IT Forensics · Drones

Forensic analysis of cloud-synchronised drone data – utilising flight data stored in the cloud

Many drone companion apps offer optional cloud synchronisation, which allows flight data, recordings and settings to be stored in a manufacturer’s own or third-party cloud service, in addition to local storage.

Enquire without obligation

Provided that such synchronisation was active and the relevant access details, obtained in accordance with the law, are available, the cloud can serve as an additional data source that is independent of the physical device.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We check whether drone data has been synchronised to the cloud and, subject to the relevant authorisation, analyse accessible cloud data sets as a supplementary forensic source.

Typical areas of application

•Analysis of flight data stored in the cloud
•Replacement of missing or lost local data
•Evidence of active cloud synchronisation at a specific point in time
•Analysis of data access via the cloud connection
•Judicial and non-judicial expert reports
•Incident response for drone incidents

How a cloud synchronisation analysis works

Once it has been checked whether cloud synchronisation has been set up and, if so, with which service, the available cloud data is accessed, provided the necessary authorisation is in place. This data is backed up and synchronised with the data stored locally to check for completeness and consistency.

Why is cloud synchronisation analysis relevant in a forensic context?

Cloud data may still be available even if the local device has been lost, damaged or its data deleted, and thus provides an important fallback option.

A comparison between local and cloud data can also help to detect any subsequent local alterations, provided that the cloud version was synchronised before such a change was made.

Frequently Asked Questions

Is cloud synchronisation enabled by default?+
This depends on the app in question and the user’s individual settings, and is assessed on a case-by-case basis.
How can cloud data be accessed in a legally permissible manner?+
Only with the account holder’s authorisation or on the basis of a valid legal basis.
What happens if cloud synchronisation was not active?+
In this case, the investigation is limited to the data available locally on the drone, the controller and the end device.

🔗 Related topics

LanCologne – IT Forensics Drones Cologne

Do you require a professional forensic investigation into „the forensic analysis of cloud-synchronised drone data"? LanCologne can assist you with the legally admissible preservation of digital evidence and the transparent analysis of relevant drone artefacts.

Get in touch now