UAV Forensic Analysis and Software Tools Assessment: DJI Phantom 4 and Matrice 210 as Case Studies

Fahad E Salamh,Mohammad Meraj Mirza,Umit Karabiyik

doi:10.3390/electronics10060733

Fahad E Salamh, Mohammad Meraj Mirza + Show 1 more

Open Access

https://doi.org/10.3390/electronics10060733

Copy DOI

Journal: Electronics	Publication Date: Mar 19, 2021
Citations: 18	License type: CC BY 4.0

Affiliation: Purdue University West Lafayette, Taif University

Abstract

Unmanned Aerial Vehicles (UAVs) also known as drones have created many challenges to the digital forensic field. These challenges are introduced in all processes of the digital forensic investigation (i.e., identification, preservation, examination, documentation, and reporting). From identification of evidence to reporting, there are several challenges caused by the data type, source of evidence, and multiple components that operate UAVs. In this paper, we comprehensively reviewed the current UAV forensic investigative techniques from several perspectives. Moreover, the contributions of this paper are as follows: (1) discovery of personal identifiable information, (2) test and evaluation of currently available forensic software tools, (3) discussion on data storage mechanism and evidence structure in two DJI UAV models (e.g., Phantom 4 and Matrice 210), and (4) exploration of flight trajectories recovered from UAVs using a three-dimensional (3D) visualization software. The aforementioned contributions aim to aid digital investigators to encounter challenges posed by UAVs. In addition, we apply our testing, evaluation, and analysis on the two selected models including DJI Matrice 210, which have not been presented in previous works.

Highlights

The use of flying Unmanned Aerial Vehicles (UAVs) has increased over the past five years among hobbyists, photographers, and journalists
As most of the world faces issues related to the forensic investigation of UAVs, the INTERPOL recently has collaborated with communities, researchers, and practitioners by developing a drone incident response framework that could aid in the investigation of such flying devices by addressing the challenges that are faced by drone forensic examiners [2]
Our analysis indicates that Magnet Axiom forensic tool was not able to decrypt the recovered .DAT files and does not visualize flight routes at least on the two selected UAV models

Summary

Introduction

The use of flying Unmanned Aerial Vehicles (UAVs) has increased over the past five years among hobbyists, photographers, and journalists. As most of the world faces issues related to the forensic investigation of UAVs, the INTERPOL recently has collaborated with communities, researchers, and practitioners by developing a drone incident response framework that could aid in the investigation of such flying devices by addressing the challenges that are faced by drone forensic examiners [2]. It is crucial to classify artifacts recovered from UAVs to enhance the performance of drone incident investigations and response. The Computer Forensic Reference Data Sets (CFReDS) provides access to acquired drone images including—remote controls, mobile devices, chip-offs, internal and external SD cards from a wide range of UAV models [3]. Challenges to the UAV ecosystem include cyber threats that could impact the reliability of the investigated digital evidence

Objectives

Methods

Results

Discussion

Conclusion