Drone-controller Integrated Forensic Timeline (DRIFT): a framework for drone and android mobile controller forensics

The increasing deployment of Unmanned Aerial Vehicles (UAVs) or drones across various sectors presents significant challenges, including potential misuse such as unauthorised surveillance and airspace violations. To address these concerns, this research introduces a novel forensic framework, DRIFT, designed to enhance drone forensics by integrating data from both drones and Android smartphone controllers. The DRIFT framework provides a comprehensive approach to digital artifact acquisition and analysis, offering critical insights into drone-related forensic investigations. This study applies DRIFT to analyse digital artifacts from the DJI Mini 3 drone and its Android-based controller (DJI RC-N1) without rooting the device. Data acquisition was performed using both static and dynamic methods on the drone and physical and logical methods on the smartphone. Dynamic acquisition of the drone revealed richer artifacts, including EXIF metadata containing key information such as latitude, longitude, and altitude. Although flight log data were not found on the drone itself, they were successfully extracted from the smartphone via logical acquisition by identifying the DJI Fly application package (dji.go.v5). The extracted flight logs were then converted into .kmz format using Phantomhelp.com and visualised in Google Earth to confirm airspace violations. This research highlights the significance of the DRIFT framework in integrating acquisition methods and understanding application structures to obtain valid forensic evidence while preserving the integrity of the device.