A Digital Forensics Case Study of the DJI Mini 3 Pro and DJI RC

TL;DR

This paper presents a forensic analysis of the DJI Mini 3 Pro drone and its remote controller, identifying digital artefacts and exploring extraction and visualization methods to aid investigations in a rapidly evolving drone landscape.

Contribution

It provides a detailed case study of digital evidence on recent consumer drones and discusses techniques for extracting, analyzing, and visualizing drone flight data for forensic purposes.

Findings

Digital artefacts include media, logs, and usage data.

Methods for extracting and visualizing flight history are demonstrated.

Potential evidence obfuscation techniques are highlighted.

Abstract

The consumer drone market is rapidly expanding with new drone models featuring unique variations of hardware and software. The rapid development of drone technology and variability in drone systems can make it difficult for digital forensic investigators and tools to keep pace and effectively extract and analyse digital evidence from drones. Furthermore, the growing popularity of drones and their increased use in illegal and harmful activities, such as smuggling, espionage, and even terrorism, has led to an increase in the number of drone forensic cases for authorities to manage. To assist forensic investigators, a static digital forensic case study was conducted on two drone devices recently released by Da-Jiang Innovations (DJI): the Mini 3 Pro drone, and its remote controller, the DJI RC. The study discovered the presence of several digital artefacts on both devices, including recorded media, flight logs, and other information that could help investigators trace the drone's usage and identify its operator. Additionally, this paper explored several methods for extracting and visualising the drone's flight history, and highlights some of the potential methods used to limit, obscure, or remove key types of digital evidence.