Drone Forensic Database Gets Boost on NIST Website
Over the last decade or so the tasks drones have been set have been wide and varied and while many are exciting and innovative – for example delivering emergency medical supplies to remote communities and surveying and monitoring a range of situations – not all have been above board.
While widespread drone delivery of food and other products is getting closer day by day – take Ele.me in China, for example, apparently in some prisons drone delivery is already happening. It seems drones have been used to fly drugs, cell phones and other contraband above and over prison walls; of more concern cases where drug traffickers have used drones to ferry narcotics across borders have been discovered.
If and when such drones are captured, data extracted from them can lead to the traffickers and others involved in such an illegal operation being identified. However there are many types of drones and each has its own individual quirk which makes the extraction of data complex.
If investigators were able to download a “forensic image” of any type of drone (that is, a complete data extraction from a digital device), their task would be much easier.
To this end, the National Institute of Standards and Technology (NIST) has now added a section to their repository of digital evidence, known as Computer Forensic Reference Datasets, or CFReDS, completely dedicated to drones.
There, forensic experts can find and download for free ‘images’ (packets of simulated digital evidence) of 14 popular makes and models, NIST announced this week.
This allows them to test their methods of data extraction before working on high profile cases.
“You don’t want to practice on evidence,” says Barbara Guttman, manager of digital forensic research at NIST.
Created by Colorado-based digital forensics and cybersecurity firm VTO Labs, the images were added to the NIST database because that website is well-known within the digital forensics community.
“Listing the drone images there is the fastest way to get them out to experts in the field,” Guttman said.
The creation of the images was conducted by Steve Watson, chief technology officer at VTO, under a contract from the Department of Homeland Security’s (DHS) Science and Technology Directorate.
Aerial drones at the field research station in Colorado | VTO Labs
The purpose of the research was initially needed not only in the fight against drug smuggling by drone, but also so officials can respond quickly in the case of a drone being used as a weapon.
“When we proposed this project, there was little existing research in this space,” said Watson.
The method of image creation involved flying three of each model to create a baseline of data. While the first only had data extracted, the second and third of each model were then disassembled to varying degrees, with data extracted from the circuit board and cameras of the second. From the third, data was extracted not only from the chips but also from the pilot controls and other remote devices.
“The forensic images contain all the 1s and 0s we recovered from each model,” Watson said. The images were created using industry standard data formats so that investigators can connect to them using forensic software tools and inspect their contents. The images for each model also come with step-by-step, photo-illustrated teardown instructions.
The kinds of information Watson was able to extract included retrieve serial numbers, flight paths, launch and landing locations, photos and videos.
On one model, he even found a database that stores a user’s credit card information.
The drone images should prove incredibly useful not only for investigators, but also for universities, forensic labs – and even drone application developers.
This number of drones on the website is expected to grow to 30 by December 2018. A description of the drone images and instructions for accessing them are available on the new drones section of CFReDS.
