GRYPHON: Drone Forensics in Dataflash and Telemetry Logs

The continuous decrease in the price of Unmanned Aerial Vehicles (UAVs), more commonly known as drones, has pushed their adoption from military-oriented to a wide range of civilian and business applications. Nevertheless, the many features that they offer have started being maliciously exploited. The latter coupled with the fact that accidents or malicious acts may occur to drones has sparked the interest towards drones forensics. Trying to fill in the gap of the literature, this work focuses on a particular field of drone forensics that of forensics on the flight data logs. Therefore, we investigate one of the most widely used platforms, Ardupilot and the dataflash and telemetry logs. In this work, we discuss a methodology for collecting the necessary information, analysing it, and constructing the corresponding timeline. In this regard, we have developed an open source tool that is freely available and tested it on data provided by VTO Labs.