Keywords
digital evidence
telemetry
UAV
digital media
IoT
How to Cite
Abstract
The article is devoted to a comprehensive analysis of the scientific and methodological foundations for the study of modern digital storage media and a specific type of digital footprints - telemetric data, within the framework of forensic computer-technical examination. The paper substantiates that the rapid evolution of unmanned aerial systems (UAS), Internet of Things (IoT) devices, and the implementation of new file systems requires a transformation of classical approaches to the extraction and analysis of evidence. The aim of the study is to develop and scientifically substantiate methodological approaches to the study of telemetry as a key source of forensically significant information. The methodological basis of the work consists of systems analysis methods, comparative legal methods, and special digital forensic methods (forensic imaging, live analysis). Particular attention is paid to Soft-ware-Defined Radio (SDR) technologies as a tool for the verification of digital evidence. In the course of the research, the architectural features of the APFS (Apple File System) were analyzed, in particular, the Copy-on Write and Snapshots mechanisms, which open up new opportunities for recovering deleted telemetric logs. A classification of telemetry into external, internal, and cloud categories has been defined, allowing the expert to structure the process of searching for evidence. The role of SDR technologies in the process of identifying devices by radio frequency signatures and validating GPS coordinates contained in UAV flight logs is highlighted. The scientific novelty of the results obtained lies in the combination of classical computer-technical examination methods with radio-technical analysis of control signals, which allows not only the reconstruction of events but also the detection of signs of intellectual interference (GPS-spoofing, wiping). The practical significance of the work lies in the formulation of recommendations for forensic experts on working with proprietary data formats (on the example of the MAVLink protocol and DJI logs). The proposed approaches will help toincrease the objectivity and reliability of expert opinions in cases involving the use of high-tech devices.
References
Pro sudovu ekspertyzu: Zakon Ukrainy vid 25.02.1994 № 4038-XII [On forensic examination: Law of Ukraine]. (1994). Retrieved April 20, 2026, from https://zakon.rada.gov.ua/laws/show/4038-12 (in Ukrainian)
Instruktsiia pro pryznachennia ta provedennia sudovykh ekspertyz ta ekspertnykh doslidzhen: Nakaz Ministerstva yustytsii Ukrainy vid 08.10.1998 № 53/5 [Instruction on the appointment and conduct of forensic examinations]. (1998). Retrieved April 20, 2026 (in Ukrainian)
Bilyk, O. S., & Martynchuk, O. O. (2024). Doslidzhennia BPLA v sudovii kompiuterno-tekhnichnii ekspertyzi [UAV research in forensic computer examination]. In Proceedings of the VIII International Scientific Conference. Kyiv. (in Ukrainian)
Suleimanov, E. A., Suleimanov, S. A., Martynchuk, O. O., & Bilyk, O. S. (2023). Doslidzhennia metodiv lokalizatsii dzherela vyprominiuvannia… [Methods of RF source localization using SDR]. In ICTC-2023 Proceedings (pp. 57–60). (in Ukrainian)
Karpinska, N., & Krykunov, О. (2017). Certain Issues of Carrying Out Judicial Computer-Technical Expertise in Criminal Proceeding. History and Law Journal, 9(1), 140–144. Retrieved from https://chasopys.hl.vnu.volyn.ua/index.php/chasopys/article/view/351. (in Ukrainian)
Cheremnova, A., & Bielik, L. (2023). Digital information as an object of expert examination in the context of digitalization: problems and prospects of development. Criminalistics and Forensic Expertise, (68), 57–64. https://doi.org/10.33994/kndise.2023.68.06
Bilyk, O. S., & Martynchuk, O. O. (2023). Ohliad metodiv vyiavlennia BPLA… [Review of UAV detection methods using SDR]. In ICTC-2023 Proceedings (pp. 52–56). (in Ukrainian)
Bilyk, O. S., & Martynchuk, O. O. (2024). Stvorennia modeli shtuchnoho intelektu dlia vyiavlennia BPLA [AI model for UAV detection]. In Radioelectronics and Youth Forum (Vol. 4, pp. 5–7). (in Ukrainian)
Bilyk, O. S., & Martynchuk, O. O. (2025). Doslidzhennia spektralnykh kharakterystyk syhnaliv BPLA [Spectral characteristics of UAV signals]. In Forensic Science Conference Proceedings. (in Ukrainian)
Kuchuk, H., Mozhaiev, O., Tiulieniev, S., Mozhaiev, M., Kuchuk, N., Khorobrykh, P., Gnusov, Y., Horelov, Y., Svitlychnyi, V., & Bilyk, O. (2025). Devising a method for managing computing resources in a fog layer of the mobile high-density internet of things. Eastern-European Journal of Enterprise Technologies, 6(4 (138), 15–25. https://doi.org/10.15587/1729-4061.2025.344553
Bilyk, O. S., & Martynchuk, O.O. (2024). Development of software for UAV signal processing and their further use in machine learning. Collection of Scientific Papers
«ΛΌГOΣ», (April 26, 2024; Bologna, Italy), 231–235. https://doi.org/10.36074/logos-26.04.2024.047
Babenko В., Luchenko С., Bilyk О., & Drozdyk E. (2025). Visual System For Setting Up Machine Learning Algorithms And Data. Measuring And Computing Devices In Technological Processes, (3), 194–203. https://doi.org/10.31891/2219-9365-2025-83-26
Casey, E. (2011). Digital evidence and computer crime (3rd ed.). Academic Press. https://doi.org/10.1016/C2009-0-20033-X
Hamdi, Dua'a & Iqbal, Farkhund & Alam, Saiqa & Kazim, Abdulla & MacDermott, Áine. (2019). Drone Forensics: A Case Study on DJI Phantom 4. 1-6. 10.1109/AICCSA47632.2019.9035302.
Yousef, Maryam & Iqbal, Farkhund & Hussain, Mohammed. (2020). Drone Forensics: A Detailed Analysis of Emerging DJI Models. 066-071. 10.1109/ICICS49469.2020.239530.
Horsman, Graeme. (2016). Unmanned aerial vehicles: A preliminary analysis of forensic challenges. Digital Investigation. 16. 1-11. DOI: 10.1016/j.diin.2015.11.002
Rekhis, S., & Boudriga, N. (2020). Formal forensic analysis of digital evidence in smart cities. IEEE Communications Magazine, 58(3), 60–66. https://doi.org/10.1109/MCOM.001.1900534
ISO. (2012). ISO/IEC 27037: Guidelines for identification, collection, acquisition and preservation of digital evidence.
ISO. (2015). ISO/IEC 27041: Guidance on assuring suitability and adequacy of incident investigative methods.
ISO. (2015). ISO/IEC 27042: Guidelines for the analysis and interpretation of digital evidence.
NIST. (2006). Guide to integrating forensic techniques into incident response (SP 800-86).
NIST. (2014). Guidelines on mobile device forensics (SP 800-101 Rev.1).
MAVLink Development Team. (2026). MAVLink micro air vehicle communication protocol. Retrieved March 20, 2026, from https://mavlink.io
ArduPilot Dev Team. (2026). ArduPilot documentation: DataFlash logs. Retrieved April 20, 2026, from https://ardupilot.org
PX4 Development Team. (2026). PX4 user guide: ULog file format. Retrieved March 20, 2026, from https://docs.px4.io
DJI. (2026). DJI flight log data analysis documentation. Retrieved March 20, 2026, from https://www.dji.com