Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3

UNMANNED AERIAL VEHICLE FORENSIC INVESTIGATION PROCESS: DJI PHANTOM 3 DRONE AS A CASE STUDY1 Alan Roder [email protected] Kim-Kwang Raymond Choo Department of Information Systems and Cyber Security, University of Texas at San Antonio, TX 78258, USA [email protected] Nhien-An Le-Khac School of Computer Science, University College Dublin, Ireland [email protected] ABSTRACT Drones (also known as Unmanned Aerial Vehicles – UAVs) is a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be used to guide a drone forensic investigation using the DJI Phantom 3 drone as a case study. Keywords: Drone forensics, UAV forensics, forensic challenges, forensic guideline, forensic case study successfully, remotely and accurately control a 1. INTRODUCTION UAV. Drones, also referred to as Unmanned Aerial In recent years, UAVs have been increasingly Vehicles (UAVs) in the literature, can be loosely popular among consumers and the research defined as an aircraft piloted by remote control or an community. For example, the global market revenue on-board computer. There are a wide range of for drones is expected to surpass $11.2 billion by the UAVs, in terms of capabilities and prices. Such year 2020, according to a report from Gartner [1]. UAVs are also designed for use in different With so many drones purchased for home and environments, such as security, disaster response personal use, the potential for drones to be involved (e.g. rescue missions), mapping and adversarial in a digital (forensic) investigation will undoubtedly settings (e.g. battlefields). increase. For example, it was posited that UAVs can be considered as part of the broader vulnerabilities in driverless vehicles may be Unmanned Aerial System (UAS), which exploited by criminals, particularly terrorists, to encompasses UAV, Ground Control Station (GCS) and Controller. These parts are necessary to 1 Certain commercial entities, equipment, or materials may be identified in this paper in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the authors or their institutions, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. 1 facilitate criminal or terrorist attacks in the physical UAV forensic and security examinations have been world [2]. The same can be said for drones [7]. undertaken by UAV enthusiasts and the fan communities. For example, a number of them have UAV forensics is relatively less studied, in created their own (often freely available) software, comparison to other popular consumer devices and which can interpret the data files stored on the technologies such as mobile devices (e.g. Android, UAVs. One such example is DatCon, a tool designed iOS, and Windows Phones), cloud computing, edge to interpret .DAT files specifically from DJI UAVs computing and fog computing [25]. [9]. While these tools are a valuable pool of In 2015, Kovar [3] highlighted the essential elements knowledge, such tools are unlikely to have been akin to UAV forensics, and detailed the process of validated according to forensic requirements. In obtaining data from the popular DJI Phantom 2. A other words, these tools are unlikely to be year later in 2016, Kovar, Dominguez and Murphy forensically sound and artefacts obtained from using [4] extended the prior work in [3] to include a such tools may be inadmissible in a court of law. forensic examination of DJI Phantom 3. Along a Thus, there is a need for forensic validation work to similar line, Horsman [5] conducted a forensic be undertaken by the digital forensic community. investigation of Parrot Bebop UAV, and Clark et al. In addition to the diversity / variation in UAV [8] presented their findings of a Phantom 3 UAV products, it is understandable that the existing forensic examination. forensic examination guidelines may not be On the other hand, more than a decade ago in 2007, appropriate or sufficient. For instance, the ACPO the Association of Chief Police Officers (ACPO) principles for obtaining digital evidence [10] and published 'The ACPO principles for obtaining NIST Guidelines for mobile phone forensics [11] digital evidence' [10]. In the same year, the National were both published in 2007, and these guidelines Institute for Science and Technology (NIST) may not have kept pace with technological advances. published the 'Guidelines on Mobile Device In the context of UAVs or UAS, for example, data Forensics' [11]. Existing UAV forensic approaches can be stored in several locations, such as the UAV, are generally based on ACPO and NIST guidelines GCS, network routers, and so on. Storage locations (or their variations). This is not surprising as there is can also be overt or covert, and one also needs to no published guideline designed for UAV forensics. note that in some instances, there are in-built Hence, in this research, we review existing (UAV) persistent storage media such as Micro SD cards forensic literature and potential data storage [12]. There is also the likelihood of the recovery of locations. In our review, we highlight the limitations artefacts from flash storage, which typically requires in existing guidelines, and the need for a guideline some form of direct connection [24]. We would also dedicated to UAV forensics. Thus, we propose in have to take into consideration the likelihood that a this paper a forensic process focused on UAV UAV used in a criminal activity has been modified investigations. This process is designed to guide the to either hinder forensic investigation or enhance investigation process when examining UAVs. certain features such as increased load carrying We then evaluate the proposed process using a drone capacity (e.g. in drug smuggling activities across as a case study, and specifically a DJI Phantom 3 borders, or act as an improvised explosive device). drone. As previously discussed, there are a number of The rest of this paper is structured as follows. In the existing digital forensic guidelines. When the ACPO next section, we discuss UAV forensic challenges principles [10] were created, it was an attempt to and briefly review existing forensic guidelines in the standardize what was then a relatively new field of context of UAV forensics. We present our UAV forensic study. The four ACPO principles were forensic process in Section 3, and the case study in generalized so that they are technologically neutral. Section 4. We conclude and discuss future work in However, it is important to note the key concept Section 5. underpinning these principles is to ensure the integrity of the original data. This clearly applies to 2. UAV FORENSIC CHALLENGES UAV and any forms of digital forensics. 2 There are also similarities between UAV and mobile At the time of this research, popular commercial device forensics [26]. For example, similar to a UAVs provide OS via flash storage or Micro SD mobile device, a modern or advanced GCS is likely card, with a separate Micro SD card for video to have Wi-Fi, Bluetooth or Internet connection. footage. This flexibility allows the base UAV cost to Therefore, there is a possibility that the device could remain low, whilst allowing upgrades to storage at be remotely wiped or modified. UAV forensics can the owner’s expense. Since there is demand for also involve conventional storage media forensics UAVs to remain in flight for longer periods of time, [24] (e.g. memory cards are copied) and live and to provide increased 4K support for video forensics (e.g. real-time access to a live UAV to capture, the likelihood that flash storage will become view data stored on flash memory). Since most an option (similar to Apples graded internal storage UAVs do not have a graphical user interface (GUI) pricing) becomes more likely. or inbuilt interface, there is a real-risk that data may A more significant variance between UAVs and have been changed without the knowledge of the mobile devices is the inherent adaptability and forensic examiner / investigator. Thus, consideration modular nature of UAVs. UAVs can store data in must be given at this level of examination, and while different locations such as the UAV, GCS, and other deciding the order of investigation one needs to mobile devices used to connect/pilot the UAVs. minimize any potential for data modification. Since Flight log data is often stored in a single location; checking of UAV flash memory requires a live however, media files are often found in multiple interaction, it is unlikely that any two examinations locations, usually in different resolutions. will achieve the same result. Investigation on the data obtained from mobile Whilst existing literature is useful to guide a general devices, laptops and personal computers usually forensic investigation of a UAV, having a UAV incorporate elements of registration information, focused / specific forensic process could be more such as email addresses, usernames and payment useful to forensic examiners / investigators (e.g. to plans. Since UAVs traditionally do not require maintain consistency across cases). registration or payment plans [13], this further dilutes the association between the device and the 4. PROPOSED UAV FORENSIC operator. INVESTIGATION PROCESS In this section, we first determine if there are any 4.2 Proposed process differences between digital storage locations, when compared to traditional computer/mobile forensics.

Load more