Topic outline

  • UAV (Drone) Forensics

    This three-day advanced level course will equip you with the practical skills and competencies required to identify and extract various sources of data recoverable from Unmanned Aircraft Systems (UAS), also known as Drones, including their associated control devices in line with approved best practices.

    Course Details

    Synopsis

    This three-day advanced level course will equip you with the practical skills and competencies required to identify and extract various sources of data recoverable from Unmanned Aircraft Systems (UAS), also known as Drones, including their associated control devices in line with approved best practices.

    Using leading research and development from Spyder Forensics, this course will introduce you to the world of UAV’s and instruct you how to fly a Drone followed by best practices in conducting forensically sound extractions and analysis of UAS data for use as evidence or intelligence gathering. Attendees will learn how to collect data from within the aircraft using non-destructive processes utilizing industry-standard tools to create forensic collections of storage media that include flight logs, aircraft data, photo, and video files without the need to disassemble the aircraft or controller. Students will then learn procedures in the acquisition of application data found on the mobile device.

    Once data has been acquired, attendees will master how to analyze the flight logs and user data using software originally designed to work with these types of structures, gaining knowledge on workflows to connect data between the drone application and the flight data recovered from the aircraft.

    This course uses non-destructive processes to extract and analyze the data from all hardware in the UAS including the handheld device, mobile application, and drone. All software used in class can be used in the DFIR lab free of charge and without the need to purchase additional applications to conduct a Drone examination.

    Primary Learning Objectives

    Become proficient in the extraction of UAV controller data from mobile devices and UAV’s using industry recognized forensic software.

    Recognize types of data available from drones, their linked devices and thirdparty sources.

    Conduct forensic extractions of data from the leading drone devices, analyze extracted data effectively to produce reports fit for use in criminal justice proceedings.

    Course Modules

    • 1
      2
      3
      4
      5
      6
      7
      8
      9
    • Introduction to UAV Forensics

      In This Module You Will:

      •Introduction to sUAS
      •Criminal use of UAV’s
      •Manufacturers variables
      •Attack vectors – risks to public safety
      •Capacity and Capability of drones
      •Health and Safety – Handling and seizure
      •Health and Safety – LiPo Batteries
      •Linked devices – controller considerations
      •Digital vs. Physical Evidence
      •Packaging/Storage and continuity
      •Understanding of how flight logs are created and updated
      Aircraft power on flowchart.
      • Components of sUAS

        In This Module You Will:

        •Components and features of small unmanned aircraft systems (sUAS)
        •Controller options
        Mobile and Tablet Devices
        Bespoke flight controllers
        FPV controllers
        •Autonomous flights
        Return-to-home feature
        WiFi controls
        Signal interception.
        • Learning to Fly

          In This Module You Will:

          •Unpack ‘your’ aircraft
          •Recognizing components within the box
          •Basic instruction on flying the drone
          •Practical exercises in flying your Drone
          Collection techniques.
          • Extraction techniques

            In This Module You Will:

            •Extraction of data from the aircraft
            •Extraction of data from mobile \ tablet device
            •Extraction of controller data
            •Disassembling techniques
            Arguments for and against.
            • Interpretation of data

              In This Module You Will:

              •Techniques in using opensource and commercial forensic tools to review the evidence
              •Interpretation of data contained on the UAV
              File System considerations
              Registered user information
              Aircraft details
              Flight log analysis techniques
              •Interpretation of data from portable devices
              Default folder structures of the controlling app from an Android and iOS device
              Synchronized logs vs. local logs
              Error log analysis
              Media file examination (geolocations and dates & times)
              Workflows in combining offline files for further analysis
              •Techniques in the interpretation additional data on other devices.
              • Advanced Analysis Techniques

                In This Module You Will:

                •Flight recorder “Black box”
                •Advanced examination workflows
                •Additional App and Controller considerations
                •Linking hardware devices within the sUAS
                •Simplification of data – graphical representation
                •Mapping of flight paths.
                • Presentation of Evidence capable of acceptance in court

                  In This Module You Will:

                  •Discussion on courtroom preparation and presentation
                  • Report Writing

                    In This Module You Will:

                    •Glossary of terms
                    •Overview of UAV report considerations
                    •Report writing practical
                    • Final Assessment

                      In This Module You Will:

                      •Student knowledge assessment.