RECORD-LEVEL VALIDATION OF OPEN-SOURCE UAV FLIGHT LOG PARSERS ON THE NIST CFREDS CORPUS
DOI:
https://doi.org/10.37943/ZUOX7374Keywords:
drone forensics, flight log parsing, tool validation, known-answer testing, record-level comparison, DJI DAT, ArduPilot DataFlash, NIST CFReDS, repeatability, silent failureAbstract
Examiners read drone flight logs with open-source parsers, and published comparisons of these parsers count the rows a tool writes or note whether it crashed. We tested whether such counts say anything about the evidence. Six parsers (DatCon, DROP, DRDP, Fodogu, pymavlink and GRYPHON) were run three times on each of the 72 files of four NIST CFReDS drone datasets, 1,296 runs with pinned versions and hashed inputs and outputs. Every coordinate a tool wrote was compared with two reference decoders: one accepts a DJI packet only when its checksum verifies, the other reproduces the Mission Planner exports shipped with the ArduPilot logs. On the DJI Phantom 3 files, DatCon and DROP wrote no unsupported position and agreed exactly wherever both reported one; 729,793 reference records (82.4%) are reproduced by both. The count differences earlier read as complementary recovery come from repeated rows and from two undocumented display rules: DROP blanks positions logged with two or fewer satellites, and DatCon writes nothing before a flag set by the first record with non-zero position and height. At the rate used here, 98.3% of DatCon's GPS-receiver rows repeat an earlier value (97.9% at its 30 Hz default). Runs that ended with status zero and no coordinates from a file holding them made up 21 of 126 runs on formats a tool claims to support and 61 of 120 on other formats. On the ArduPilot logs, 545 of 927 positions that pass a plain latitude and longitude range test were logged without a three-dimensional fix. All 431 completed run triples were bit-identical. The procedure is stated as a formal model, so that each reported quantity has a definition.
References
. Studiawan, H., Grispos, G., & Choo, K.-K. R. (2023). Unmanned aerial vehicle (UAV) forensics: The good, the bad, and the unaddressed. Computers & Security, 132, 103340. https://doi.org/10.1016/j.cose.2023.103340
. Thantilage, R. D., Buttner, G., & Genoe, R. (2025). Drone forensics in law enforcement: Assessing utilization, challenges, and emerging necessities. Forensic Science International: Digital Investigation, 55, 302003. https://doi.org/10.1016/j.fsidi.2025.302003
. Studiawan, H., & Choo, K.-K. R. (Eds.). (2026). Drone and UAV forensics. Springer. https://doi.org/10.1007/978-3-031-93511-4
. Horsman, G. (2016). Unmanned aerial vehicles: A preliminary analysis of forensic challenges. Digital Investigation, 16, 1–11. https://doi.org/10.1016/j.diin.2015.11.002
. Bouafif, H., Kamoun, F., Iqbal, F., & Marrington, A. (2018). Drone forensics: Challenges and new insights. In 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS). IEEE. https://doi.org/10.1109/NTMS.2018.8328747
. Clark, D. R., Meffert, C., Baggili, I., & Breitinger, F. (2017). DROP (DRone Open source Parser) your drone: Forensic analysis of the DJI Phantom III. Digital Investigation, 22, S3–S14. https://doi.org/10.1016/j.diin.2017.06.013
. Walker, B. (2019). DatCon: A converter for DJI flight logs (Version 3.5.0) [Computer software]. https://github.com/BudWalkerJava/DatCon
. FOSEGU. (2024). Fodogu: DJI drone forensic tool [Computer software]. https://github.com/FOSEGU/Fodogu
. Zhao, Z., Wang, Y., & Liao, G. (2024). Digital forensic research for analyzing drone and mobile device: Focusing on DJI Mavic 2 Pro. Drones, 8(7), 281. https://doi.org/10.3390/drones8070281
. Mantas, E., & Patsakis, C. (2019). GRYPHON: Drone forensics in dataflash and telemetry logs. In N. Attrapadung & T. Yagi (Eds.), Advances in Information and Computer Security (IWSEC 2019), LNCS 11689 (pp. 377–390). Springer. https://doi.org/10.1007/978-3-030-26834-3_22
. ArduPilot Development Team. (2024). pymavlink: A Python MAVLink library (Version 2.4.49) [Computer software]. https://github.com/ArduPilot/pymavlink
. Salamh, F. E., Mirza, M. M., & Karabiyik, U. (2021). UAV forensic analysis and software tools assessment: DJI Phantom 4 and Matrice 210 as case studies. Electronics, 10(6), 733. https://doi.org/10.3390/electronics10060733
. Baibussinov, A., Shayakhmetov, M., Rzayeva, L., & Yesbergenov, K. (2026). A hardware-software complex for the reconstruction of unmanned aerial vehicle digital traces under logical data damage using LSTM-based telemetry recovery and multi-source confidence scoring. Journal of Cybersecurity and Privacy, 6(4), 123. https://doi.org/10.3390/jcp6040123
. National Institute of Standards and Technology. (2023). Computer Forensics Tool Testing Program (CFTT). https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt
. Horsman, G. (2019). Tool testing and reliability issues in the field of digital forensics. Digital Investigation, 28, 163–175. https://doi.org/10.1016/j.diin.2019.01.009
. International Organization for Standardization. (2012). ISO/IEC 27037:2012 Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence. ISO.
. International Organization for Standardization. (2017). ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories. ISO.
. National Institute of Standards and Technology. (2018). Computer Forensic Reference Data Sets: Drone images. https://cfreds.nist.gov/
. Wilson, E. B. (1927). Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158), 209–212. https://doi.org/10.1080/01621459.1927.10502953
. Roder, A., Choo, K.-K. R., & Le-Khac, N.-A. (2018). Unmanned aerial vehicle forensic investigation process: DJI Phantom 3 drone as a case study. arXiv. https://arxiv.org/abs/1804.08649
. Sihag, V., Choudhary, G., Choudhary, P., & Dragoni, N. (2023). Cyber4Drone: A systematic review of cyber security and forensics in next-generation drones. Drones, 7(7), 430. https://doi.org/10.3390/drones7070430
. Kim, H., We, D., An, W., & Park, M. (2026). Correlation analysis of pilots and drones using DJI cloud forensic data. Forensic Science International: Digital Investigation, 57, 302101. https://doi.org/10.1016/j.fsidi.2026.302101
. Metz, J. (2024). libewf: Library and tools to access the Expert Witness Compression Format (EWF) [Computer software]. https://github.com/libyal/libewf
. Zhao, Z. (2025). DRDP: Drone data parser [Computer software]. https://github.com/EveZzy/DRDP
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Articles are open access under the Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Authors who publish a manuscript in this journal agree to the following terms:
- The authors reserve the right to authorship of their work and transfer to the journal the right of first publication under the terms of the Creative Commons Attribution License, which allows others to freely distribute the published work with a mandatory link to the the original work and the first publication of the work in this journal.
- Authors have the right to conclude independent additional agreements that relate to the non-exclusive distribution of the work in the form in which it was published by this journal (for example, to post the work in the electronic repository of the institution or publish as part of a monograph), providing the link to the first publication of the work in this journal.
- Other terms stated in the Copyright Agreement.