IT Forensics · Drones

Analysing the file system structure of drone storage media – conducting a forensic analysis of the underlying file organisation

Drone storage media typically use common file system formats to organise the stored data; the structure of these formats can provide additional metadata, such as creation and modification dates, during a forensic examination.

Enquire without obligation

A structured analysis at the file system level makes it possible to systematically evaluate not only the files themselves but also their organisation, directory structure and remaining free space.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We carry out a comprehensive analysis of the file system structure of backed-up drone storage media and systematically evaluate both existing and partially overwritten data sectors.

Typical areas of application

•Full analysis of the directory and file structure
•Recording the creation and modification dates of individual files
•Identification of unusual file storage locations
•Supplement to procedures for recovering deleted files
•Judicial and non-judicial expert reports
•Incident response for drone incidents

How a file system structure analysis works

Once the data has been backed up, the file system structure of the storage medium is read in its entirety and systematically documented. Any unusual directory or file structures are examined separately and correlated with further investigative steps.

Why is file system structure analysis relevant to forensic investigation?

File system-level metadata can provide additional temporal cues, independent of the actual file contents, which are valuable for forensic chronology.

Examining free or unusually organised memory areas can also provide evidence of deliberate attempts at manipulation.

Frequently Asked Questions

Which file systems are commonly used on drone memory cards?+
Formats that are widely used and standard for removable media, the exact structure of which may vary depending on the card and formatting.
Does the file system level provide more reliable timestamps than the file itself?+
Both sources are used to complement one another and, where there is any doubt, are cross-checked for plausibility.
Can tampering at file system level be detected?+
In many cases, yes – for example, due to anomalies in the directory structure or inconsistent metadata.

🔗 Related topics

LanCologne – IT Forensics Drones Cologne

Do you require a professional forensic investigation into „analysing the file system structure of drone storage media"? LanCologne can assist you with the legally admissible preservation of digital evidence and the transparent analysis of relevant drone artefacts.

Get in touch now