Forensics of a DJI Mavic 3 seized by the Coast Guard · 3D flight simulation · defendant conviction
A forensic unit handed DSET the memory of a DJI Mavic 3 seized by the Coast Guard. Drone flight history + video recording + telemetry analysis were needed in court. Following the ISO 27037 procedure DSET produced a bit-perfect image, carved deleted video, and prepared a 3D flight simulation. The court accepted the technical expert opinion 100%; the defendant received a 4-year prison sentence.
01 The Challenge
A DJI Mavic 3 + 1 SD card 64GB + 1 internal storage 8GB. The flight date in dispute (the defendant says "I didn't fly it that day"). The video was deleted but occupies space in internal storage (recoverable). The chain of custody is critical and the ISO 27037 procedure is mandatory. The defendant says "the drone is not mine."
02 DSET's Approach
T+0 · ISO 27037
A bit-perfect image was taken with a write-blocker (3 hours) + an SHA-256 hash record + the chain of custody document was signed. DSET started in the capacity of expert witness.
T+72h · Flight log
DJI flight log analysis: GPS coordinates + IMU + battery + camera log. The defendant's "I didn't fly it that day" claim was challenged; the GPS data proved the place + time.
T+1 week · Video carving
Deleted video carving (FAT32 cluster recovery): 14 videos recovered. Recordings of the moment of the crime + the license plate of the defendant's vehicle were identified.