Abstract
Drones have become prevalent for the sustenance of routine services including the delivery of goods, premise surveillance and for carrying out observation and reporting of phenomena, such as weather patterns. The vulnerability of a drone to a cyber attack is significant. The compromise of a drone in flight may cause flight path alteration, a crash and sabotage of sensitive captured data. In the event of such compromise, the process of investigating a captured and/or crashed drone as part of a digital forensic investigation could be tedious, due to data type, volume and availability. We propose an unsupervised machine learning-based approach for extracting forensically sound evidence from such drones and test its efficacy for a specific drone type, namely, DJI Phantom P4.