Drone Forensics
Drone forensics is the recovery and interpretation of data from Unmanned Systems (UxS): what the platform, controller, mobile app and cloud account can reveal about the system, and how much confidence to place in each source.
Practical guides, tools and original research for investigators, analysts and operators.
Start with what you need
How drone forensics works
The five stages of an examination, from acquisition to report, and where each one can go wrong.
Read the guide
What a drone holds
Flight logs, media, settings, radio frequencies and pairing records: what each part of the system stores and what it tells you.
See the data sources
Tools to get started
21 open-source projects for log parsing, telemetry, firmware and mapping. Each lists its license and last activity.
Browse the tools
Drone exploitation
Field-level drone analysis for rapid decision making, and how it differs from forensic examination.
Learn the differenceThe process at a glance
Every examination, in a lab or at the point of recovery, moves through the same five stages.
Acquire
Obtain data from each source without altering it
Preserve
Hash, document and secure the originals
Extract
Decode formats; recover logs, media, settings
Interpret
Build timelines, place events, weigh confidence
Report
State findings, method and their limits
Resource
Open-source tools for drone forensics
Not every agency, lab or university has purpose-built tooling on day one. We track 21 community projects, from DJI log parsers to firmware tools, and check each one against GitHub so you can see what is still maintained.
Research
Original research is on the way
We are preparing original technical research on drone forensics and exploitation. Tell us which questions you would like answered first.
Quick answers
Is drone forensics the same as drone exploitation?
They share methods and data but differ in purpose. Forensics aims at a defensible, repeatable account, often for evidence. Exploitation aims at timely understanding for operational decisions. Read the difference.
What data can be recovered from a drone?
Commonly recovered data includes flight and telemetry records, media with associated metadata, configuration settings, controller and application data, and device identifiers. The exact information available depends on the platform, firmware version and condition of the system. See the data sources.
Can drone data identify the operator?
It can provide leads, such as launch locations, connected devices and account links. Those are indicators that need corroboration, not identification on their own.
Does the aircraft have to be intact?
Not always, but damage can limit what is recoverable. Data may also exist on the controller, phone or cloud account even when the aircraft is lost.
Help keep this useful
Know a tool we should list, a topic we should cover or something we got wrong? Tell us.