MobileAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsDrone Forensics
Recover DJI flight logs, GPS tracks and home points from drones, controllers and phone apps
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
A drone drops a package over a jail wall or hovers near a restricted site. Once it is seized the questions are simple. Where did it take off, where did it go, who flew it and when? The answers are spread across the aircraft, the remote controller, the pilot's phone and the memory card in the camera.
This course focuses on DJI, the brand investigators see most. Other makes are covered in less depth. You learn where flight records live, how the .txt flight records from the DJI apps differ from the .DAT logs kept on the aircraft and how to turn both into a GPS track with height, speed, battery level and home point. You also read EXIF, XMP and SRT data from drone photos and videos and link the aircraft serial number to the controller and the app account.
Newer DJI log versions are encrypted and some decoding tools fetch keys from DJI's servers. The course covers what that means for evidence handling and how to record it in your notes.
DJI flight logsGPS tracksHome pointDrone media
After this course you can
- Seize a drone, its controller, batteries and memory cards and document each part
- Find flight records on the aircraft, the controller and the pilot's phone
- Convert DJI .txt and .DAT logs into a readable flight track
- Identify the home point, take-off time, maximum height and return-to-home events
- Read GPS and camera data from drone photos, videos and SRT files
- Present a flight path on a map with clear limits on its accuracy
Syllabus
7 modules · 26 topics
01How drones work4 topics
- Flight controller, GNSS receiver, compass, IMU and barometer
- What the aircraft, remote controller and app each store
- Serial numbers of the aircraft, flight controller, batteries and controller
- India's Drone Rules, 2021, registration on Digital Sky and the green, yellow and red zones
02Seizure and handling4 topics
- Handling LiPo batteries safely and keeping the aircraft powered off
- Cutting the controller and phone off the internet so records do not sync or get deleted
- Removing the memory card and imaging it separately
- Photographing labels, serial numbers and any damage
03DJI app flight records4 topics
- DJIFlightRecord .txt files written by DJI GO 4 and DJI Fly
- Where the apps keep them on Android, iOS and controllers with built-in screens
- Encrypted record versions and how decoding tools obtain keys
- Exporting to CSV and reading latitude, longitude, height and battery fields
04Aircraft .DAT logs3 topics
- Onboard flight controller logs and how to reach them, for example through DJI Assistant 2 on supported models
- Decoding .DAT files with DatCon and viewing them in CsvView
- Comparing aircraft logs with app records to spot gaps
05Reading the flight4 topics
- Home point, take-off and landing positions
- Height above take-off compared with height above sea level
- Return-to-home, low battery and signal loss events
- Satellite count, GPS accuracy and why a track can jump
06Media from the drone3 topics
- EXIF GPS tags and DJI XMP fields such as gimbal angles and relative altitude
- SRT subtitle files with frame-by-frame position for DJI video
- Matching photos and video frames to points on the flight track
07Other platforms and reporting4 topics
- ArduPilot dataflash (.BIN) and telemetry (.tlog) logs and PX4 .ulg logs
- Reading open-source autopilot logs in Mission Planner
- Exporting tracks to KML for Google Earth
- Writing a flight summary an officer or court can follow
Hands-on labs
- Lab 1
Decode a sample DJI flight record and plot the flight in Google Earth Pro
- Lab 2
Decode a .DAT log with DatCon and compare it with the app record for the same flight
- Lab 3
Find the home point and take-off time and check them against photo EXIF
- Lab 4
Match frames of a drone video to positions using its SRT file
- Lab 5
Write a one-page flight summary for a drone seen over a restricted site
Tools you will use
- DatCon
- CsvView
- Airdata UAV
- DJI Assistant 2
- ExifTool
- Google Earth Pro
- Mission Planner
- ALEAPP and iLEAPP
Who it suits
- Police and security force staff who deal with drone incidents
- Security teams at prisons, airports and other sensitive sites
- Mobile forensic examiners adding drones to their work
- Drone pilots and students interested in investigation
Before you join
- Basic computer skills and comfort with spreadsheets
- Some mobile forensics knowledge helps, for example from the Android Forensics course
Questions about this course
Does the course cover drones other than DJI?
Yes, in less depth. Drones built on ArduPilot or PX4 keep their own logs and you learn to read them. DJI gets most of the time because it is what investigators come across most often.
Can I upload drone logs to online viewers?
Only if your organisation's rules and the case allow it. Uploading evidence to a third-party server is a disclosure. The course teaches offline methods first and explains when an online tool is acceptable.
What if the drone crashed and is badly damaged?
The memory card, controller and pilot's phone are often fine even when the aircraft is not. Internal storage on a broken aircraft may need board-level work, which the course discusses but which is beyond its practical scope.
More courses in Mobile & IoT Forensics
MobileAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
MobileSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cards
MobileIoT Device ForensicsEvidence from smart speakers, cameras, wearables and routers, plus firmware extraction basicsNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.