Drones are complex digital systems. During a flight, numerous digital traces can be created on the drone itself, the remote control, storage media used, connected smartphones or tablets, as well as within manufacturer apps and user accounts.

LB Forensik's drone forensics services focus on the professional securing, analysis, and evaluation of this data. Depending on the manufacturer, model, system architecture, and specific case, flight logs, GPS and position data, telemetry information, sensor data, photo and video files, and information from connected mobile devices can be examined.

A reliable drone forensic investigation therefore does not consider the aircraft in isolation. The combination of the drone, remote control, smartphone, app, memory card, and other digital data sources can be crucial for reconstructing an incident.

In suitable cases, drone analysis can be combined with our mobile forensics . We also explain the fundamental requirements for the traceability of digital evidence in the article " Integrity of Digital Evidence".

What is drone forensics?

Drone forensics, or UAV forensics, is a specialized field of digital forensics. It involves the investigation of digital information that may have originated on a drone or in the technical systems connected to it.

Depending on the question, it is possible, for example, to investigate when a flight took place, what position or telemetry data is available, what image and video files were recorded, what devices were connected to the system, or whether a technical sequence of events before a crash can be reconstructed.

A professional investigation therefore does not begin with the most comprehensive data extraction possible, but with a specific question of proof:

What digital evidence can contribute to clarifying the drone incident in question?

Which data sources can be relevant in a drone investigation?

In a modern drone, relevant data is often distributed across multiple components. This is precisely why a system-wide analysis is often more informative than looking at a single device in isolation.

Drone and internal storage

The aircraft itself may contain internal storage areas, configuration information, system data, technical logs, or other digital artifacts.

The information that is actually stored depends on the specific manufacturer, model, and software version.

In a forensic investigation, it is therefore necessary to first clarify which storage areas are present and which of them may be relevant to the specific question.

Flight logs and flight reports

Flight logs are among the most important data sources for a drone forensic investigation.

Depending on the specific system, it may contain time information, positions, altitude values, speeds, system states, sensor values, warning messages or other flight-related information.

This data can help to place individual flight phases and technical events in chronological order.

However, it is crucial not to interpret the recorded values ​​in isolation. A single log entry only gains meaning when placed within the overall technical context.

GPS and position data

Suitable drone systems may have GPS or position information available.

This data can provide information about the starting point, flight path, intermediate positions, landing location, or other geographical reference points.

However, position information has a technical measurement accuracy and should not be understood as an absolutely exact location without further verification.

A reliable reconstruction therefore takes into account, where possible, several positional data points, their temporal sequence and other accompanying technical information.

Altitude, speed and movement data

Depending on the system, information about altitude, speed, direction of flight or movement states can be stored.

Such data can be particularly relevant in the event of crashes, collisions, disputed flight paths, or safety incidents.

The evaluation must take into account which sensor or system a value originates from and what its technical accuracy is.

Telemetry data

Telemetry data can contain technical information about the condition of a drone during flight.

Depending on the system, this may include battery status, position information, flight parameters, warning messages, connection status, or other technical values.

When reconstructing an incident, telemetry data can be evaluated together with flight logs, sensor data and media.

sensor data

Modern drones use various sensors for navigation, stabilization, and obstacle detection.

Depending on the specific system, sensor data or values ​​derived from sensor information may be stored in logs.

This information can be relevant, for example, in the technical reconstruction of unusual flight behavior or a crash event.

Photo and video data

Photo and video files are often key pieces of digital evidence.

In addition to the visible image content, metadata can also be analyzed. Depending on the file format and recording system, this may include, for example, the time of capture, camera information, file system information, or geographical metadata.

Such data can be correlated with flight logs and other sources.

Since metadata is inherently changeable, it should not be interpreted as the sole proof of location, time, or authorship without further examination.

memory Cards

Many drones store photo and video data on removable memory cards.

These storage media can contain not only visible files but also file system information, directory structures, or possibly remnants of deleted data.

In the event of potential evidence being used, a memory card should ideally not be reused, formatted, or rewritten.

Remote control and controller

Remote control can also represent an independent digital data source.

Modern controllers sometimes have their own operating systems, memory areas, displays, or integrated applications.

Depending on the system, technical information, configuration data, app data, or other flight-related artifacts may be present there.

Therefore, drones and remote controls should generally be considered as a single, integrated technical system.

Examine smartphone and drone together

Many drone systems use a smartphone or tablet for control, configuration, or display of flight information.

This means the mobile device itself can become an important source of forensic data.

Depending on the operating system, manufacturer's app and usage, app data, flight logs, user information, cache data, media, location information or other drone-related artifacts may be present there.

The joint investigation of drones and smartphones can be particularly useful when information from multiple systems needs to be compared.

Further information on the examination of mobile devices can be found under Mobile Forensics.

Manufacturer app and user account as evidence

Modern drone systems often consist of several interconnected technical components.

In addition to the aircraft and remote control, a manufacturer's app can play an important role.

Depending on the system, certain information may be stored locally on the smartphone or tablet and possibly also in a user account or online service.

This can result in a digital chain of evidence from multiple sources in complex cases:

• Drone
• remote control or controller
• memory card
• smart phone or tablet
• manufacturer app
• user account
• other available online or cloud data

These data sources should not automatically be considered identical. Different systems may contain different data states or timing information.

Reconstructing a drone's flight path

A common question is whether it is possible to trace where a drone has flown.

Whether a complete or partial flight route can be reconstructed depends on the data actually available.

With suitable systems, position information from flight logs can be combined with time data, altitude values, speeds and other telemetry data.

Additionally, photo and video data, information from the control app and data from a connected smartphone can be taken into account.

Therefore, a reconstruction should ideally be based on multiple data sources.

Investigate the take-off and landing site of a drone

Under certain conditions, position and time information can provide clues as to the departure or arrival locations of a flight.

However, a distinction must be made between stored GPS positions, home point information, and actually verifiable physical positions.

Therefore, a stored coordinate should always be evaluated within the technical context of the respective drone system.

Forensic investigation of drone crash

After a crash, the question may arise as to what caused the event.

A drone forensic investigation can analyze existing flight logs, telemetry information, alerts, sensor data, and other digital artifacts.

This allows, for example, verification of which technical conditions were documented immediately before the event.

However, digital data alone does not automatically answer every question about the cause of the crash.

In complex cases, additional physical damage, technical components, environmental conditions or other external factors may need to be taken into account.

Reconstruct collisions and damage events

In the event of a collision, time, position, altitude and motion data can provide additional information about the sequence of events.

Photos or videos may also contain relevant clues.

The task of digital forensics is to secure existing electronic information in a traceable manner and to classify it technically.

The final legal assessment of a damage event is to be distinguished from this.

Unauthorized use of a drone

Companies, authorities or private individuals may have questions about whether a drone was used without the appropriate authorization.

Digital traces can provide information about flight times, flight movements, user accounts, devices used, or technical system connections.

However, a single piece of technical information does not automatically prove the pilot's identity.

For a reliable attribution, additional data sources such as smartphones, user accounts, or other digital evidence may be required.

Drones in cases of suspected espionage and surveillance

Drones, due to their cameras and mobile deployment capabilities, can also become relevant in suspected cases involving unauthorized observation or information gathering.

A forensic investigation can evaluate existing flight, position, photo and video data, as well as other technical information.

A strict distinction must be made between technical findings and legal assessment.

The fact that a drone was in a certain position at a certain time does not automatically prove, for example, the purpose of the flight or the identity of the person responsible.

Photo and video analysis using drones

Photo and video files can contain additional digital information besides their visible content.

Depending on the file format, metadata may contain information about the recording time, camera used, file structure, or geographical information.

In a forensic investigation, such data can be compared with flight logs, app data, and other artifacts.

Since metadata is inherently changeable, it must always be evaluated in conjunction with other data sources.

Deleted data on drones and memory cards

If photo, video or other files have been deleted, it is possible to check whether data or file remnants are still present, depending on the storage medium and its further use.

However, a recovery cannot be guaranteed.

In particular, further use of the memory card can lead to previously deleted data being overwritten.

In the event of potential evidence being used, a storage medium should therefore not be reused, formatted, or rewritten if possible.

Forensic backup instead of simple data copying

Copying visible files from a memory card or drone does not automatically constitute forensic evidence preservation.

A professional investigation must document in a comprehensible manner which object was examined, which data source was secured, and which method was used for the backup.

Depending on the object of investigation, suitable technical procedures can be used to document secured data sets in a traceable manner.

Further information can be found under Integrity of Digital Evidence.

Digital chain of evidence for drones

Especially in drone forensic investigations, multiple devices and storage media can be relevant simultaneously.

Therefore, reliable documentation should record which components were adopted, when they were examined, and which data sources were actually evaluated.

This is particularly important when examining the drone, remote control, memory card and smartphone together.

Only when the source of information is clearly documented can it later be evaluated in a technically verifiable manner.

Our procedure for a drone forensic investigation

1. Define the research question

First, it is clarified which specific issue is to be investigated.

This could include, for example, a crash, a collision, unauthorized use, a specific flight path, or the evaluation of image and video data.

2. Identify objects of investigation

Next, the presence of certain components is checked.

Besides the drone itself, remote controls, memory cards, smartphones, tablets and other system components can be particularly relevant.

3. Prioritize data sources

Not every existing component needs to be automatically examined.

The crucial factor is which data source is expected to provide the greatest insight for the specific question of proof.

4. Back up digital data

Relevant data are secured using a method suitable for the respective object of investigation.

The individual examination steps are documented in a comprehensible manner.

5. Analyze flight and system data

The secured information will be examined with regard to the specific evidentiary question.

This can include flight logs, position information, telemetry, sensor data, media and other digital artifacts.

6. Correlate data sources with each other

If multiple data sources are available, they can be compared with each other in terms of time and technology.

This allows similarities, differences, and possible correlations to become visible.

7. Document results

Depending on the assignment, the technical findings are documented in a structured investigation report or an expert report.

Further information can be found at our expert office for IT and mobile forensics.

What should be avoided before a drone survey?

In the event of a potential evidentiary hearing, the existing digital state should be altered as little as possible.

• Avoid reusing the drone if possible
• Do not format memory cards
• Do not save new recordings to existing storage media
• Do not delete flight logs
• Do not unnecessarily reset or reinstall the manufacturer's app.
• Do not reset smartphone or tablet
• Do not change user account unnecessarily
• Do not edit or rename existing files
• Do not unnecessarily reconfigure the controller or remote control

The sooner relevant systems are backed up, the lower the risk that existing digital information will be altered or overwritten through further use.

Drone forensics for businesses

Companies use drones for tasks such as inspections, documentation, surveying, or other operational duties.

Digital flight data can therefore become relevant in the event of accidents, loss, unauthorized use, or internal investigations.

LB Forensics can examine existing digital data sources and document the results in a comprehensible manner.

Drone forensics for lawyers and courts

In legal disputes, it can initially be crucial to determine what digital information is available and what conclusions can be drawn from it from a technical standpoint.

LB Forensik provides support in securing and technically evaluating digital drone data, separating verifiable technical findings from further interpretations.

Depending on the assignment, results can be structured and prepared for further legal or judicial use.

Drone forensics for insurance companies

In the event of crashes, collisions, and other damage incidents, digital flight data can provide an additional source of information.

Flight logs, telemetry information, and other digital artifacts can help reconstruct technical processes prior to an event.

The conclusions that can be drawn depend on the quality, completeness, and validity of the data actually available.

Drone forensics for private individuals

Private individuals can also have a drone examined if there is a specific technical or legal question.

This can include, for example, crashes, collisions, unauthorized use, disputes over a flight path, or the securing of relevant photo, video, and flight data.

Drone forensics nationwide in Germany

LB Forensik supports companies, lawyers, authorities, insurance companies and private individuals nationwide in securing and analyzing digital evidence.

Depending on the case under investigation, it can first be clarified which components are actually needed and which data sources are expected to provide the greatest insights.

Regional information can be found, for example, under IT forensics for Stuttgart , IT forensics for Düsseldorf and IT forensics for Hanover.

Verifiable forensic documentation

When dealing with digital drone data, it is not sufficient to export individual flight values ​​or files from a system.

For the professional evaluation, data origin, investigation method, technical limitations and possible deviations must be taken into account.

LB Forensics documents relevant investigation steps in a structured manner and separates technical findings from conclusions that cannot be reliably derived from the available data.

Limits of drone forensics

Even a professional drone survey cannot answer every question.

• Not every drone stores the same information.
• Not every flight can be fully reconstructed.
• Not every GPS position has the same accuracy.
• Not every technical error leaves a clear digital trace.
• Not every usage can be attributed to a specific person.
• Not all deleted data can be recovered.
• Damaged aircraft or storage media can limit data recovery.
• Different devices may contain different data sets.

A reliable forensic investigation therefore not only identifies the data found, but also its technical limitations.

Frequently asked questions about drone forensics

What data can be read from a drone?

Depending on the manufacturer, model and system, flight logs, GPS and position data, telemetry information, sensor data, as well as photo and video files may be present.

Can the flight path of a drone be reconstructed?

Yes, under certain conditions. If suitable position and flight logs are available, flight movements can be partially or more extensively reconstructed. However, a complete flight route is not available for every system.

Is it possible to determine when a drone has been launched?

Flight logs can contain time information that allows a flight to be placed in a specific time frame. The specific time information available and its reliability must be verified within the given system.

Can the starting point of a drone be determined?

If position data is available, it may contain information about starting positions or stored reference points. The significance of this information depends on the specific data and its accuracy.

Can the landing site of a drone be reconstructed?

This may be possible if suitable position or flight logs are available. In the event of a crash or aborted flight, the last documented positions can provide additional clues.

Can the cause of a drone crash be determined?

Flight logs, telemetry, and sensor data can provide clues about technical conditions prior to a crash. Whether a definitive cause of the crash can be determined from this depends on the individual case. Further technical or physical investigations may be necessary.

Is it possible to determine who flew a drone?

Digital data can provide clues about user accounts, connected devices, and flight activity. However, it does not automatically allow for the unambiguous identification of a natural person and may require additional evidence.

Can the smartphone used with the drone be examined?

Yes. A smartphone or tablet can be an important additional data source. App data, flight logs, and other digital artifacts can be compared with the information from the drone.

Can deleted photos and videos be recovered?

This may be possible depending on the storage medium and its subsequent use. If storage areas have already been overwritten, recovery may be limited or impossible.

Can photo and video metadata be analyzed?

Yes. Existing metadata can include, for example, technical recording information, timestamps, or geographical data. Since metadata is inherently changeable, it must be evaluated in conjunction with other data sources.

Can a damaged drone still be forensically examined?

This depends on the type and extent of the damage. Even in a damaged aircraft, individual storage components, memory cards, remote controls, or connected mobile devices may still contain relevant data.

Can a remote control be examined separately?

Yes. Depending on the model, a remote control may contain its own memory areas, apps, or technical data. Whether relevant information can be extracted from this depends on the specific system.

Can a memory card be examined on its own?

Yes. A memory card can contain photo, video, and file system data. However, for reconstructing a flight, it can be useful to also include the drone, remote control, and smartphone.

What should be done with the memory card after a drone crash?

It should ideally not be reused, formatted, or overwritten with new data. In the event of a forensic examination, the existing state should be preserved.

Is it possible to verify whether a drone was present at a specific location?

This may be possible if suitable location information or other location-related data is available. The reliability of the results depends on the accuracy, completeness, and technical origin of the data.

Is it possible to check whether a drone has entered a specific no-fly zone?

If sufficient position and time information is available, it can be verified whether documented flight positions correspond to a specific geographical area. The legal assessment of a potential violation is a separate matter.

Can app data from a drone application be analyzed?

Yes. Depending on the operating system and app, locally stored data, flight logs, cache data, or other artifacts may be present. Technical availability depends on the specific device and data state.

Can cloud or user account data from a drone be examined?

If relevant data is legally available and can be made technically accessible, it can be considered as an additional data source. The specific information available depends on the respective manufacturer and service.

Can drone data be used as digital evidence?

The technical usability depends, among other things, on data origin, security, integrity, and verifiable documentation. The legal evaluation of evidence in the specific proceedings is the responsibility of the competent court or the participating legal bodies.

Which devices should be submitted for examination?

If possible, it should be clarified beforehand which components are relevant. Besides the drone itself, the remote control, memory cards, the smartphone or tablet used, and other associated storage media can be particularly important.

How quickly should a drone be forensically secured?

The sooner relevant devices and storage media are backed up, the lower the risk that existing data will be altered through further use, synchronization, updates or overwrites.

Request drone forensics through LB Forensics

If flight data needs to be investigated after a crash, collision, unauthorized use or other legally relevant situation, it is recommended to back up the existing systems early.

For an initial assessment, we need in particular the manufacturer and model of the drone, the existing components, and a brief description of the specific question.

LB Forensics then checks which data sources are relevant for the investigation and how drones, remote controls, storage media, smartphones and other digital information can be meaningfully incorporated into the forensic analysis.

The goal is not to extract the largest possible amount of data, but to provide a technically verifiable answer to the specific question of proof.