Introduction to Drone Data Sources
Drones generate and store data in multiple locations throughout their ecosystem. Understanding these data sources is critical for comprehensive forensic analysis. This part covers the various locations where evidence can be found and the structure of that data.
By the end of this part, you will be able to identify all potential data sources in a drone ecosystem, understand flight log structures, extract GPS and telemetry data, analyze camera and media files, and examine controller and mobile app data.
Data Storage Locations
A complete drone ecosystem contains multiple data storage points:
Drone Internal Memory
Flight logs, sensor data, firmware settings, calibration data, error logs, and cached media thumbnails.
SD Cards
Primary media storage for photos and videos. May also contain flight logs, panorama data, and cache files.
Remote Controller
Some controllers store binding information, stick calibration, and limited telemetry cache.
Mobile Device
Control app databases, cached flight records, synced media, account credentials, and GPS history.
Cloud Services
Synced flight records, uploaded media, account information, drone registration data.
Battery
Smart batteries store charge cycles, voltage history, cell health, and sometimes timestamps.
Flight Log Data
Flight logs are the most valuable forensic artifact, containing detailed records of every flight operation.
Flight Log Contents
| Data Category | Specific Data Points | Forensic Value |
|---|---|---|
| Position Data | Latitude, Longitude, Altitude (GPS & barometric), Home point coordinates | Flight path reconstruction, location verification |
| Time Data | UTC timestamp, local time, flight duration, sample intervals | Timeline establishment, correlation with other evidence |
| Flight Dynamics | Pitch, roll, yaw angles, velocity (3D), acceleration | Crash analysis, maneuver reconstruction |
| Control Inputs | Stick positions, flight mode, autonomous commands | Operator intent, control authority |
| System Status | Battery voltage, motor RPM, signal strength, GPS satellites | System health, failure analysis |
| Gimbal/Camera | Gimbal angles, photo/video triggers, camera settings | What was being captured, targeting analysis |
Flight Log Structure Example
DJI drones typically log data at 10 Hz (10 samples per second) for position data and up to 200 Hz for IMU data. A 10-minute flight generates approximately 6,000+ GPS data points and 120,000+ IMU samples.
GPS and Location Data
GPS data is crucial for establishing where the drone flew and when.
GPS Data Elements
- Latitude/Longitude: Position in decimal degrees (e.g., 19.076090, 72.877426)
- Altitude: Height above sea level (GPS) or above takeoff point (relative)
- Number of Satellites: Quality indicator (more satellites = better accuracy)
- HDOP/VDOP: Horizontal/Vertical Dilution of Precision (accuracy metrics)
- Speed: Ground speed calculated from position changes
- Heading: Direction of travel (0-360 degrees)
Home Point Data
The "home point" is particularly forensically significant:
- Recorded at takeoff - indicates launch location
- Can be manually updated during flight
- Used for Return-To-Home (RTH) function
- Often correlated with pilot location
Most drones use WGS84 coordinate system (same as Google Maps). Altitude may be recorded as MSL (Mean Sea Level), AGL (Above Ground Level), or relative to takeoff. Always verify which altitude reference is used in analysis.
Camera and Media Data
Captured photos and videos contain rich metadata valuable for forensic analysis.
Media File Metadata (EXIF/XMP)
| Metadata Type | Information | Forensic Application |
|---|---|---|
| GPS Coordinates | Latitude, longitude, altitude at capture | Exact capture location verification |
| Timestamp | Date and time of capture (may include timezone) | Timeline correlation |
| Camera Settings | ISO, aperture, shutter speed, white balance | Lighting conditions, intent analysis |
| Gimbal Data | Pitch, roll, yaw angles of camera | Direction camera was pointing |
| Flight Data | Drone speed, altitude, distance from home | Flight state at capture time |
| Device Info | Drone model, serial number, firmware version | Device identification |
Video SRT Subtitle Files
Many DJI drones generate SRT files alongside videos containing telemetry overlays:
SD cards should be forensically imaged and analyzed for deleted files. Drones often cache thumbnails in internal memory even when original files are deleted from SD card. Check for .THM (thumbnail) and .LRF (low-resolution file) files.
SD Card Analysis
The SD card is typically the primary storage medium for drones and requires careful forensic handling.
Typical DJI SD Card Structure
SD Card Forensic Considerations
- File System: Typically FAT32 or exFAT depending on card size
- Deleted Files: Recoverable unless overwritten; use forensic recovery tools
- Fragmentation: Large video files may be fragmented
- Timestamps: File system timestamps may differ from EXIF timestamps
- Hidden Files: Check for system/hidden directories
- Card Capacity: Note if card was near full (may have caused recording issues)
Controller Data
Remote controllers contain limited but useful forensic data.
Data Stored in Controllers
- Binding Information: Paired drone serial numbers
- Stick Calibration: Personalized control settings
- Firmware Version: Controller software version
- Display Cache: Controllers with screens may cache video frames
- WiFi History: Some controllers store network connection history
DJI Smart Controller
DJI Smart Controllers run Android and contain significantly more data:
- Full Android file system with DJI app data
- Cached flight records and media
- Google account sync data (if signed in)
- WiFi connection history
- App installation and usage data
Standard controllers may require specialized hardware interfaces for data extraction. Smart Controllers can often be accessed via ADB (Android Debug Bridge) if enabled, or through mobile forensic tools.
Mobile App Data
The mobile device running the control app is often the richest source of forensic data.
DJI App Data Locations
Key Mobile App Artifacts
| Artifact | Location | Contents |
|---|---|---|
| Flight Records | FlightRecord/*.txt | Encrypted/encoded complete flight data |
| Account Data | databases/dji_fly.db | User account, registered drones |
| Cached Media | cache/, files/ | Downloaded or cached photos/videos |
| Map Cache | map_cache/ | Downloaded map tiles (shows areas of interest) |
| Preferences | shared_prefs/*.xml | Settings, last used drone, feature flags |
iOS devices store DJI app data in the app sandbox (requires physical extraction or backup analysis). Android devices may have data on both internal storage and SD card. Both require appropriate legal authorization for extraction.
Cloud Data
DJI and other manufacturers maintain cloud services that sync flight data and media.
DJI Cloud Services
- DJI Account: User profile, registered drones, purchase history
- Flight Sync: Automatic upload of flight records (if enabled)
- Media Sync: Photos and videos synced to DJI cloud storage
- FlightHub: Enterprise fleet management with detailed logs
- Geofencing Data: No-fly zone unlock requests and history
Obtaining Cloud Data
Cloud data from DJI requires legal process (typically through MLAT for data held in China or other jurisdictions). For investigations, document the DJI account email and prepare appropriate international legal assistance requests. Some data may be accessible through the user's account login with proper authorization.
- Drone data exists in six main locations: drone internal memory, SD cards, controller, mobile device, cloud, and smart batteries
- Flight logs contain detailed telemetry at 10+ Hz including GPS, attitude, control inputs, and system status
- GPS data includes position, altitude, satellite count, and home point - critical for path reconstruction
- Media files contain EXIF/XMP metadata with GPS coordinates, timestamps, camera settings, and gimbal angles
- SD cards have structured directories; always check for deleted files and cache data
- Mobile apps (DJI Fly/GO) store rich forensic data including encrypted flight records, account info, and cached media
- Cloud data may require international legal cooperation but contains synced flights and media