# Cyber4 Drone: A Systematic Review of Cyber Security and Forensics in Next-Generation Drones
## 6 Drone Forensics
### Drone Forensics Artifacts  
Digital artifacts are digital entities with forensic value. The investigator, while performing drone forensics, collects data, information, or evidence of something that has occurred, such as logs, metadata, route chart, and many more. These artifacts help the investigator create a timeline of events and executions on a drone by a user. The Ground Station Controller, Flight Control Board, and TCU (Transceiver Control Unit) constitute a potentially trustworthy form of evidence in terms of possible digital forensic artifacts. The ground station controlling unit can also be used to extract log and memory information. Data saved inside the memory, contents of various log files,and electromagnetic wave data are all examples of digital forensic artifacts from drone equipment. Memory artifacts could come from the FCB. These elements include data from the aircraft's internal monitoring unit, flight record information, flight control information, and data from installed transmitters and sensors. Digital artifacts via respective transceivers and installed sensors, on the other hand, would provide additional verifiable data for the investigation [11; 13; 141]. In this section, we present a comprehensive analysis of forensic artifacts that an investigator looks for while performing drone forensics. The artifacts retrieved during \begin{table}
\begin{tabular}{c l l l} \hline \hline  & \multicolumn{1}{c}{**Artifacts**} & \multicolumn{1}{c}{**Source**} & \multicolumn{1}{c}{**Description**} \\ \hline \multirow{6}{*}{**Files**} & Images & M & Images captured \\  & Videos & M & Videos captured \\  & Text files & M & Config and log information \\  & DAT files & M & Encrypted logs \\  & Cache files & M & Temporary info of recent flight \\  & Config files & M & Drone configuration \\  & Binary files & M & Executables and system files \\ \hline \multirow{6}{*}{**Exif Data**} & Timestamp & EL & Flight time info \\  & GPS data & EL & Geo location info \\  & Altitude & L & Drone height during flight \\  & Altitude reference & L & Altitude of home location \\  & Latitude Longitude & L & Geo location data \\  & Thumbnails & M & Media file info \\ \hline \multirow{6}{*}{**Log data**} & Username & FM & user info \\  & Email address & M & username \\  & Drone serial number & OM & Unique id of drone \\  & Country code & F & Location info \\  & Aircraft model & FO & Maker info \\  & Manufacturer & OF & Developer info \\  & Firmware version & F & Firmware info \\  & Controller ID & OFM & GCS unique id \\ \hline \multirow{6}{*}{**PII**} & Flight log data & L & Flight info \\  & Black box files & FM & Drone logs and damage status \\  & Flight air time & L & Duration of flight \\  & Sensor data & LFM & Different sensor logs \\  & Battery status & L & Battery consumption status \\  & Home location & GL & Initial flight location \\  & GPS Tracks & EL & Flight path identifiers \\  & Controller commands & GF & Commands sent during flight \\  & System events & FL & User events on drone \\  & Last connected time & FL & Recent user activity \\ \hline \multirow{6}{*}{**Sensor Logs**} & GPS & LG & Location info \\  & Magnetometer & FL & Guides drone for magnetic field \\  & Accelerometer & L & Acceleration info \\  & Barometer & L & Atmospheric pressure info \\  & Altimeter & L & Altitude info \\  & Gyroscope & L & Drone stability \\  & Speedometer & L & Speed info \\  & Tilt sensors & L & Measure axis tilt \\  & Camera sensors & LM & For image capture \\ \hline \hline \end{tabular}
\end{table} 
Table 6: List of drone artifacts (E: Exif data; F: System files; G: Ground controller; L: Logs; M: Memory card; O: Observation). drone forensics are primarily categorized into EXIF data, files, log data, personal identifiable information, and sensor data. Few artifacts can be in multiple categories, and in some cases, an artifact can lead to generating other ones (e.g., media files store timestamps and geo-location information). Table 6 provides a list of drone artifacts and their classification.