Drone forensics redefined: Integrating live, digital, and non-digital evidence acquisition systems

The rapid development and proliferation of drone technology have led to an increase in various threats. In particular, the number of attacks, crimes, and accidents using drones is continuously expanding, and the need for a systematic response is growing. Existing response strategies have mainly focused on real-time defense-oriented technologies and policies, such as detection, identification, and neutralization of drones. However, recently, the importance of drone forensics, which identifies the flight path of drones, pilot information, and the cause of accidents after an incident, has been highlighted. Drone forensics combines elements of traditional digital forensics and non-digital (physical) forensics, and live forensics technology that collects and analyzes data immediately after an incident plays a crucial role. Drone forensics has distinct technical characteristics compared to general forensics, and this study presents a systematic analysis framework and analysis algorithm structure that reflects these technical characteristics and convergent analysis factors. It comprehensively reviews the major drone forensics technologies currently being utilized. This will help to secure the legal evidence capability of drone forensics and increase its usefulness as evidence. • Proposes a hybrid drone forensic framework combining live, digital, and physical data • Introduces a sequential forensic algorithm tailored to UAV-specific evidence • Analyzes key forensic technologies for crash cause and pilot identification • Addresses legal admissibility of forensic drone data