Accessing different data storage mediums.

Accessing Different Data Storage Mediums

Multiple devices/evidence sources present significant opportunities to investigators who, if required to do so, may have the opportunity to access vast volumes of rich data about an owner or user’s usage of a device from multiple data storage sources. Our research has demonstrated that the storage and retention of data change dramatically depending on the manufacturer and specification of the UAV in question. This can range from very little, if any, digital recovery opportunities available from low-end recreational devices, right up to vast volumes of complex data that can be accessed from commercial and bespoke UAV configurations.

In addition to varying volumes of data, the location of data can also vary significantly depending on the specifications of the device, and the chosen configuration of the user. It is therefore crucial when considering data from UAVs that the principle of Digital Profiling is adopted to review: the wider technical profile and digital competency of the user, the specification of the UAV in question, any payloads in use, and the flight control configuration in place for the specific UAV. Once each of these factors has been considered, then an informed assessment can be made as to where the relevant data relating to an enquiry may be retained.

There are several locations that data may reside during an investigation. These include:

a) On-board Data Storage

Some UAV devices will store and retain information within memory and processors built into the UAV frame or flight controller. Depending on the specifications of the UAV and its associated ports, the method of extracting this data may vary from relatively simple methods such as ‘plug and play’, to advanced destructive forensics techniques such as ‘chip off’.

b) Removable Storage Devices

Given the size of the associated files, most UAVs designed to capture high resolution images and video will offer the capability to integrate a removable storage device. Given micro SD cards are now available with up to 2 TB in storage, this range offers the most value and capacity while taking up little space, and is the leading data storage solution in UAVs. It should be taken into consideration that while the primary purpose of external storage may be to retain multimedia files, other types of data may also be available on the device.

c) Mobile Devices and Applications

Many UAVs offer the ability to fully or partially control the device or payload via a web connection or native application on a smart device. This should not be overlooked as a potential source of UAV data. When conducting digital profiling, consider which applications the subject has on their mobile device, and what the presence of a UAV-related application may offer to the investigation.

d) Remote Controllers

Most drones require a specific remote controller. This remote controller may hold residual data that may assist in helping identify the drone it is paired with, as well as any phones or tablets used to view the drone’s footage.

e) Ground Stations

Control systems that have a ground link for route planning, FPV, or visual monitoring can also record their data or live footage onto a local storage device such as a computer hard drive. Access to this rich data can be obtained through the use of integrated software to view the data in its intended source or, if this is not available, through computer triage or traditional digital forensic techniques.

f) Cloud-Based Data Platforms

The continual commoditisation of and increased access to cloud-based storage means that it cannot be overlooked as a potential source of UAV data. Cloud data could be intended by the user to reduce local storage demand, or a by-product of a UAV cloud-hosted platform which retains data on behalf of its customers.