Advanced Drone Forensic Analysis (ADFA)

This module introduces the fundamentals of Uncrewed Vehicle (UxV) forensics with a focus on small Uncrewed Aircraft Systems (sUAS). Students are introduced to common UxV platforms and manufacturers, examining how ecosystem differences across DJI, ArduPilot, PX4, and FPV systems influence data storage, logging behavior, and forensic acquisition strategies.

The module addresses key handling considerations and common obfuscation or anti-forensic techniques encountered in UxV investigations, followed by an overview of core UAV forensic artifacts, including flight logs, telemetry, configuration data, and controller-side records. This module establishes the baseline knowledge required for subsequent hands-on UxV forensic analysis.

This module introduces the core components and control architectures of small Uncrewed Aircraft Systems (sUAS), examining how different controller types—including mobile device–based controllers, integrated display systems, bespoke flight controllers, and FPV controllers—impact command execution and forensic data generation across DJI, ArduPilot, PX4, and FPV ecosystems.

Students are introduced to autonomous flight concepts such as Return-to-Home, pre-planned missions, and error or failsafe initiation, with an emphasis on how these features are implemented and recorded within flight logs, telemetry, and controller artifacts. The module provides foundational knowledge for interpreting operator intent, system behaviour, and recorded events during sUAS forensic investigations.

This module addresses the responsibilities of first responders when encountering small Uncrewed Aircraft Systems (sUAS), focusing on evidence preservation, safe handling, and preparation for transport. Students are introduced to controlled disassembly techniques and best practices to minimize data loss and contamination.

The module provides an overview of data extraction methods from the aircraft, associated mobile or tablet devices, and remote controllers, including the use of vendor and forensic tools such as Disero – CFID. Students are also introduced to advanced acquisition techniques, including FTP-based data extraction and ADB bridging to access exposed communications ports. This module establishes procedural and technical foundations for reliable sUAS evidence collection.

This module introduces techniques for reviewing sUAS evidence using open-source and commercial forensic tools, with an emphasis on structured workflows and defensible analysis. Students examine UAV-resident data, focusing on file system considerations, registered user information, aircraft identifiers, configuration data, and flight log analysis techniques used to reconstruct operational activity.

The module explores the interpretation of data stored on flash media devices, including examination of media folder structures, EXIF metadata associated with images, and embedded telemetry and metadata inserted into graphics and video files by manufacturers such as DJI. Emphasis is placed on understanding how flight, location, and sensor data are persistently embedded within media artifacts.

The module concludes with analysis of data from portable devices used to control sUAS, covering default Android and iOS application folder structures, synchronized versus local logs, error log analysis, and media file examination for geolocation and temporal context. Students are introduced to workflows for correlating offline artifacts across aircraft, controllers, and mobile devices to support comprehensive forensic reconstruction.

This module introduces advanced workflows for the forensic examination of sUAS data, focusing on the correlation, normalization, and visualization of complex datasets. Students learn techniques for simplifying and graphically representing flight and telemetry data to support timeline construction and investigative interpretation.

The module covers CFID and Disero data analysis, including the review of decrypted flight logs using both vendor and third-party external viewers. Students apply geospatial analysis techniques using tools such as Google Earth to visualize flight paths, events, and environmental context. The module concludes with ecosystem-specific examination approaches for PixHawk and PX4 platforms, as well as Betaflight-based FPV systems, preparing students to analyze diverse sUAS data sources using consistent, defensible workflows.

This module introduces best practices for documenting sUAS and UxV forensic investigations. Students review report structure, content considerations, and professional presentation, with examples of clear and defensible investigative reporting. The module also provides a glossary of key terms to standardize terminology and support consistent communication of technical findings across UAV ecosystems, including DJI, ArduPilot, PX4, and FPV platforms.