A Comparative UAV Forensic Analysis: Static and Live Digital Evidence Traceability Challenges

• Main Authors: Fahad E. Salamh, Umit Karabiyik, Marcus K. Rogers, Eric T. Matson
• Format: Article
• Language: English
• Published: MDPI AG 2021-05-01
• Series: Drones
• Subjects: UAV forensic; Kill Chain; digital evidence traceability; data integrity; technical issues; comparative model
• Online Access: https://www.mdpi.com/2504-446X/5/2/42

The raising accessibility of Unmanned Aerial Vehicles (UAVs), colloquially known as drones, is rapidly increasing. Recent studies have discussed challenges that may come in tow with the growing use of this technology. These studies note that in-depth examination is required, especially when addressing challenges that carry a high volume of software data between sensors, actuators, and control commands. This work underlines static and live digital evidence traceability challenges to further enhance the UAV incident response plan. To study the live UAV forensic traceability issues, we apply the ‘purple-teaming’ exercise on small UAVs while conducting UAV forensic examination to determine technical challenges related to data integrity and repeatability. In addition, this research highlights current static technical challenges that could pose more challenges in justifying the discovered digital evidence. Additionally, this study discusses potential drone anti-forensic techniques and their association with the type of use, environment, attack vector, and level of expertise. To this end, we propose the UAV Kill Chain and categorize the impact and complexity of all highlighted challenges based on the conducted examination and the presented scientific contribution in this work. To the best of our knowledge, there has not been any contribution that incorporates ‘Purple-Teaming’ tactics to evaluate UAV-related research in cybersecurity and digital forensics. This work also proposes a categorization model that classifies the discovered UAV static and live digital evidence challenges based on their complexity and impact levels.