Unmanned Aerial Vehicle Forensic Investigation Process: DJI Phantom 3 Drone As a Case Study

2018 Annual ADFSL Conference on Digital Forensics, Security and Law Proceedings May 17th, 10:40 AM - 11:15 AM Unmanned Aerial Vehicle Forensic Investigation Process: DJI Phantom 3 Drone As a Case Study Alan Roder [email protected] Kim-Kwang Raymond Choo University of Texas at San Antonio, [email protected] Nhien-A Le-Khac University College Dublin, Ireland, [email protected] Follow this and additional works at: https://commons.erau.edu/adfsl Part of the Aviation Safety and Security Commons, Computer Law Commons, Defense and Security Studies Commons, Forensic Science and Technology Commons, Information Security Commons, National Security Law Commons, OS and Networks Commons, Other Computer Sciences Commons, and the Social Control, Law, Crime, and Deviance Commons Scholarly Commons Citation Roder, Alan; Choo, Kim-Kwang Raymond; and Le-Khac, Nhien-A, "Unmanned Aerial Vehicle Forensic Investigation Process: DJI Phantom 3 Drone As a Case Study" (2018). Annual ADFSL Conference on Digital Forensics, Security and Law. 1. https://commons.erau.edu/adfsl/2018/presentations/1 This Peer Reviewed Paper is brought to you for free and open access by the Conferences at Scholarly Commons. It has been accepted for inclusion in Annual ADFSL Conference on Digital Forensics, Security and Law by an (c)ADFSL authorized administrator of Scholarly Commons. For more information, please contact [email protected]. Unmanned Aerial Vehicle Forensic ... CDFSL Proceedings 2018 UNMANNED AERIAL VEHICLE FORENSIC INVESTIGATION PROCESS: DJI PHANTOM 3 DRONE AS A CASE STUDY1 Alan Roder [email protected] Kim-Kwang Raymond Choo Department of Information Systems and Cyber Security, University of Texas at San Antonio, TX 78258, USA [email protected] Nhien-An Le-Khac School of Computer Science, University College Dublin, Ireland [email protected] ABSTRACT Drones (also known as 'Unmanned Aerial Vehicles' - UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV / drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV / drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV / drone forensic investigations. Next, we present our set of guidelines for UAV / drone investigations. Finally, we demonstrate how the proposed guidelines can be used to guide a drone forensic investigation using the DJI Phantom 3 drone as a case study. Keywords: Drone forensics, UAV forensics, forensic challenges, forensic guideline, forensic case study 1. INTRODUCTION prices. Such U AVs are also designed for use in different environments, such as security, Drones, also referred to as 'Unmanned Aerial disaster response ( e.g. rescue missions) , Vehicles' (UAVs) in the literature, can be mapping, and adversarial settings ( e.g. loosely defined as an aircraft piloted by remote battlefields). control or an on-board computer. There are a wide range of UAVs, in terms of capabilities and 1 Certain commercial entities, equipment, or materials may be identified in this paper in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the authors or their institutions, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. @ 2018 ADFSL Page 55 CDFSL Proceedings 2018 Unmanned Aerial Vehicle Forensic ... U AV s can be considered as part of the Technology (NIST) published the 'Guidelines broader Unmanned Aerial System (UAS), which on Mobile Device Forensics [11] '; Existing UAV encompasses UAV, Ground Control Station forensic approaches are generally based on (GCS) and Controller. These parts are ACPO and NIST guidelines ( or their variations). necessary to successfully, remotely and This is not surprising, as there is no published accurately control a UAV. guideline designed for UAV forensics. In recent years, UAVs have been Hence, in this research, we review existing increasingly popular among consumers and the (U AV) forensic literature and potential data research community. For example, the global storage locations. In our review, we highlight market revenue for drones is expected to surpass the limitations in existing guidelines, and the $11.2 billion by the year 2020, according to a need for a guideline dedicated to U AV forensics. report from Gartner [1]. With so many drones Thus, we propose in this paper a forensic process purchased for home and personal use, the focused on U AV investigations. This process is potential for drones to be involved in a digital designed to guide the investigation process when (forensic) investigation will undoubtedly examining U AV s. increase. For example, it was posited that We then evaluate the proposed process vulnerabilities in driverless vehicles may be using a drone as a case study, and specifically a exploited by criminals, particularly terrorists, to DJI Phantom 3 drone. facilitate criminal or terrorist attacks in the physical world [2]. The same can be said for The rest of this paper is structured as drones [7] . follows: in the next section, we discuss U AV forensic challenges and briefly review existing U AV forensics is relatively less studied, in forensic guidelines in the context of U AV comparison to other popular consumer devices forensics. We present our U AV forensic process and technologies such as mobile devices ( e.g. in Section 3, and the case study in Section 4. Android, iOS, and Windows Phones) , cloud We conclude and discuss future work in Section computing, edge computing, and fog computing 5. [25]. In 2015, Kovar [3] highlighted the essential 2. UAV FORENSIC elements akin to U AV forensics and detailed the CHALLENGES process of obtaining data from the popular DJI U AV forensic and security examinations have Phantom 2. A year later in 2016, Kovar, been undertaken by U AV enthusiasts and the Dominguez and Murphy [4] extended the prior fan communities. For example, a number of work in [3] to include a forensic examination of them have created their own ( often freely a DJI Phantom 3. Along a similar line, Horsman available) software, which can interpret the [5] conducted a forensic investigation of Parrot data files stored on the U AVs. One such Bebop UAV, and Clark et al. [8] presented their example is DatCon, a tool designed to interpret findings of a Phantom 3 U AV forensic .DAT files specifically from DJI UAVs [9]. examination. While these tools are a valuable pool of On the other hand, more than a decade ago knowledge, such tools are unlikely to have been in 2007, the Association of Chief Police Officers validated according to forensic requirements. In (ACPO) published 'The ACPO principles for other words, these tools are unlikely to be obtaining digital evidence [10] .' In the same forensically sound and artifacts obtained from year, the National Institute for Science and using such tools may be inadmissible in a court Page 56 @ 2018 ADFSL Unmanned Aerial Vehicle Forensic ... CDFSL Proceedings 2018 of law. Thus, there is a need for forensic advanced GCS is likely to have Wi-Fi, validation work to be undertaken by the digital Bluetooth, or Internet connection. Therefore, forensic community. there is a possibility that the device could be remotely wiped or modified. UAV forensics can In addition to the diversity / variation in also involve conventional storage media UAV products, it is understandable that the forensics [24] (e.g. memory cards are copied) and existing forensic examination guidelines may live forensics (e.g. real-time access to a live UAV not be appropriate or sufficient. For instance, to view data stored on flash memory). Since the ACPO principles for obtaining digital most U AVs do not have a graphical user evidence [10] and NIST Guidelines for mobile interface (GUI) or inbuilt interface, there is a phone forensics [11] were both published in real-risk that data may have been changed 2007, and these guidelines may not have kept without the knowledge of the forensic pace with technological advances. examiner / investigator. Thus, consideration In the context of UAVs or UAS, for must be given at this level of examination, and example, data can be stored in several locations, while deciding the order of investigation one such as the UAV, GCS, network routers, and so needs to minimise any potential for data on. Storage locations can also be overt or covert, modification. Since checking of U AV flash and one also needs to note that in some memory requires a live interaction, it is unlikely instances, there are in-built persistent storage that any two examinations will achieve the same media such as Micro SD cards [12]. There is also result. the likelihood of the recovery of artifacts from Whilst existing literature is useful to guide flash storage, which typically require some form a general forensic investigation of a UAV, of direct connection [24]. We would also have to having a UAV focused/ specific forensic process take into consideration the likelihood that a could be more useful to forensic U AV used in a criminal activity has been examiners/ investigators (e.g. to maintain modified to either hinder forensic investigation consistency across cases). or enhance certain features such as increased load carrying capacity (e.g. in drug smuggling 3. PROPOSED UAV activities across borders, or act as an improvised FORENSIC explosive device). INVESTIGATION As previously discussed, there are a number of existing digital forensic guidelines. When the PROCESS ACPO principles [10] were created, it was an In this section, we first determine if there are attempt to standardise what was then a any differences between digital storage relatively new field of forensic study. The four locations, when compared to traditional ACPO principles were generalised so that they computer/ mobile forensics.

Load more