This overview brings together all the questions and answers relating to IT forensics for drones at LanCologne – from flight data and storage media, through photo and video analysis, to crashes, misuse and legally compliant procedures for different types of drones. Click on a category to view the relevant questions.
Flight data and telemetry
- Forensic analysis of flight logs – systematically reconstructing stored flight data
- Analysing GPS telemetry data from drones – forensically reconstructing position data
- Forensically reconstructing altitude and speed data – analysing a drone’s movement dynamics
- Determining take-off and landing points using forensic analysis – reconstructing the start and end points of a flight
- Forensic reconstruction of flight routes and waypoints – Comparing planned and actual flight paths
- Forensic analysis of ‘Return-to-Home’ data – Forensic investigation of the automatic return function
- Forensic analysis of geofencing and no-fly zone data – investigating breaches of flight restrictions
- Forensic analysis of flight mode and control data – Distinguishing between manual and automated control
- Forensic analysis of compass and IMU sensor data – the forensic use of position and motion sensors
- Forensic analysis of barometer data – the forensic use of air-pressure-based altitude measurement
Technical diagnostic data and firmware
- Forensic analysis of the remote control’s firmware – forensic examination of the control unit’s software version
- Conducting a forensic analysis of the drone’s firmware – carrying out a forensic check of the aircraft’s software version
- Forensic analysis of serial numbers and device identification – Using unique device identifiers in forensic investigations
- Forensic analysis of battery data and charging history – using the power supply as a forensic data source
- Forensic analysis of motor and rotor diagnostic data – Using technical drive diagnostics for forensic purposes
- Forensically reconstructing sensor faults and warning messages – Forensically analysing system-generated error messages
Companion apps and cloud synchronisation
- Forensic analysis of companion app data on smartphones – using the associated mobile app as a data source
- Forensic analysis of cache and database files from drone apps – Forensic evaluation of internal app data structures
- Forensically reconstructing flight history in companion apps – Forensically analysing long-term usage history
- Forensic analysis of user account and login details in drone apps – Forensic investigation of account-related usage
- Forensic analysis of push notifications and app logs – using the Companion app’s system messages for forensic purposes
- Forensic analysis of cloud-synchronised drone data – utilising flight data stored in the cloud
- Forensic reconstruction of automatic flight data uploads – Forensic analysis of automated data transfers
- Forensic analysis of the drone’s network connections – Forensic evaluation of radio and data connections
- Proving remote access to drone systems through forensic analysis – Providing forensic evidence of unauthorised access
Storage media and files
- Forensic backup of SD cards from drones – analysing removable storage as a key data source
- Forensic backup of drones’ internal storage – Forensic analysis of permanently installed storage media
- Recovering deleted files from drone memory cards – Reconstructing supposedly lost footage and data
- Analysing the file system structure of drone storage media – conducting a forensic analysis of the underlying file organisation
- Conducting forensic analysis of encrypted drone storage media – assessing access to protected data sets
- Forensic recovery of damaged SD cards from crashed drones – Recovering physically damaged storage media
- Forensic backup of drone storage media using standard tools
- Use Belkasoft X to analyse drone tracking data
- Using X-Ways Forensics for raw data analysis of drone storage devices
Photo and video analysis
- Analysing photo and video EXIF metadata from drone footage – using hidden recording information for forensic purposes
- Forensic analysis of geotagging data from drone imagery – utilising location data in image and video files
- Forensically verifying the timestamps of drone footage – critically examining the times at which the footage was recorded
- Proving the manipulation of drone footage through forensic analysis – detecting image and video tampering through forensic analysis
- Recovering deleted photos and videos from drones – Restoring deleted image and video files
- Forensic reconstruction of live-stream data from drones – Forensic analysis of transmitted real-time video data
Remote control and communication
- Forensically securing a remote control (controller) – using the control unit as an independent source of evidence
- Forensic analysis of pairing data between the drone and the controller – forensic reconstruction of the pairing history
- Forensically reconstructing control commands – forensically analysing the pilot’s inputs
- Proving drone-based jamming and spoofing through forensic analysis – Investigating targeted signal jamming and spoofing
Crashes, collisions and incident reconstruction
- Forensic reconstruction of drone crashes – comprehensively investigating the causes of a crash
- Forensic investigation of drone collisions – investigating collisions with objects or other aircraft
- Forensic analysis of a drone losing control – Investigating a sudden loss of control
- Proving that flight data has been tampered with using forensic methods – Detecting data records that have been altered retrospectively
- Reconstructing the timeline of a drone incident – Consolidating all data sources into a timeline
- Conducting a forensic examination of drones with tampered registration numbers
Misuse and security incidents
- Proving unauthorised drone use through forensic evidence – establishing that the drone was used without the owner’s permission
- Forensic investigation into the theft of drone data – investigating unauthorised access to stored data
- Forensic investigation of drone espionage and surveillance operations – Forensic evidence of unauthorised surveillance
- Forensic investigation of smuggling using drones – Forensic analysis of illegal transport flights
- Conducting forensic investigations into cross-border drone operations
- Conducting forensic investigations into drone operations over critical infrastructure
- Conducting forensic investigations into drone operations over events and crowds
- Forensic documentation of counter-UAS measures
Types of drones and areas of application
- Conducting forensic examinations of multicopter drones
- Conducting a forensic examination of fixed-wing drones
- Conducting forensic investigations on FPV and racing drones
- Forensic examination of agricultural drones
- Conduct a forensic examination of delivery drones
- Forensic examination of industrial inspection drones
- Forensic examination of surveying and mapping drones
- Forensic examination of drones used in photography and film production
- Conducting forensic examinations of security and surveillance drones
- Conducting forensic examinations of homemade drones
- Forensic examination of micro-drones and toy drones
- Conducting forensic investigations into swarm and multi-drone operations
- Conducting a forensic examination of drones fitted with thermal imaging cameras
- Forensic examination of drones fitted with LiDAR sensors
- Conducting a forensic examination of tethered drones
Physical security and special cases
- Securing drones for forensic analysis following a water landing
- Securing drones for forensic analysis following exposure to fire or heat
- Securing seized drones for forensic analysis
- Carry out a forensic examination of a drone found with no known owner
- Conduct a joint forensic examination of several seized drones
Order Process and Legal Matters
- Quality assurance and second-opinion reviews for drone surveys
- Temporal synchronisation of multiple data sources in the event of drone incidents
- Combined analysis of drone and mobile phone data
- Emergency response to drone incidents for businesses
- Communicating the limitations of drone forensics transparently
- Preparing for a forensic drone investigation for clients
- Why drone forensics requires a thorough, cross-tool examination
Other questions
- Limitations of analysing proprietary flight data formats
- Chain of custody for evidence gathered by drones
- Hash value generation and integrity verification for drone data
- Write protection when backing up drone memory cards
- Forensic analysis of Remote-ID and EU drone identification
- The legal basis for drone forensics under aviation law
- The EU Drone Regulation and forensic evidence
- Data protection assessment of drone footage
- Proving infringements of personal rights caused by drone surveillance through forensic evidence
- Forensic assessment of insurance claims arising from drone crashes
- Preparing expert reports for the courts on drone incidents
- Cooperation with aviation authorities in the event of drone incidents
- Cooperation with law enforcement agencies on drone-related offences
- Reporting and documentation in drone surveys
- Automated versus manual analysis of drone data