Parsing evidence trails in the sky with drone forensics
As drone usage rapidly expands, so does their relevance to civil disputes, regulatory reviews, and risk management inquiries. According to an article from HKA partner Geo Brown, drone forensics can uncover what a drone did, where it flew, and how it was operated.
For example, a sensitive industrial site has been reporting repeated unauthorized nighttime drone activity. A skilled investigator can recover the digital trail of flight logs cached on a mobile device, GPS telemetry in media files, and cloud records to determine where the drone launched, where it flew, and how it was controlled.
In the thought piece – “Drone forensics: Uncovering the secrets of the sky” – Brown defines drone forensics as the systematic identification, preservation, analysis, and interpretation of digital artifacts generated by unmanned aerial systems (UAS) and their supporting ecosystem.
Drone forensics is used in various areas. In litigation and insurance matters, it can provide evidence on what happened during a flight and whether operations aligned with requirements. Drone forensics can also support internal investigations, vendor disputes, ownership disputes, loss recovery, and accountability.
Drones operate within a network of onboard systems, remote controllers, mobile applications, and cloud services that all generate records. A forensic investigator will examine the sources together to create a defensible account of how, when, where, and by whom a drone was operated.
Data sources
Brown, an HKA expert specializing in digital forensics, notes that a 30-minute drone flight can create millions of data points across several systems. The primary sources of digital evidence are:
The operating system, which is the software layer on the drone controlling areas including flight stability, navigation, and communications. It can be open source or proprietary, and can contain system events and operational records to explain how the drone was configured and how it behaved during flight.
GPS and telemetry data is heavily relied upon by drones for navigation and stability. Flight logs will typically record coordinates, altitude, speed, and timestamps that can pinpoint a drone’s location.
Flight logs record activity on most modern drones, and are stored on the drone itself, on removable media, or within connect mobile applications. Flight logs will record information including GPS data, speed, and controller inputs.
Photo and video metadata – known as EXIF metadata – is embedded information when drones take pictures of videos. EXIF metadata can include GPS coordinates, time stamps, and altitude info and can be used to cross-reference a claimed flight or event.
Flight data in the cloud is automatically synchronized with many drones’ flight logs. This cloud data is especially important when a drone is destroyed or unsalvageable, and can provide the central basis for reconstructing flight paths and operational behavior.
Mobile applications will also often aggregate the data generated by a drone’s OS, flight logs, media files, and cloud services. This can also be relied upon is the drone is unrecoverable.
Brown notes that drone forensics begins with proper data extraction and preservation, and that forensic integrity is crucial. That includes documenting acquisition methods and preserving original data in a read-only state if possible.
Drone forensics isn’t a task for generalist investigators, Brown says, because it requires working knowledge of drone hardware and proprietary data formats – which are often fragmented across devices and platforms.
“Drones operate in the air, but the records they generate stay on the ground across devices, applications, and cloud platforms long after the flight ends,” Brown concludes. “Examined systematically, this data reveals where the drone flew, how it was operated, and if the conduct aligned with applicable requirements.”
