Unmanned aerial vehicle data acquisition method and data forensic analysis method based on remote controller

Abstract

The invention belongs to the technical field of unmanned aerial vehicles, and particularly relates to an unmanned aerial vehicle data acquisition method and a data forensic analysis method based on a remote controller. The data acquisition method comprises a step of acquiring data on an external SD card and an internal flash memory in a remote controller of the unmanned aerial vehicle, and comprises a step of acquiring the data of the internal flash memory and imaging an MMCBLK0 block device according to the acquired data. Analysis of these data is used to find some important information, including who is operating the drone, when to which drone is connected, the location of the pilot during flight, the flight route of the drone, and any potential illegal activity performed during operation of the drone. The data collection method can be used for investigation and evidence collection of unmanned aerial vehicle operation.

Description

Technical Field

[0001] The present invention belongs to the technical field of unmanned aerial vehicles, and in particular relates to a remote control-based unmanned aerial vehicle data collection method and a data forensics analysis method. Background Art

[0002] With the development of Internet of Things technology, unmanned aerial vehicles (UAV), especially drones, have been widely used around the world. These small wireless embedded devices are equipped with wireless communication technology, connected to a controller, and can fly into the sky, so they are called "mobile Internet of Things" or "flying Internet of Things". Drones have applications in many fields.

[0003] Drones’ small size and remote-control capabilities make them difficult to track and often hard to identify their operators. For these reasons, since the late 2010s, an increasing amount of digital forensics research has focused on preparing for the potential misuse of drones in a variety of criminal activities.

[0004] Most existing research focuses on collecting and analyzing data from drones and smartphones used as remote control panels. Researchers often rely on the provided software Assistant for data collection to extract encrypted drone flight records. The analysis of these encrypted files often relies on third-party programs such as CSVView / DatCon, AirData UAV, and Phantom Help. This means that researchers are limited in their ability to access files directly from the device's storage, resulting in a limited scope of data that can be collected. Furthermore, the analysis of the collected encrypted files is often tied to the functionality of these third-party programs.

[0005] Drones come in many types and ranges. There are many types of drones and they are numerous, with manufacturers constantly launching new products. This means that conducting digital forensic research on each new drone model requires a lot of time, effort, and resources. In contrast, remote controllers, which are essential for drone flight, are released less frequently.

[0006] While smartphones were primarily used as drone control panels in the past, recent developments have led to the creation and widespread use of remote controls with dedicated interfaces. Unfortunately, there is a lack of digital forensic research specifically targeting these modern remote controls, so the present invention relies on the drone remote control assistant program provided by the drone remote control to collect data is of great significance. Summary of the invention

[0007] The present invention provides a method for collecting data of a UAV based on a remote controller, which collects data from the remote controller without relying on various complicated and changeable models of UAVs. Since the remote controller is a necessary tool for operating the UAV, and its replacement speed is much slower than the UAV itself, the present application is used to solve this problem.

[0008] The present invention is achieved through the following technical solutions:

[0009] A remote controller-based drone data acquisition method includes the steps of acquiring data on an external SD card and an internal flash memory in the drone remote controller, including acquiring data from the internal flash memory and imaging an MMCBLK0 block device with the acquired data.

[0010] Furthermore, the acquisition of the data in the internal flash memory specifically includes the following steps:

[0011] Step A1: Run the Assistant application for the drone remote controller and connect the drone remote controller to the PC via USB;

[0012] Step A2: Install the device driver of the drone remote controller on the PC;

[0013] Step A3: Based on the procedure in step A2, run the drone remote controller FCC tool, connect the remote controller to the server, and install the FCC patch.

[0014] Step A4: Establish a shell connection from the PC to the drone remote controller using the ADB protocol.

[0015] Further, the acquired data is used to image the MMCBLK0 block device, which specifically includes the following steps:

[0016] Step B1: Use the command cat / proc / partitions to confirm the block device name mmcblk0, which represents the entire flash memory;

[0017] Step B2: Use the ADB forward command to specify a port number for the ADB TCP protocol;

[0018] Step B3: Meanwhile, on the drone remote controller, use the DD command to image the MMCBLK0 block device and transfer it to the PC via port 9999 using the Netcat program;

[0019] Step B4: On the PC, use the Netcat program to receive the transmitted image dump file from the drone remote controller via port 9999.

[0020] A remote control-based drone data forensic analysis method, the drone data analysis method comprising the following steps:

[0021] Step C1: using the data on the external SD card and the internal flash memory in the drone remote controller obtained in claim 1, analyzing the file system information of each storage medium to obtain an overview of the internal data;

[0022] Step C2: decompress and decrypt the forensic data obtained by the application installed on the drone remote controller;

[0023] Step C3: Analyze the log data generated by each application;

[0024] Step C4: Analyze the multimedia data captured by the drone.

[0025] Further, the step C1 includes the analysis of the file system of the / data partition, specifically, mirroring the internal flash memory of the drone remote controller, which consists of multiple partitions, and the user data and the drone flight information are located in the / data partition; this partition uses the ext4 file system;

[0026] All installation files for the applications installed on the drone remote controller for analysis are located in

[0027] The analysis is done in the subdirectories of / data / app / and / data / app-lib / ; the configuration and log files generated by the application for analysis are located in the subdirectories of / data / data / and / data / media / 0 / android / data / , respectively; and the multimedia data for analysis is located in the subdirectory / DCIM / UAV_RC_ALBUM on the external SD card.

[0028] Further, the step C2APK includes file application behavior analysis specifically as follows:

[0029] Using the drone remote controller FCC gained root access to the drone remote controller; this allowed the execution of the pm list packages command through an ADB shell to retrieve a list of all installed applications on the drone remote controller; in addition, the / data / system / packages; XML and / data / system / packages; list files were extracted to obtain information about installed applications; by inspecting the image / data partition using a file system analysis tool, the directory structure created under / data / data / was explored based on the package name of the application;

[0030] Bluetooth application, which is used to provide various Bluetooth-related functions, including Bluetooth connection management, file transfer, audio streaming, and interaction with peripheral devices; to handle the synchronization of multimedia files captured by the drone;

[0031] Qualcomm application for the ability to wirelessly share the display from a smartphone or tablet using Wi-Fi Display;

[0032] Drone Remote Control Fly app, used to operate the drone remote control during flight;

[0033] The drone remote controller uses it to control the drone flight. It is the main application that runs continuously on the drone remote controller, providing various functions such as logging into the drone remote controller server, pairing with the drone, controlling the drone flight, and downloading multimedia files captured by the drone.

[0034] In addition, in the / data / data / drone-remote-controller path go.V5 / databases / , in the internal SD card area, specifically in / data / media / 0 / android / data / drone-remote-controller;

[0035] In go.V5 / files / , V5 / files / log / cache / * contains various information including drone remote controller device details, drone remote controller Fly application information, country information where the drone is flying, paired drone information, and location information of the drone remote controller during drone flight.

[0036] Furthermore, the drone pairing information of step C3 specifically includes the time when the pairing occurs, the serial number and model name of the drone, the country code information set on the drone remote controller during pairing, the location information, and the flight status;

[0037] The data types that contain location information in the drone remote controller include the location of the drone remote controller and the location of the flying drone;

[0038] Drone remote control location: The location information of the drone remote control indicates the location of the person controlling the drone flight; the files containing this information include s / data / ... / UP_DATA_ALL / *.txt and

[0039] / data / ... / UP_NEW_ALL / *.txt, cache and AeroscopeLogic files that only store location information when the drone remote controller is connected to the Internet via Wi-Fi;

[0040] Drone location: DJIFlightRecord_YYYY-MM-DD_[HH-MM-SS].txt file is the drone flight log generated by the drone remote controller FLY application, which is encrypted; the drone remote controller Flight Log Viewer-Phantom Help website provides the service of decrypting the file, parsing the flight records contained in it, and displaying them on a map.

[0041] Furthermore, the multimedia data in step C4 includes photos and videos taken from the drone, specifically,

[0042] The Bluetooth application is used to extract and analyze the files while the drone is flying and capture multimedia data, which is initially stored on the drone. The multimedia data stored on the drone is synchronized with the drone remote control via Bluetooth. The multimedia data includes photos in JPEG format and video files in MP4 format. These files are extracted and analyzed using standard metadata analysis techniques, including examining EXIF / XMP data in JPEG files. This analysis helps determine the objects captured by the user while flying the drone.

[0043] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the above method is implemented.

[0044] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0045] The beneficial effects of the present invention are:

[0046] The goal of the invention is to discover critical information, including who is operating the drone, when it is connected to which drone, the pilot's location during the flight, the drone's flight path, and any possible irregular operations performed during the drone's operation.

[0047] The present invention focuses on collecting and strictly analyzing data, but is not limited to operating the remote control of the drone.

[0048] The present invention is supported by real data and can conduct data forensic investigation through the groundbreaking data collection of remote controller devices. The method proposed by the present invention collects data from the remote controller, and does not rely on various complex and changing models of drones. The remote controller is a necessary tool for operating drones, and its replacement speed is much slower than the drone itself, so the evidence collection method proposed by the present invention has great advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the method of the present invention.

[0050] Figure 2 It is a schematic diagram of the connection between the drone remote controller of the present invention and various devices.

[0051] Figure 3 It is a schematic diagram of the drone remote controller and server of the present invention.

[0052] Figure 4 It is a schematic diagram of data connection information of the drone remote controller of the present invention.

[0053] Figure 5It is a schematic diagram of data information used for evidence collection on the drone remote controller of the present invention. DETAILED DESCRIPTION

[0054] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0055] It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0056] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0057] The following is attached to this application specification Figure 1-5 , the technical solutions in the embodiments of the present application are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0058] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present application. Therefore, the present application is not limited to the specific embodiments disclosed below.

[0059] Implementation Method 1

[0060] This embodiment provides a method for collecting drone data based on a remote controller. Before data collection, the drone remote controller is first selected as the analysis object, which can control most drones released using the drone remote controller. The drone remote controller is a controller with a panel that runs on a customized Android OS with a Linux kernel. Users can control the drone through the drone remote controller Fly application installed on the Android operating system. The operating system can force the drone remote controller Fly application to run continuously in the foreground, thereby preventing users from navigating to the Android home screen, launching other applications, or closing the drone remote controller Fly application. Therefore, users can only use the drone remote controller for drone control through the drone remote controller Fly application, and cannot use it for other purposes such as web browsing. In addition, the operating system does not allow the installation of third-party applications, so applications cannot be installed through an external SD card. In addition, it restricts access to external URLs and does not allow the download and installation of third-party applications.

[0061] Connecting with peripheral devices

[0062] The drone remote controller can establish connections with various devices, such as Figure 2 Here is information about the connection and communication methods between these devices:

[0063] The drone remote controller pairs with the drone remote controller drone via the drone remote controller Fly app. It is worth noting that during the pairing attempt, the drone remote controller Fly app always verifies the drone's firmware version and only allows pairing if it is the latest. Once the pairing is complete, the user can control the drone's flight using the drone remote controller's joystick. The real-time flight feedback transmitted from the drone's camera is also sent to the drone remote controller via the OcuSync protocol.

[0064] UAV remote controller and UAV remote controller server see Figure 3 :

[0065] To fly the drone normally, you need to register an account and log in to the server through the drone remote control Fly App on the Internet. After logging in, the drone remote control server will check whether the firmware version of the connected drone is the latest and limit the flight range of the drone according to the allowed height and distance set by each country.

[0066] The drone remote controller can be connected to the PC via a USB cable. Figure 4By installing the Drone Remote Controller Assistant2 application on the PC and installing the device driver for the drone remote controller, the PC recognizes the drone remote controller as an external storage device and allows USB serial communication. After that, users can access the SD card inside the drone remote controller through the file explorer, view photos and videos taken by the drone, and update the device's firmware.

[0067] Data to Digital Forensic Analysis

[0068] The data used for analysis on the drone remote controller is stored on two physical storage media: internal flash memory and external SD card. Figure 5 As shown: It contains multiple partitions, including firmware files for the drone remote controller, system logs for the Android operating system, installation and execution files for installed applications, and log files generated by these applications. All of these components need to be analyzed.

[0069] Data on an external SD card can be collected and analyzed without any special administrator privileges. This can be achieved by extracting the Micro SD card from the drone remote controller and using a card reader for data retrieval and subsequent analysis. This storage contains photo and video files taken by the drone and is usually downloaded from the drone by the drone remote controller during the drone's operation. Drone remote controllers usually store multimedia files captured by the drone on an external SD card. By analyzing these files, it is possible to examine the photos and videos taken by the drone, and in particular, by analyzing the EXIF ​​data in the photo files, aspects such as the flight path of the drone can be analyzed.

[0070] The data acquisition method includes the steps of acquiring data on an external SD card and an internal flash memory in a drone remote controller, including acquiring data from the internal flash memory and imaging an MMCBLK0 block device with the acquired data.

[0071] Furthermore, the acquisition of the data in the internal flash memory specifically includes the following steps:

[0072] Step A1: Run the Assistant application for the drone remote controller and connect the drone remote controller to the PC via USB;

[0073] Step A2: Install the device driver of the drone remote controller on the PC;

[0074] Step A3: Based on the procedure in step A2, run the drone remote controller FCC tool, connect the remote controller to the server, and install the FCC patch.

[0075] Step A4: Establish a shell connection from the PC to the drone remote controller using the ADB protocol; this enables confirmation that root permissions have been successfully and permanently secured on the drone remote controller.

[0076] Use the FCC tool of the drone remote controller to successfully perform root operation, and use the ADB protocol shell to check root permissions;

[0077] Further, the acquired data is used to image the MMCBLK0 block device, which specifically includes the following steps:

[0078] Step B1: Use the command cat / proc / partitions to confirm the block device name mmcblk0, which represents the entire flash memory;

[0079] Step B2: To extract the image dump file from the drone remote controller to the PC, use the ADB forward command to specify a port number (e.g., 9999) for the ADB TCP protocol.

[0080] Step B3: Meanwhile, on the drone remote controller, use the DD command to image the MMCBLK0 block device and transfer it to the PC via port 9999 using the Netcat program;

[0081] Step B4: On the PC, use the Netcat program to receive the transmitted image dump file from the drone remote controller via port 9999.

[0082] Specifically, the method of collecting data when operating a drone using a drone remote controller is a device equipped with an independently customized Android operating system, from which data can be collected using data collection methods commonly used by Android smart devices.

[0083] terminal

[0084] The Drone Remote Controller FCC Tool is designed to allow users to modify the transmission power level mode of the drone remote controller by switching between CE / FCC mode. CE mode is the mode set for drone flights in European countries. FCC mode is configured for drone flights in regions such as the United States, Canada, and China.

[0085] During the mode change process, the drone remote controller FCC tool exploits a vulnerability to gain root privileges on the drone remote controller. The process of gaining superuser privileges on the device includes the following steps:

[0086] 1. First, run the drone remote controller FCC tool, connect the remote controller to the server, and install the FCC patch.

[0087] 2. Subsequently, a shell connection is established from the PC to the drone remote controller using the ADB protocol. This enables confirmation that root privileges have been successfully and permanently secured on the drone remote controller.

[0088] 3. Use the FCC tool of the drone remote controller to perform root operations and use the ADB protocol shell to check root permissions.

[0089] This rooting process improves access and control of the drone remote controller, allowing for further data collection.

[0090] Flash Imaging

[0091] Table 1 Partition information of internal flash memory

[0092]

[0093]

[0094] After obtaining root privileges on the drone remote controller through the drone remote controller FCC, shell access can be used to image the internal flash memory of the drone remote controller. The internal flash memory capacity of the drone remote controller is divided into multiple partitions using the GUID partition table (GPT) as shown in Table 1. In order to collect all partitions of the flash memory, follow the following four steps to image the MMCBLK0 block device:

[0095] (1) Use the command cat / proc / partitions to confirm the block device name mmcblk0, which represents the entire flash memory.

[0096] (2) To extract the image dump file from the drone remote controller to the PC, use the ADB forward command to specify a port number for the ADBTCP protocol.

[0097] (3) On the drone remote controller, use the DD command to image the MMCBLK0 block device and use the Netcat program to transfer it to the PC through the port.

[0098] (4) On the PC, use the Netcat program to receive the image dump file transmitted from the drone remote controller through the port.

[0099] (5) These steps enable imaging of the drone remote controller’s flash memory and transfer of the dump file to a PC for further analysis.

[0100] (6) Decompressing encrypted files: In the / data partition of the drone remote controller, critical digital forensic data is stored, including device information, installed application files, application logs, and the internal SD card. However, there are encrypted directories and files in the subpaths of the data partition. Because they were collected in an encrypted state when the flash memory was imaged using the previously mentioned method. Therefore, additional decryption is required to access and analyze this data.

[0101] External SD card

[0102] The drone remote controller external SD card can be imaged after physical removal and using a hardware imaging device. The study used MedialMager's GM4 Pro to image the external SD card. If a hardware imaging device is not available, the external SD card can be imaged by inserting it into a write blocker and connecting it to a PC. In this case, forensic software tools such as Encase or FTK Imager can be used for imaging.

[0103] Implementation Method 2

[0104] This embodiment provides a remote control-based drone data forensic analysis method, the drone data analysis method comprising the following steps:

[0105] Step C1: using the data on the external SD card and the internal flash memory in the drone remote controller obtained in claim 1, analyzing the file system information of each storage medium to obtain an overview of the internal data;

[0106] Step C2: decompress and decrypt the forensic data obtained by the application installed on the drone remote controller;

[0107] Step C3: Analyze the log data generated by each application;

[0108] Step C4: Analyze the multimedia data captured by the drone.

[0109] Further, the step C1 includes the analysis of the / data partition file system. Specifically, the internal flash memory of the drone remote controller is mirrored, and the flash memory consists of multiple partitions. Among these partitions, user data and drone flight information are located in the / data partition; therefore, the main analysis focus is on the data in this partition; this partition uses the ext4 file system; the overall structure of directories and files is similar to a typical Android file system;

[0110] All installation files for the applications installed on the drone remote controller for analysis are located in

[0111] The configuration and log files generated by the application for analysis are located in the subdirectories of / data / data / and / data / media / 0 / android / data / , respectively. In addition, multimedia data for analysis can be located in the subdirectory / DCIM / UAV_RC_ALBUM on an external SD card.

[0112] Further, the step C2APK includes file application behavior analysis specifically as follows:

[0113] Using the drone remote controller FCC gained root access to the drone remote controller; this allowed the execution of the pm list packages command through an ADB shell to retrieve a list of all installed applications on the drone remote controller; in addition, the / data / system / packages; XML and / data / system / packages; list files were extracted to obtain information about the installed applications; in addition, by inspecting the image / data partition using a file system analysis tool (such as Encase, FTK Imager, Autopsy, etc.), the directory structure created under / data / data / can be explored based on the package name of the application;

[0114] Using these methods, we were able to identify multiple applications installed on the drone remote controller; the drone remote controller has a customized Android operating system that always launches the drone remote controller Fly application and places it on the top of the screen; therefore, users may think that only the drone remote controller Fly application exists on the drone remote controller; however, in reality, the installation status of these applications is not visible to users; given that these applications may store user information or drone-related data in logs, it is necessary to conduct a comprehensive analysis of them.

[0115] In order to analyze the behavior of an application, you need to access the APK (Android Package Kit) file, also known as the Android application package; an APK file is an installation file for a specific application. In the Android ecosystem, after installing an application, its APK file is copied to the / data / app / * subdirectory; therefore, APK files can be extracted from this directory for all applications installed on an Android device; APK files can serve as both an application installer and an executable file of the application, i.e., a DEX file; these DEX files can be statically analyzed using decompression and decryption tools (such as APKTool, JADX, and Jeb decompiler), enabling you to understand the behavior of the application; in addition, SO files are libraries used by the application, which can be reverse engineered using tools such as IDA Pro and Ghidra. In addition, for dynamic analysis, network data capture, and hooking into the internal logic of an application, tools like Frida can be used;

[0116] A Bluetooth application for providing various Bluetooth-related functions, including Bluetooth connection management, file transfer, audio streaming, and interaction with peripheral devices; this application is customized to handle the synchronization of multimedia files captured by the drone with the ; the synchronization of multimedia files captured by the drone with the is specifically handled as follows: when the drone remote controller synchronizes multimedia files from the drone, the files are initially stored on the external SD card; if there is insufficient space on the external SD card, they are stored on the SD card of the internal flash memory; even if the internal SD card lacks sufficient storage space, the synchronization process will fail.

[0117] Qualcomm application for the ability to wirelessly share the display from a smartphone or tablet using Wi-Fi Display. It is a modified version of the Android default Gallery application that allows users to view photos and videos they have taken. This application is usually the default when using a device equipped with a Qualcomm chipset.

[0118] The drone remote controller Fly application, namely the dpad_setup.apk (com.dpad.setup) app application, is used to operate the drone remote controller during flight.

[0119] The SysObserver.APK application is a debugging tool created by the drone remote controller for reference during product development and is not run under normal circumstances. When the com.dji.sysobserver.Main Activity application is forced to execute, using the ADB command, it generates a systrace button. Clicking this button records the operating status of the application through logcat and creates a drone system trace file.

[0120] The drone remote controller uses it to control the drone flight. It is the main application that runs continuously on the drone remote controller, providing various functions such as logging into the drone remote controller server, pairing with the drone, controlling the drone flight, and downloading multimedia files captured by the drone.

[0121] In addition, in the / data / data / drone remote controller path go.V5 / databases / , information related to the pairing of the drone remote controller and the drone was found. In the internal SD card area, especially in

[0122] / data / media / 0 / android / data / drone-remote-controller. In go.V5 / files / , files containing account information and drone flight details were found. V5 / files / log / cache / * contained various information, including drone remote control device details, drone remote control Fly application information, country information of drone flight, paired drone information, and location information of drone remote control during drone flight. However, these files: were encrypted based on events and then encoded in Base64. In order to analyze them, the drone remote control Fly application was reverse engineered to extract the information required for decryption.

[0123] Furthermore, the drone pairing information of step C3 specifically includes the time when the pairing occurs, the serial number and model name of the drone, the country code information set on the drone remote controller during pairing, the location information, and the flight status;

[0124] The data types containing location information in the drone remote controller include the location of the drone remote controller and the location of the flying drone. Analyzing the files containing the drone remote controller location can reveal when and where the user controlled the drone (When and Where), while analyzing the files containing the drone location can provide information about where the drone flew to and from (Where).

[0125] Drone remote controller location: The location of the drone remote controller indicates the location of the person controlling the drone. The files containing this information include s / data / ... / UP_DATA_ALL / *.txt and

[0126] / data / ... / UP_NEW_ALL / *.txt, cache and AeroscopeLogic files only store location information when the drone remote controller is connected to the internet via Wi-Fi. When the internet is not connected, the location information records the latitude and longitude as "0", and once the internet connection is established, the actual latitude and longitude are recorded. This means that until there is no internet connection, there is no location information. However, when the internet connection is established, it starts recording location information.

[0127] Drone location: DJIFlightRecord_YYYY-MM-DD_[HH-MM-SS].txt file is the drone flight log generated by the drone remote controller FLY application, which is encrypted; the drone remote controller Flight Log Viewer-Phantom Help website provides the service of decrypting the file, parsing the flight records contained in it, and displaying them on a map.

[0128] Essentially, the file contains information such as the time the drone was flown, its location (latitude, longitude, and altitude), the flight status, the connection between the drone remote controller and the drone, the serial number of the camera installed on the drone, the model of the drone, and much more. In particular, the flight path of the drone can be determined by analyzing the time, location information, and flight status.

[0129] There are four possible flight states:

[0130] Automatic takeoff: This state indicates the start of flight.

[0131] P-GPS: This status means the joystick of the drone remote controller controls the drone.

[0132] Return to Home: This status indicates that the Return to Home (RTH) function is in use and the drone is returning to its initial takeoff position.

[0133] Auto Landing: This state means the drone is ending its flight and landing.

[0134] Furthermore, the multimedia data in step C4 includes photos and videos taken from the drone, specifically,

[0135] The Bluetooth application is used to extract and analyze the files while the drone is flying and capture multimedia data, which is initially stored on the drone. The multimedia data stored on the drone is synchronized with the drone remote control via Bluetooth. The multimedia data includes photos in JPEG format and video files in MP4 format. These files are extracted and analyzed using standard metadata analysis techniques, including examining EXIF / XMP data in JPEG files. This analysis helps determine the objects captured by the user while flying the drone.

[0136] Implementation Method 3

[0137] An embodiment of the present invention provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the memory is used to store software programs and modules, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory and the processor are connected via a bus. Specifically, the processor implements any step in the first embodiment above by running the computer program stored in the memory.

[0138] It should be understood that in the embodiments of the present invention, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0139] The memory may include a read-only memory, a flash memory, and a random access memory, and provides instructions and data to the processor. A part or all of the memory may also include a nonvolatile random access memory.

[0140] It should be understood that if the above-mentioned integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned implementation method, and can also be completed by instructing the relevant hardware through a computer program. The above-mentioned computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method implementations when executed by the processor. Among them, the above-mentioned computer program includes computer program code, and the above-mentioned computer program code can be in source code form, object code form, executable file or some intermediate form. The above-mentioned computer-readable medium may include: any entity or device capable of carrying the above-mentioned computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the above-mentioned computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.

[0141] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest range consistent with the principles and novel features disclosed herein.

[0142] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the above-mentioned device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the implementation method can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method implementation method, which will not be repeated here.

[0143] It should be noted that the methods and detailed examples provided in the above embodiments can be combined with the devices and equipment provided in the embodiments, and references can be made to each other, and no further details will be given.

[0144] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0145] In the embodiments provided by the present invention, it should be understood that the disclosed device / terminal equipment and method can be implemented in other ways. For example, the device / equipment implementation described above is only illustrative, for example, the division of the above modules or units is only a logical function division, and in actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0146] The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above-mentioned embodiments, or replace some of the technical features therein by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for collecting data from a drone based on a remote controller, characterized in that: The data acquisition method includes the steps of acquiring data on an external SD card and an internal flash memory in a drone remote controller, including acquiring data from the internal flash memory and imaging an MMCBLK0 block device with the acquired data.

2. The method for collecting data from a drone based on a remote controller according to claim 1, characterized in that: The method of obtaining the data of the internal flash memory specifically comprises the following steps: Step A1: Run the Assistant application for the drone remote controller and connect the drone remote controller to the PC via USB; Step A2: Install the device driver of the drone remote controller on the PC; Step A3: Based on the procedure in step A2, run the drone remote controller FCC tool, connect the remote controller to the server, and install the FCC patch. Step A4: Establish a shell connection from the PC to the drone remote controller using the ADB protocol.

3. The method for collecting data from a drone based on a remote controller according to claim 2, characterized in that: The acquired data is used to image the MMCBLK0 block device, which specifically includes the following steps: Step B1: Use the command cat / proc / partitions to confirm the block device name mmcblk0, which represents the entire flash memory; Step B2: Use the ADB forward command to specify a port number for the ADB TCP protocol; Step B3: Meanwhile, on the drone remote controller, use the DD command to image the MMCBLK0 block device and use the Netcat program to transfer it to the PC through the specified port; Step B4: On the PC, use the Netcat program to receive the transmitted image dump file from the drone remote controller through the specified port.

4. A remote control-based drone data forensic analysis method, characterized in that: The drone data analysis method comprises the following steps: Step C1: using the data on the external SD card and the internal flash memory in the drone remote controller obtained in claim 1, analyzing the file system information of each storage medium to obtain an overview of the internal data; Step C2: decompress and decrypt the forensic data obtained by the application installed on the drone remote controller; Step C3: Analyze the log data generated by each application; Step C4: Analyze the multimedia data captured by the drone.

5. The remote control-based drone data forensic analysis method according to claim 4 is characterized in that: The step C1 includes / data partition file system analysis, specifically, mirroring the internal flash memory of the drone remote controller, which consists of multiple partitions, and user data and drone flight information are located in the / data partition; This partition uses the ext4 file system; All installation files for the applications installed on the drone remote controller for analysis are located in The analysis is done in the subdirectories of / data / app / and / data / app-lib / ; the configuration and log files generated by the application for analysis are located in the subdirectories of / data / data / and / data / media / 0 / android / data / , respectively; and the multimedia data for analysis is located in the subdirectory / DCIM / UAV_RC_ALBUM on the external SD card.

6. The remote control-based drone data forensic analysis method according to claim 4 is characterized in that: The step C2APK includes file application behavior analysis specifically as follows: Using the drone remote controller FCC gained root access to the drone remote controller; this allowed the execution of the pm list packages command via an ADB shell to retrieve a list of all installed applications on the drone remote controller; in addition, the / data / system / packages; XML and / data / system / packages; list files were extracted to obtain information about installed applications; Inspect the image / data partition by using a file system analysis tool and explore the directory structure created under / data / data / based on the package name of the application; Bluetooth application, which is used to provide various Bluetooth-related functions, including Bluetooth connection management, file transfer, audio streaming, and interaction with peripheral devices; to handle the synchronization of multimedia files captured by the drone; Qualcomm application for the ability to wirelessly share the display from a smartphone or tablet using Wi-Fi Display; Drone Remote Control Fly app, used to operate the drone remote control during flight; The drone remote controller uses it to control the drone flight. It is the main application that runs continuously on the drone remote controller, providing various functions such as logging into the drone remote controller server, pairing with the drone, controlling the drone flight, and downloading multimedia files captured by the drone. In addition, in the / data / data / drone-remote-controller path go.V5 / databases / , in the internal SD card area, specifically in / data / media / 0 / android / data / drone-remote-controller; In go.V5 / files / , V5 / files / log / cache / * contains various information including drone remote controller device details, drone remote controller Fly application information, country information where the drone is flying, paired drone information, and location information of the drone remote controller during drone flight.

7. The remote control-based drone data forensic analysis method according to claim 4 is characterized in that: The drone pairing information of step C3 specifically includes the time when the pairing occurred, the serial number and model name of the drone, the country code information set on the drone remote controller during pairing, the location information, and the flight status; The data types that contain location information in the drone remote controller include the location of the drone remote controller and the location of the flying drone; Drone remote controller location: The location information of the drone remote controller indicates the location of the person controlling the drone flight; the files containing this information include / data / ... / UP_DATA_ALL / *.txt and / data / ... / UP_NEW_ALL / *.txt, cache and AeroscopeLogic files that only store location information when the drone remote controller is connected to the Internet via Wi-Fi; Drone location: DJIFlightRecord_YYYY-MM-DD_[HH-MM-SS].txt file is the drone flight log generated by the drone remote controller FLY application, which is encrypted; the drone remote controller Flight Log Viewer-Phantom Help website provides the service of decrypting the file, parsing the flight records contained in it, and displaying them on a map.

8. The remote control-based drone data forensic analysis method according to claim 4 is characterized in that: The multimedia data in step C4 includes the photos and videos taken from the drone, specifically, The Bluetooth application is used when the drone is flying and captures multimedia data, which are initially stored on the drone. The multimedia data stored on the drone is synchronized with the drone remote controller via Bluetooth. Multimedia data includes photos in JPEG format and video files in MP4 format; These files were extracted and analyzed using standard metadata analysis techniques, including examining EXIF / XMP data within JPEG files. This analysis helped determine what objects the user captured while flying the drone.

9. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images