[Technical Insights] Find Who's Behind Unsanctioned Flight of UAV

Date:06-07-2017

Severe Consequences Caused by Unsanctioned UAV Flight

 

Recent years have seen a marked shift of Unmanned Aerial Vehicle (UAV) from an expensive and professional production equipment to a consumer product.  And, along with this shift comes more unsanctioned flights which have major impacts on the safety of traditional aircrafts and human life. Unsanctioned flights of four UAVs occurred at Chengdu Shuangliu International Airport at the night of April 21st, for example, caused alternate landing of 58 flights at Xi’an, Chongqing, Guiyang, and Mianyang airports, 4 flight returns, and the stranding of more than 10,000 passsengers. Prior to this event, on the 14th, 17th, and 18th, unauthorized flights of UAV also disturbed the normal arrangement of Shuangliu airport when they caused alternate landing and delay of flights.



image.png

Picture 1: DJI UAV

 

Two File Formats of UAV Flight Records


Unsanctioned flights of UAV are causing severe consequences, and relevant digital foreniscs solutions can help investigators reveal truth and prevent similar accidents. SalvationDATA technical engineers, therefore, conducted in-depth analysis on UAV flight records based on DJI products.


image.png

Picture 2: Flight Records of DJI UAV

 

Technical engineers from SalvationDATA found that DJI products record flight data in two formats: .DAT file in UAVs and .txt file in cellphones/tablets controlling the drones.


image.png

Picture 3: Data Generated in Cellphones/Tablets during UAV Flights

 


Access of Android and iOS Systems to Flight Record Files

 

Both Android and iOS systems can search and access flight record files saved in cellphones and tablets controlling the drone.


For Android users, follow the following steps: connect the phone/tablet to a computer; find the file named ‘dji.pilot/DJI/FlightRecords’; and locate needed flight record files which are usually named ‘DJIFlightRecordxxxx-xx-xx[xx-xx-xx]’. If this file is opened directly by double-clicking, unreadable codes in picture 4 will be shown bacause of data encryption and website http://www.phantomhelp.com/LogViewer/Upload/ can be used to decode the file content.

 

image.png

Picture 4: Unreadable Codes While Opening a File Directly

 

For IOS users: connect the phone/tablet to a computer; use iTunes to export flight records; open iTunes-"File Sharing”-DJI GO App-, and check ‘Flight Records’. Flight data is also encrypted and can be decoded and accessed using the above-mentioned website, as in picture 5.


 

image.png

 

Picture 5: Accessing Flight Data Through the Website

 

SalvationDATA SPF(SmartPhone Forensic System): Cloud Synchronized Data Forensics Supported

 

1. Local Data Forensic

 

SalvationDATA SPF can extract and analyse flight record files saved in cellphones/tablets controlling UAVs. Run SPF, conduct data extraction and analysis of the connected cellphone directly, and data on the account, GPS location, local flight records, video, and WeChat moments will be extracted (picture 6).

 

image.png

Picture 6: UAV Data Extracted Using SPF

 

2. Forensics of Cloud Synchronized Data

 

When no local data is available, users can login DJI website to conduct Data Synchronism using their account and password, and data in picture 7 can be seen. Synchronized data of flights will be saved in the cellphone and then SalvationDATA SPF can be used to conduct data extraction and analysis forensics.


image.png

Picture 7: Comparison of Data after Data Synchronization

 

Besides its broad use in civil fields, UAV also has wide range of applications in military, aeronautic, astronautic and other fields, which indicates the importance of UAV related forensics as a vital prospect of digital forensics. SalvationDATA is dedicated to follow the trend of mainstream technology development and provide the best products and services customers need.

 

Since there’re massive UVA brands on the market, SalvationDATA R&D center will continue to design forensics procedures for products of other brands and models and share its responsibility, together with other digital data forensics, in enhancing and improving UVA forensic software.

 

Please click HERE to learn more about SPF.