Researchers take apart drones to find data for investigations. (Image: VTO Labs)
VTO Labs
Drones can be used for good, but it depends on who’s flying them. The recent drama at London’s Gatwick Airport is a real-life example of how even an amateur drone pilot can disrupt major infrastructure. Now that suspects have been arrested and a drone has been captured, what’s next? Drone forensics is an emerging field that finds hidden clues inside these popular flying gadgets.
The New York Times reports that British authorities arrested a couple for allegedly flying drones that forced Gatwick Airport to cancel or divert more than 1,000 flights over three days right before Christmas, which disrupted travel for an estimated 140,000 people. In recent years, drones have also caused problems around the world by delivering contraband to prisons, crashing into crowds during a baseball game, and carrying drugs over international borders.
Also: Why working with Intel is helping Delair’s drones fly into new markets
Drones are emerging as an important part of investigations. The US Department of Homeland Security contracted Colorado-based digital forensics and cybersecurity firm VTO Labs to study drone forensics.
“Drones were starting to land in places where we didn’t want them to. They were landing at government facilities and military bases; they were coming across the border,” says VTO Labs CEO Steve Watson.
The problem for investigators is there are many types of drones, so data extraction is complicated. That’s why Watson and his team at VTO Labs flew 30 different models of drones ranging in price from $100 to $35,000. Then the researchers took the drones apart to find out what kind of information was hidden inside. Within a drone, the circuit board, onboard cameras, and chips all contain data. Plus, more information is available on the controller and remotely connected devices such as a PC or an app that the drone partners with for pilot controls.
“When you show up at a crime scene, you usually don’t find all of the pieces lined up neatly for you,” Watson says. He adds, “We were able to get data off of all of the pieces of every model we touched.”
The information they compiled wasn’t only valuable for Homeland Security; the scientific community and other government agencies also started to take notice. The National Institute of Standards and Technology (NIST) compiled the drone images in Computer Forensic Reference Datasets that contain device specifications and sample digital evidence that investigators can download for free to learn what’s inside a drone.
Barbara Guttman, leader of the Digital Forensics program at NIST explains that drones are equipped with computers and cameras that contain data including personal details about pilots.
Also: 17 drone disasters that show why the FAA hates drones TechRepublic
She tells us, “They might have accidentally taken a picture of themselves or their house. A drone is just taking pictures — when it takes off it might include their license plate or all kinds of things. Never underestimate the ability of people to do dumb things.”
Guttman explains that investigators primarily want video from drones, but also GPS coordinates of all flight paths. For example, investigators could notice that a drone frequently takes off from the same location. Plus, drones might have user information such as username or credit card details that could link the drone to its owner. “These are reasonably useful targets for an investigation if the drone did something bad. They want to know who owned it and what it did,” Guttman says.
According to CNN, British police are now carrying out a forensic examination of a damaged drone that was found near Gatwick Airport.
“Even if they did find a crashed drone, there is possibility of getting data off of that, even if it’s damaged,” says Watson.
[Note: NIST research activities are currently on hold because of the government shutdown, so some of the hyperlinks in this article may be temporarily unavailable.]