm based on T-BOX data reverse analysis is proposed.The algorithm is mainly divided into three stages:data preprocessing,underlying data analysis and driving behavior reshaping.In the data preprocessing stage,the original data is cleaned by setting the vehicle stationary data identification and typical data threshold range.In the underlying data analysis stage,the data analysis of different modules is com-pleted through data type identification and data description conversion.In the stage of driving behavior reconstruction,vehicle travel data analysis and vehicle driving path reconstruction are realized.The ex-perimental results show that the vehicle behavior forensics algorithm based on T-BOX data reverse analysis can effectively realize vehicle travel data analysis and vehicle path reshaping.Compared with the traditional T-BOX data forensics method,the forensics results are more complete and accurate,and at the same time,the security problem of wireless transmission of T-BOX data is avoided.