IT Forensics · Drones
Schwarm- und Mehrfach-Drohnen-Einsätze forensisch untersuchen
Bei koordinierten Einsätzen mehrerer Drohnen, etwa im Rahmen choreografierter Lichtshows oder gemeinsamer Vermessungsaufgaben, müssen die Daten sämtlicher beteiligter Fluggeräte sowie einer gegebenenfalls zentralen Steuerungseinheit zusammengeführt werden.
This point is particularly important when it comes to drones, as manufacturers, model types, firmware versions and the storage and transmission formats used can vary considerably. A commercial multicopter drone, a fixed-wing drone used for surveying purposes and a homemade model must not be treated according to the same technical approach. Storage location, data format, encryption and connectivity determine which data is accessible and which backup method causes the least disruption.
Die forensische Herausforderung liegt hier insbesondere in der koordinierten Sicherung und zeitlichen Synchronisation der Daten mehrerer, teils gleichzeitig fliegender Systeme.
Why LanCologne?
LanCologne does not examine digital traces relating to drone operations according to a blanket standard procedure, but rather on the basis of the specific drone type, the storage and transmission formats used, and the particular issue at hand. Our staff have decades of experience in information technology and many years of practical experience in IT forensics. We assist companies, solicitors and private individuals, as well as regularly supporting courts and public authorities, in the technical investigation of digital matters.
The investigation is generally carried out on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence is either left unchanged or, where technically unavoidable alterations have been made, these are transparently documented and the evidence is stored in a manner that preserves its integrity.
Our working methods and the tools we use
Our investigation does not begin by launching an analysis programme, but by gathering evidence. The drone, storage media, remote control and, where applicable, any connected mobile devices are documented in the condition in which they were found. A decision is then made as to which components need to be secured and in what order this is technically appropriate.
The next step is to define the backup strategy. We distinguish between read-only backups of memory cards, separate backups of remote controls and mobile devices, and the collection of available cloud data. The choice depends not on convenience, but on the storage location, encryption, availability of the components and the specific evidential requirements. Where technically possible, we work in read-only mode; any unavoidable changes to the state of the data are explicitly logged.
The backup created is documented using hash values. The actual analysis is not carried out on the original, but on a working copy or a verified forensic image. This allows searches or specific analysis steps to be carried out without continuously altering the original evidence.
Bei Schwarm- und Mehrfach-Drohnen-Einsätzen sichern wir die Daten aller beteiligten Fluggeräte sowie einer gegebenenfalls vorhandenen zentralen Steuerungseinheit koordiniert und führen diese zu einer gemeinsamen, zeitlich synchronisierten Gesamtauswertung zusammen.
For a reader unfamiliar with the subject, one point is particularly important: a forensic programme does not automatically „find" the truth. It reads data structures and interprets them according to known rules. If a new firmware or app version changes a data format, an automated analysis may produce an incomplete or incorrect result. That is why, in the case of crucial findings, we check which file or data structure the result originates from and whether a second technical approach confirms the same findings.
We deliberately do not use any dedicated, manufacturer-specific drone forensics software, as such software is not reliably available for many models and formats anyway. Instead, we analyse storage media, mobile devices and common file and database formats using our established forensic tools, in particular Belkasoft X and X-Ways Forensics. Where proprietary, undocumented binary formats from individual manufacturers prevent a fully automated analysis, we examine the raw data manually and document any technical limitations transparently, rather than claiming an unsubstantiated finding.
Typical areas of application
This is how the forensic investigation is carried out
The drone, its storage media, the remote control and, where applicable, any connected mobile devices are first clearly identified and documented either photographically or in writing. We record the physical and electronic condition in which the components were found. This information may prove crucial later on.
The manufacturer, model, firmware version, storage media used and connectivity are identified. Only then can it be determined which data is generally accessible and which backup method is appropriate.
Data is backed up in such a way that the original state is altered as little as possible. Depending on the circumstances, memory cards are read in write-protected mode, controllers and mobile devices are backed up separately, and any available cloud data is captured with the authorised person’s consent. Every step is logged.
Any images or copies created are given unique names, assigned hash values and verified. Analysis and searches are then carried out exclusively on working copies.
Existing data is analysed in a structured manner using our established forensic tools. Where standard software does not fully support a particular format, this is documented rather than being tacitly ignored.
In the case of findings that are particularly relevant to the evidence or unusual, we manually check the raw data, file structures and metadata to rule out any automated misinterpretations.
At the end, we do not merely list what could be gleaned from the data. We explain the technical source on which the findings are based, what conclusions can be drawn, and where the limitations lie.
Why is this area of investigation relevant to forensics?
Bei koordinierten Einsätzen mehrerer Drohnen, etwa im Rahmen choreografierter Lichtshows oder gemeinsamer Vermessungsaufgaben, müssen die Daten sämtlicher beteiligter Fluggeräte sowie einer gegebenenfalls zentralen Steuerungseinheit zusammengeführt werden.
The forensic value lies not solely in the volume of data found, but in its origin and reliability. A file name, a timestamp or a log entry can be misleading without context. That is why we document how an artefact may have come into being, what alternative explanations exist and what further evidence supports the findings.
Die forensische Herausforderung liegt hier insbesondere in der koordinierten Sicherung und zeitlichen Synchronisation der Daten mehrerer, teils gleichzeitig fliegender Systeme.
In the case of drones in particular, attempts to carry out a comprehensive technical analysis may also reach their limits if manufacturers use proprietary, unpublished data formats. A lack of documentation, encrypted storage areas and manufacturer-specific cloud connections highlight why it is so important to carry out a proper backup and to communicate existing limitations transparently before the actual analysis begins. Errors made at this stage cannot always be rectified later on.
Frequently Asked Questions
LanCologne – IT Forensics Drones Cologne
Sie benötigen eine professionelle Untersuchung zu „Schwarm- und Mehrfach-Drohnen-Einsätze forensisch untersuchen"? LanCologne unterstützt Sie bei der beweissicheren Sicherung, mehrstufigen Auswertung und nachvollziehbaren Dokumentation digitaler Spuren im Zusammenhang mit Drohneneinsätzen. Entscheidend ist dabei nicht, möglichst viele automatische Treffer zu erzeugen, sondern technisch belastbare und überprüfbare Beweise zu sichern.