Drone Investigation Training (CDDA) Course
Level - Advanced
Course Length: 3 Days
The Drone Investigation Training (CDDA) course is a three-day advanced level program designed to teach investigators and forensic examiners to recover, analyze and generate reports based on data obtained from unmanned aircraft systems (UAS), also known as drones. Students will learn how to employ best practices in disassembling a drone to acquire flight data embedded within the device. In addition to the embedded flight data, students will use a UFED Touch2 or UFED 4PC to create forensic images of associated storage media containing photo and video files recorded by onboard or attached cameras. Once the data is acquired, students will learn how to analyze the data using UFED Physical Analyzer software and to correlate data found in smartphone drone applications with flight data recovered from the device.
The Cellebrite Drone Investigation Training course is comprised of the following modules and lessons:
This module provides unique insight into actual cases from around the world where crimes have been committed by or facilitated with the use of drones.
Legal Guidelines and Terms
This module will provide students with a review of the guidelines that drone pilots should follow when flying, either as a hobbyist or for commercial purposes, both in the US and abroad. Students will learn about federal and local government legal issues (initiatives) related to enforcement of drone usage. This module will also provide students with common terms and definitions utilized within the sUAS industry.
In this module, students will learn about the multiple components and features of small unmanned aircraft systems (sUAS). This lecture includes information related to flying drones via the use of cell phones, flight controllers, integrated displays, and autonomous flights. Students will learn what data may exist in each component, how the data can be extracted and how this information may impact the investigative process. Students will also learn about the home point (return-to-home feature) found in many drones and explore radio frequency, WiFi controls, and signal interception.
This module begins with a focus on incident response and the handling of a sUAS at the time of seizure and will include a discussion on safety concerns related to lithium batteries often used in the aircraft. Using a functional drone, students will learn how to disassemble the drone to recover the embedded microSD card and learn how to extract the flight data using forensically sound methodologies. In addition to extractions using Cellebrite's hardware and software, students will also learn how to apply best practice when using third-party tools.
File System Artifacts
This module includes a lecture and information related to the various file-types encountered during the examination of sUAS data. Students will learn which files should be analyzed and what information is expected to be found within them. Analysis of artifacts in this module may reveal information identifying the registered user of the sUAS, critical information needed in legal processes such as subpoenas and search warrants. Image and video analysis will be conducted with a discussion of metadata and how to recover deleted and incomplete files found in certain situations. Students will also learn how to analyze DAT and TXT files found in specific systems.
sUAS Application Data
This module will introduce the student to numerous artifacts found in the accompanying phone application files. Students will be instructed how to extract and review the files of interest, explaining what was found in each file and how it impacts the investigation. Students will be exposed to flight records and flight logs and taught how to correlate the controller data with the data found in the aircraft.
Using Physical Analyzer and Third-Party Tools
In this module, students will participate in practical exercises to analyze drone data extracted from an aircraft and associated control station or mobile phone. The practical exercises will allow the student to demonstrate an understanding of how the analysis phase may require more than one tool and how to employ best practice during investigations.
Students successfully demonstrating proficiency will earn the Drone Investigation Training (CDDA) certification. To earn this certification, the student must demonstrate proficiency in:
- Disassembly of a drone to remove the embedded microSD card; and
- Extracting flight data from a drone using forensically sound methodologies; and
- Analyzing flight data recovered from a specific incident; and
- Achieving a minimum score of 80% on a knowledge-based examination related to drone analysis
Students who opt not to demonstrate proficiency via testing will only receive a certificate of attendance.