Component by component
Availability depends on the platform, the firmware version, the condition of the equipment and how the data was stored. Treat this as a map of where to look, not a promise about any particular model.
| Component | May hold | Helps answer | Watch for |
|---|---|---|---|
| Aircraft | Onboard flight logs and telemetry, photos and video with metadata, configuration, firmware version, component serial numbers, radio link settings (frequency band, channel). | Where it flew and when, what it recorded, which unit it is. | Proprietary or encrypted storage, physical damage, limited log retention, formats that change between firmware versions. |
| Remote controller | Pairing records, settings, local logs, sometimes cached flight data or maps. | Which controller flew which aircraft, and how the system was set up. | Many controllers are Android-based or embedded devices, so the access method varies widely. |
| Mobile device and app | App logs and flight records, cached maps and media, saved locations, account sign-in. | The pilot-side view of a flight, plus a link to an account or person. | Standard mobile-forensics constraints: lock state, encryption, app version. |
| Cloud account | Synced flight logs and media, registered devices, account details. | History beyond a single flight, and which aircraft belong to which account. | Access usually needs legal process, retention varies, and the data can change if the account is touched. |
Data types and what they show
Flight and telemetry
Position, altitude, speed, heading, battery and flight mode over time, where the platform logs them. The core of any timeline.
Photos, video and metadata
Media plus the time, location and camera settings embedded in it. Shows what the aircraft saw and roughly when.
Configuration and settings
Flight limits, camera and gimbal settings, return-to-home behavior. Shows how the system was set up, not why.
Pairing and connection records
Links between aircraft, controllers, phones and accounts. Radio link settings, such as frequency band and channel, show how the aircraft and controller talked to each other. Can tie separate items back to one system.
Identifiers and firmware
Serial numbers, firmware versions, component IDs. Needed to choose an extraction method and to read log formats correctly.
Account and cloud data
Sign-in details, synced history, registered devices. Often the widest view of activity over time.
What to secure first
These are general principles, not a procedure. Follow your organization's rules and the method for the specific platform.
- Prevent remote change. A powered, connected system can receive commands, updates or sync activity. Isolate it from networks and radio links in line with your procedures.
- Record the state before touching it. Photograph the equipment, note what is powered on, and record visible damage and connections.
- Collect the most volatile sources first. Powered-on phones and controllers, and cloud data that can change, come before storage that will stay put.
- Do not assume the aircraft is the only source. Even a lost or destroyed aircraft can leave a record on its controller, phone or account.
Reading the results
Recovered data is evidence of what a device recorded, and that is narrower than it sounds.
- Telemetry places the aircraft, not the pilot. Who was flying it needs other evidence.
- Timestamps depend on the clock. Check which clock produced each time and whether it was set correctly before combining sources.
- Metadata can be edited. Embedded media metadata is useful and also easy to change, so corroborate it.
- Configuration shows setup, not motive. Why it was set that way has to come from elsewhere.
- State the platform. Say which model and firmware a finding applies to. A method for one may not work on another.