Severe Consequences Caused by Unsanctioned UAV Flight
Recent years have seen a marked shift of Unmanned Aerial Vehicle (UAV) from an expensive and professional production equipment to a consumer product. And, along with this shift comes more unsanctioned flights which have major impacts on the safety of traditional aircrafts and human life. Unsanctioned flights of four UAVs occurred at Chengdu Shuangliu International Airport at the night of April 21st, for example, caused alternate landing of 58 flights at Xi’an, Chongqing, Guiyang, and Mianyang airports, 4 flight returns, and the stranding of more than 10,000 passengers. Prior to this event, on the 14th, 17th, and 18th, unauthorized flights of UAV also disturbed the normal arrangement of Shuangliu airport when they caused alternate landing and delay of flights.
Picture 1: DJI UAV
Two File Formats of UAV Flight Records
Unsanctioned flights of UAV are causing severe consequences, and relevant digital forensics solutions can help investigators reveal the truth and prevent similar accidents. SalvationDATA technical engineers, therefore, conducted an in-depth analysis of UAV flight records based on DJI products.
Picture 2: Flight Records of DJI UAV
Technical engineers from SalvationDATA found that DJI products record flight data in two formats: .DAT file in UAVs and .txt file in cellphones/tablets controlling the drones.
Picture 3: Data Generated in Cellphones/Tablets during UAV Flights
Access to Android and iOS Systems to Flight Record File
Both Android and iOS systems can search and access flight record files saved in cellphones and tablets controlling the drone.
For Android users, follow the following steps: connect the phone/tablet to a computer; find the file named ‘dji.pilot/DJI/FlightRecords’; and locate needed flight record files which are usually named ‘DJIFlightRecordxxxx-xx-xx[xx-xx-xx]’. If this file is opened directly by double-clicking, unreadable codes in picture 4 will be shown because of data encryption and websitehttp://www.phantomhelp.com/LogViewer/Upload/ can be used to decode the file content.
Picture 4: Unreadable Codes While Opening a File Directly
For iOS users: connect the phone/tablet to a computer; use iTunes to export flight records; open iTunes-“File Sharing”-DJI GO App-, and check ‘Flight Records’. Flight data is also encrypted and can be decoded and accessed using the above-mentioned website, as in picture 5.
Picture 5: Accessing Flight Data Through the Website
Drone Cloud Data Forensics Supported by SalvationDATA
1. Local Data
SalvationDATA mobile forensics products SPF can extract and analyze flight record files saved in mobile phones/tablets controlling UAVs. Run SPF, conduct data extraction and analysis of the connected cellphone directly, and data on the account, GPS location, local flight records, videos, and WeChat moments will be extracted (picture 6).
Picture 6: UAV Data Extracted Using SPF
2. Forensics of Cloud Data
When no local data is available, users can login DJI website to conduct Data Synchronism using their account and password, and data in picture 7 can be seen. Synchronized data of flights will be saved in the mobile phones and then SPF can be used to conduct data extraction and analysis.
Picture 7: Comparison of Data after Data Synchronization
Besides its broad use in civil fields, UAV also has a wide range of applications in military, aeronautics, astronautics and other fields, which indicates the importance of UAV related forensics as a vital prospect of digital forensics. SalvationDATA is dedicated to follow the trend of mainstream technology development and provide the best products and services customers need.
Since there’re massive UVA brands on the market, SalvationDATA will continue to research on drone forensics helping for the DFIR community.
This research results had already integrated into our mobile forensics product SmartPhone Forensic System(SPF), and computer forensics product DF(temporary only for the Chinese market), you can download the software from our resources page of the website to have a free trial.
SalvationDATA Blog 