UAV Forensic Analysis – Next Gen - SANS DFIR Summit 2016

UAV Forensic Analysis – Next Gen

Small Unmanned Aerial Systems (sUAS), aka “drones” are all the rage. They are invading your privacy, they are delivering your packages (and illegal drugs), they are even landing on the White House lawn. Where have they been? Where are they going? Who launched them? Let’s find out. sUAS – emphasis on the final ‘S’ – are complex systems. The aerial platform alone often consists of a radio link, an autopilot, a photography sub-system, a GPS, and multiple other sensors. Each one of these components might
contain a wealth of pieces to the answer to the above questions. Add in the ground control stations, the radio controller, and the video downlink system and you have a very complex computing environment running a variety of commercial, closed source, open source, and home brew software.

And yes, there is already malware specifically targeting
drones. During this presentation, we will walk through all of the components of a representative drone and discuss the forensic process and potential artifacts of each component, along with a presentation of the overall story told by the individual components.
This presentation has been updated from last year to include new analysis options, specifically log and JTAG analysis, along with other enhancements.

David Kovar
(@dckovar), Consultant
David Kovar was recently a cybersecurity and incident response leader for a major consulting firm. He shifted focus to disruptive technologies and is currently pursuing a Master’s degree in International Affairs while consulting on UAVs. He runs a commercial UAV company that provides disaster response, precision agriculture, surveying and other aerial imaging services. He’s also been an entrepreneur, ediscovery consultant, software engineer, search and rescue incident commander, executive protection agent, and lethal forensicator. He’s collected images in China, rescued wayward Americans in Australia, fenced with APT actors from all over the world, and led a mission to Tajikistan to evaluate the emergency preparedness of many local agencies. Oh, and he flies sailplanes, fixed wings, helicopters, and drones.