Drone and UAV Forensics

What it is and why it matters

A consumer drone is a flying computer with a camera attached. Its flight controller writes position, altitude, speed, battery state and the pilot's stick movements to a log many times a second. The camera stamps photos and video with coordinates. The remote controller and the phone running the pilot app keep their own copies of much of this. Read together, these records answer the questions an investigator actually has. When did it take off, from where, where did it go, what did it film and whose account was signed in.

The discipline exists because drones keep turning up where they should not be. Near airport approaches, over prison walls with a packet taped underneath, across a border, above a crowd or a neighbour's terrace. A recovered aircraft is evidence on three fronts at once, the aviation rules it may have broken, the offence it was used for and the data it carries. In India the Drone Rules, 2021 add a regulatory trail, since most aircraft must be registered on the Digital Sky platform and carry a unique identification number that links the airframe to an owner.

The method borrows from two neighbours. The pilot app is a phone app, so mobile forensics applies. The aircraft's own logs sit on a memory chip that may only be reachable through hardware methods after a crash, so embedded device forensics applies too. Manufacturers differ widely. DJI, which makes most consumer aircraft, has log formats that researchers have studied in detail. Open-source flight controllers running ArduPilot or PX4 write their own log types. A home-built aircraft may follow no pattern a tool expects.

Types of digital evidence

Aircraft Flight Logs
Telemetry recorded on the aircraft itself. On DJI aircraft these are .DAT files; ArduPilot boards keep .BIN dataflash logs. They hold GPS fixes, altitude, speed, battery voltage, motor output, warnings and the pilot's control inputs against a clock.
App Flight Records
The pilot app on the phone saves a record of each flight, such as the .TXT flight records written by DJI apps. These are easier to reach than the aircraft logs and often survive when the aircraft does not.
Media With Coordinates
Photos and video on the microSD card and internal storage, with EXIF and XMP metadata that can carry latitude, longitude, altitude, time, camera model and the aircraft serial.
Controller Data
The remote controller stores the paired aircraft serial, firmware and sometimes its own logs. Smart controllers with a built-in screen run Android and are examined like a phone.
Account and Cloud Records
The signed-in manufacturer account, synced flight records, geofence unlock requests and uploaded media, held by the maker and reached only with separate authority.
Identity Markings
Serial numbers on the body, battery, camera and controller, the firmware version and the unique identification number sticker that Indian rules require.
Deleted Logs and Media
Flight records and files removed by the user, often recoverable from the FAT or exFAT card by carving. Thumbnails in caches frequently outlast the originals.

Devices and data sources

The aircraft's internal storage and any microSD card fitted to it
The remote controller, including smart controllers with their own screen and operating system
The pilot's phone or tablet with the flight app installed
Batteries, which carry serial numbers and charge cycle counts that can be matched to flights
Payloads such as gimbal cameras, thermal cameras, release mechanisms and sprayers
Laptops used as ground stations with mapping, survey or open-source mission software
Manufacturer cloud accounts holding synced flight records and media
FPV goggles and video receivers that may store their own recordings

How an examination runs

The order matters. Each step protects the one after it.

01
Authority and Safety
Confirm the legal basis for seizure and examination. Treat the aircraft as hazardous. Propellers can start, a damaged lithium battery can ignite and a payload may be unknown. Power down without touching the app's sync or delete controls.
02
Photograph and Label
Record the aircraft, propellers, battery, controller, cards, phone and accessories with every serial number and the UIN marking. Note damage, mud, water and anything attached to the airframe.
03
Isolate the Phone and Controller
Airplane mode or a Faraday bag so the app does not sync, update or receive a remote command. Record the lock state and the app version if visible.
04
Image Removable Storage
Image the microSD card through a write-blocker and hash it. Internal aircraft storage is exported through the maker's supported interface where one exists. Where it does not, record that a hardware route may be needed rather than improvising.
05
Extract the Phone
Run a mobile extraction aimed at the flight app's databases and flight record folder. A full file system extraction, where the handset allows it, reaches cached maps, account tokens and deleted records.
06
Decode and Plot
Parse the logs, convert timestamps and coordinate formats, draw the track and line up media times against it. Check that the aircraft clock, the phone clock and the camera clock agree before trusting any sequence.
07
Reconcile and Report
Compare the aircraft, controller and app copies of each flight. Where they differ, say so and explain why. State what the storage could not provide.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

UAS and UAV: Unmanned Aircraft System is the aircraft plus its controller, link and software. Unmanned Aerial Vehicle is the aircraft alone. The Indian rules use the term unmanned aircraft system.
Flight Controller: The board that reads the sensors, runs the motors and writes the flight log. It is the heart of the evidence on the aircraft.
Telemetry: The stream of position, attitude, speed and battery readings sent from the aircraft to the controller and saved in the logs.
Home Point: The position the aircraft records at take-off, used for the return-to-home function. It is often the best evidence of where the pilot stood.
Return to Home: An automatic flight back to the home point on signal loss or low battery. A log showing it was cancelled by stick input tells the examiner the pilot was in control.
Geofence: Software boundaries the maker builds into the aircraft to block or warn near airports and sensitive sites. Unlock requests leave records in the account.
Unique Identification Number: The number issued through the Digital Sky platform under the Drone Rules, 2021 that registers an aircraft to a person or organisation.
Remote Pilot Certificate: The certificate the Drone Rules, 2021 as amended require for flying most drones. Nano drones and some other categories are exempt.

Challenges and limits

What makes it hard

Log formats are proprietary, partly encrypted and change with firmware, so tool support lags behind new models
A crash can shatter, burn or submerge the aircraft, leaving chip-off as the only route to the logs
The phone is frequently somewhere else or locked, and the app record is the easiest copy to read
Home-built and racing aircraft follow no standard and may carry no log at all
The first GPS fixes after power-on can be poor, so the recorded take-off point may be some distance from the true one
Cloud flight records are held by makers outside India and need their own legal process
Tools decode popular DJI models well and most other makes poorly, which pushes the work back to manual parsing

Keeping the evidence intact

Never power the aircraft and connect it to a pilot app before storage is imaged, since the app may sync or overwrite records
Hash card images and exported logs and record the firmware and app versions that produced them
Keep the aircraft, controller and app records as separate exhibits rather than merging them into one file
Document the coordinate system and every time zone conversion used in plotting
Record battery condition and handling, both for safety and because battery serials link to flights

Standards and legal considerations

Drone Rules, 2021
Made by the Ministry of Civil Aviation under the Aircraft Act, 1934 and amended since. They set out registration on the Digital Sky platform, unique identification numbers, type certification, green, yellow and red airspace zones and remote pilot certificates. For an examiner they are the trail from an airframe to an owner and the measure of whether a flight was itself an offence.
SWGDE Best Practices for Drone Forensics
Document 21-F-002, version 1.2 of July 2025, covering seizure, acquisition and analysis of consumer drones and their connected systems and the known limits of each.
Read the guide
ISO/IEC 27037:2012
The general rules for identifying, collecting and preserving digital evidence, applied here to an aircraft, a controller and a phone at the same time.
Read the guide
NIST SP 800-101 Rev. 1
Guidelines on Mobile Device Forensics, which govern the extraction of the pilot's phone and any smart controller.
Read the guide

In practice

A Packet Over the Wall
A quadcopter is recovered inside a prison yard with a parcel tied beneath it. The microSD card is empty, but the aircraft's .DAT logs show a take-off point in a lane outside the perimeter, a hover above the yard and a descent. The home point and the take-off time give the investigating officer a place and a window for CCTV.
Whose Aircraft Is This
A drone is seized with no phone and no controller. The airframe carries a UIN sticker and the logs record the serial of the last paired controller. The officer traces the UIN through Digital Sky, and the examiner reports the controller serial so it can be matched if a controller is later found.
A Disputed Crash
An insurer asks whether a crash into a building was mechanical failure. The app flight record shows a low battery warning, an automatic return-to-home that the pilot cancelled by stick input and a final descent under manual control. The examiner reports the sequence and leaves the question of fault to the parties.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone appsIntermediateIoT / Drone

VideoSurveillance & Image / Video ForensicsImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveBeginner

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Questions people ask

Does a drone really store where it flew?

Most consumer aircraft do, in a log on the flight controller, and the pilot app keeps a second copy on the phone. The detail varies by maker and firmware. Cheap toy drones without GPS record little or nothing.

Can the logs be read from a smashed drone?

Often. The flight controller board is small and frequently survives a crash that destroys the body. If its port is gone, a laboratory can read the memory chip directly under written authority, as described on the chip-off and hardware page.

What if the pilot deleted the flight records in the app?

The aircraft keeps its own copy, the maker's cloud may hold synced records and deleted files on the phone can sometimes be recovered. Deleting one copy rarely removes all three.

Is flying a drone in a particular place an offence by itself?

It can be, depending on the airspace zone, the aircraft category and whether the required registration and certificate were in place under the Drone Rules, 2021. This page explains the records involved, not the law. DFRTI's legal course covers how such material is presented.