How to Extract Forensic Data from Drones

08 June 2018
Drones used for criminal activities can be used to trace them back to source of the crime. Source: NIST

Beyond just entertainment, drones are being billed as the next big thing in last-mile deliveries. However, beyond these modern positive uses to both commercial and entertainment industries, the dark side of drones is still growing with drones being used for transporting drugs, cell phones and other contraband over prison walls or used by drug traffickers to ferry narcotics across the border.

When these drones are captured, investigators try to extract data that might point them to a suspect but with numerous types of drones from a variety of vendors it makes the process tricky.

Researchers at the National Institute of Standards and Technology (NIST) have developed a method to record a forensic image of the drone and maintain a repository of images made from PCs, smartphones, tablets, hard drives and other storage media. The images contain simulated digital evidence and are available to download for free. Forensic experts can find inside NIST’s Computer Forensic Reference Datasets (CFReDS) images of 14 popular makes and models of drones with the number expected to increase to 30 by the end of this year.

Researchers test extracting vital information from drones. Source: NISTResearchers test extracting vital information from drones. Source: NIST"The drone images will allow investigators to do a dry run before working on high-profile cases," said Barbara Guttman, manager of digital forensic research at NIST. "You don't want to practice on evidence."

The drone images were created by VTO Labs, a digital forensic and cybersecurity firm, and added to the web site because it is the fastest way to get them into the field, NIST said.

The images are being used not just to combat drug smuggling but also to allow officials to respond more quickly should a drone ever be used as a weapon inside the U.S.

Steve Watson, chief technology officer at VTO, purchased three drones and flew them to accumulate a baseline of data and then extracted data from one while leaving it intact. He disassembled a second and extracted data from its circuit board and onboard camera. With the third, he removed all the chips and extracted data from it directly.

Watson was able to retrieve serial numbers, flight paths, launch and landing locations, photos and videos. On one model, he found a database that stores a user's credit card information.

Forensic investigators can use the images to practice recovering data, including deleted files while universities and forensic labs can use them for training, testing and research, NIST said.

To contact the author of this article, email

Powered by CR4, the Engineering Community

Discussion – 0 comments

By posting a comment you confirm that you have read and accept our Posting Rules and Terms of Use.
Engineering Newsletter Signup
Get the GlobalSpec
Stay up to date on:
Features the top stories, latest news, charts, insights and more on the end-to-end electronics value chain.
Weekly Newsletter
Get news, research, and analysis
on the Electronics industry in your
inbox every week - for FREE
Sign up for our FREE eNewsletter
Find Free Electronics Datasheets