Oxygen Forensic Detective is the only digital forensic tool that offers investigators the most robust features to extract digital evidence from various Parrot drone sources, parse and decode data, and present it in a easily readable form. It covers all three main sources of drone evidence.Extraction from the drone
So let’s imagine that you have a Parrot drone and you have to analyze the data. Unlike some DJI drones you cannot currently connect our software via USB cable and conduct a physical extraction. What you can do is to import flight logs that can be extracted from the drone physical dump (obtaining by invasive or non-invasive means) or the drone mobile app data and parse the following artifacts:
1. Geo coordinates with time stamps
2. Metadata that includes altitude, velocity, ground speed, Wi-Fi signal, battery level, and the number of satellites connected
3. Separate flights and flight summary
Please note that if flight logs were deleted by the drone itself they can be automatically recovered in our software. All extracted drone locations can be visualized in online or offline Oxygen Forensic Maps with one click from our Timeline section.
Extraction from mobile applications
Since drones can be controlled by their respective apps via Android or iOS-based smartphones and tablets, these apps may contain additional or identical information received from the drones. With these apps, users not only can fly a drone, but also film and easily share their aerial photos and videos. If you do not have the drone, or the flight data cannot be extracted we recommend you acquire the drone owner’s mobile device and check it for installed drone apps.
Oxygen Forensic Detective extracts official Parrot FreeFlight 6 and FreeFlight Pro apps from both from Apple iOS and Android devices. Data on Apple iOS devices can be accessed with a simple logical extraction. However, for Android devices, a physical acquisition will be required.
The artifacts that are recovered include:
1. Account information
2. Devices used by this account
3. Detailed drone logs with geo coordinates, time stamps and metadata.
In fact, flight logs collected from drone mobile apps contain the same data that can be found in drone physical dumps.
Extraction from the cloud
Drone data can be transmitted and stored in the drone manufacturer’s cloud. This additional data represents a separate challenge since manual extraction is usually either extremely complicated or simply not possible due to the lack of documented APIs.
Oxygen Forensic Detective offers the exclusive opportunity to acquire data from My.Parrot account via login/password or token. The password to My.Parrot account can be detected in desktop web browsers by our KeyScout utility and the account token is automatically found in FreeFlight Pro app installed in Apple iOS and Android devices.
The following information can be acquired from the cloud:
1. Account information
2. Drone information including its serial number
3. Flight logs that store geo coordinates, time stamps, speed, flight height, battery level, Wi-Fi signal and other data.
These Cloud logs are equal to the ones from a drone mobile app.
