\documentclass[conference]{IEEEtran}
\IEEEoverridecommandlockouts
% The preceding line is only needed to identify funding in the first footnote. If that is unneeded, please comment it out.
\usepackage{cite}
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{graphicx}
\usepackage{rotating}
\usepackage{textcomp}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage{multirow}
\usepackage{adjustbox}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{float}
\usepackage{caption}
% \usepackage{geometry} % <-- Ini opsional

\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
    T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}

    \renewcommand\IEEEkeywordsname{Keywords}
\begin{document}

\title{Integration of Forensic Artifacts from Android-based Drone Controllers into Android Logs Events and Protobuf Parser\\
%{\footnotesize \textsuperscript{*}Note: Sub-titles are not captured in Xplore and
%should not be used}
% \thanks{Identify applicable funding agency here. If none, delete this.}
}

\author{\IEEEauthorblockN{Muhammad Rias Ramadan}
\IEEEauthorblockA{\textit{Department of Informatics} \\
\textit{Institut Teknologi Sepuluh Nopember}\\
Surabaya, Indonesia\\
6025241049@student.its.ac.id }
\and
\IEEEauthorblockN{Hudan Studiawan}
\IEEEauthorblockA{\textit{Department of Informatics}\\
\textit{Institut Teknologi Sepuluh Nopember}\\
Surabaya, Indonesia\\
hudan@its.ac.id}
\and
\IEEEauthorblockN{Ary Mazharuddin Shiddiqi}
\IEEEauthorblockA{\textit{Department of Informatics} \\
\textit{Institut Teknologi Sepuluh Nopember}\\
Surabaya, Indonesia\\
ary.shiddiqi@its.ac.id}
\and
% \IEEEauthorblockN{6\textsuperscript{th} Given Name Surname}
% \IEEEauthorblockA{\textit{dept. name of organization (of Aff.)} \\
% \textit{name of organization (of Aff.)}\\
% City, Country \\
% email address or ORCID}
}

\maketitle

\begin{abstract}
The rapid development of drone technology has revolutionized various sectors, including mapping, agriculture, tourism, and even warfare. However, on the other hand, this expansion has also facilitated the misuse of Unmanned Aerial Vehicles (UAVs) for illegal activities that threaten public safety and national security. Digital forensic investigations face significant challenges when drones are damaged or destroyed. This research addresses this critical gap by focusing on the forensic analysis of Android mobile controllers used in DJI drones, which dominate the commercial market. We developed a new open-source parser integrated into the Android Logs Events and Protobuf Parser (ALEAPP) platform. This parser is designed to decode and extract flight data from .DAT and .TXT log files. Our comprehensive analysis covers various DJI drone models (Mavic 2, Mavic 2 Enterprise, Mavic Air, Mavic Pro, Phantom 3, Phantom 4, and Phantom 4 Pro), which provide results in the form of flight timestamps and GPS coordinates. This contributes to forensic investigations involving UAV technology.
\end{abstract}

\begin{IEEEkeywords}
Drone Forensics, UAV, ALEAPP, Flight Log Analysis, Result Show.
\end{IEEEkeywords}

\section{Introduction}

The development of Unmanned Aerial Vehicle (UAV) technology has led to its widespread use in various sectors, ranging from agriculture \cite{B1}, the military \cite{B2}, tourism \cite{B3}, to inappropriate areas such as smuggling, drug trafficking \cite{B4}. Another area is warfare, as seen in Palestine \cite{B5}, and most recently, the conflict between Russia and Ukraine, which also involved the use of drones \cite{B6}. The ease of access and operation has made drones increasingly popular. Market projections show growth in the adoption of drones in various domains, underlining the relevance and broad potential of this technology \cite{B19}. 

However, along with the popularity and advancement of drones, challenges have also arisen regarding their potential misuse for inappropriate purposes, as the purpose of any technology is to be a tool that facilitates human activities. There are various types of drones, ranging in size from 75 mm to more than 300 mm \cite{B7}. They also have the ability to operate remotely and access hard-to-reach locations, making them vulnerable to use in various illegal activities. Several important incidents have emphasized the urgency of this issue. For example, cases of smuggling prohibited goods, violations of restricted airspace, or even incidents that could potentially endanger public safety. In each of these incidents, identifying the perpetrators and recovering the facts is crucial, but is often hampered by the complexity of the digital data stored on the drone or drone control device \cite{B8}. Despite growing interest in the field of digital forensics, there is a need for methods to extract artifacts or obtain information generated by drones.

Currently, the main challenges in digital forensics, especially on drone devices, lie in the diversity of drone models, the control devices used, and the complexity of the data structure produced. Important data such as flight records, location coordinates, routes taken, and user profiles are scattered across various directories. Several studies have been conducted to extract artifacts from drones, including GRYPHON, an open-source tool designed to extract and analyze data from binary logs, map GPS coordinates, detect unexpected altitude variations, and present findings in a structured timeline to facilitate forensic investigations \cite{B9}. Furthermore, (DROP) Drone Open Source Parser is also an open tool that parses DAT and TXT files extracted from the internal device of the DJI Phantom III drone \cite{B10}. 

As well as the (DRDP) drone data parser that provides comprehensive forensics on the DJI Mavic 2 Pro by extracting internal and external data from the drone \cite{B11}. Datcon and CSVView are two open source tools that are used separately. Datcon can handle .DAT files. CSVView can operate on .DAT and .TXT files \cite{B12}. Of the existing drone forensic tools, most are still limited to one type of artifact produced by drones, such as flight logs with extensions .DAT and .TXT. Therefore, a comprehensive tool is needed. This gap hinders an efficient and comprehensive investigation process, as investigators must rely on separate tools to obtain information that can aid the forensic investigation process.


This study presents research on the integration of forensic artifacts from Android-based drone controllers into the Android Log Event and Protobuf Parser (ALEAPP) platform. This integration aims to improve the efficiency and scope of digital forensic analysis in cases involving drones. The main contributions of this study are as follows:

1. Identification of drone forensic artifacts: This study conducted an analysis to identify the storage location and structure of digital artifacts generated by popular drone control applications on the Android operating system.

2. Parser development: This research designed and implemented a new parser to extract flight data in the form of activity logs, timestamps (time), and GPS (longitude, latitude).

3. Integration of the parser into the Android Log Event and Protobuf Parser (ALEAPP): By integrating this, ALEAPP's ability to automatically extract, parse, and present drone controller forensic artifacts in a format that is easily understood by investigators is improved.

This paper is organized as follows. Section 2 will present a summary of previous research related to drone forensics. Next, Section 3 details the methodology used in artifact identification and parsing module development. In Section 4, we will discuss the parser implementation and integration into ALEAPP and present the test results. Findings and discussion will be presented in Section 5. Finally, Section 6 will contain conclusions and directions for future research.



\section{Related Work}

With the advancement and increasing use of unmanned aerial vehicles (UAVs) or drones, the field of drone forensics has emerged as an important area of research that has attracted the interest of academics \cite{B13}. As a relatively new discipline, the existing literature is dominated by case study-based publications. In such research, a systematic and comprehensive forensic examination is necessary in investigating various types of data on drones, from the data acquisition stage to reporting on drone devices \cite{B14}. Therefore, this section review and summarize several key works that have been published related to drone forensics to provide a foundation for this research.

Research in \cite{B15} presents a set of guidelines designed to assist the forensic investigation process on drone devices. Using the DJI Mavic Air as a case study, this research focuses on the analysis of digital artifacts from two main sources: DAT binary files accessed from the drone and flight log files generated by the DJI GO 4 application. The purpose of this analysis is to collect evidence by applying various investigation techniques. These techniques are used to explain and interpret the data that has been successfully collected, in line with standard forensic procedures that begin with data collection and end with the preparation of a final report. Several similar studies have also been conducted on several drone models such as the Yuneec Typhoon \cite{B16}, DJI Spark Drone \cite{B17}, and DJI Phantom 3 Professional \cite{B18}.

In addition, an open-source forensic tool called DROP (Drone Open source Parser) was introduced in the study \cite{B10} to analyze data files from DJI Phantom III drones. Developed using Python 3.4, this tool is capable of extracting valuable forensic findings, including GPS location data, battery information, and flight logs from DAT and TXT files. However, the authors \cite{B10} only focused on developing the tool without comparing it to other available software. As a result, this study does not provide a strong argument regarding the advantages or uniqueness of the tool they propose.

Another research developed a parser to address difficulties in drone forensics. This tool is designed to extract data generated by drone devices. The DJI Mavic 2 Pro was used as a case study for forensic analysis. The open-source tool used in this study, known as Drone Data Parser (DRDP), allows investigators to parse evidence files, analyze file structures, and encryption against three case studies on DAT, TXT, and default files to test the proposed parser. The results show that important encrypted data, including GPS location, flight time, altitude, and speed, can be recovered and decrypted correctly, thus providing valid evidence for investigations \cite{B11}.

DatCon and CSVView are two popular open-source data extraction tools for DJI drones, but they have slightly different support coverage \cite{B19}. DatCon can process DAT files from the Inspire, Phantom, Mavic, and Matrice series (exporting to CSV, KML, TXT), while CSVView also supports TXT files from DJI Go. A study in \cite{B12} compared these two tools in terms of features, ease of use, and data completeness. Using 10 DAT files from DJI Phantom 4 and 10 from DJI Inspire 1, the study found that the data extracted from Phantom 4 was more complete than the data from Inspire 1.

A review of the existing literature shows a lack of research in integration of drone flight logs to android forensic framework. This limitation motivated this research to propose the development of a parser integrated with the ALEAPP integrated framework platform. The approach described in the following section will be applied to the DJI Mavic series of drones, focusing on the analysis of data from various file types (DAT, and TXT) originating from Android control devices.


\section{Proposed Method}

\begin{figure*}[htbp]
\centerline{\includegraphics [width=0.85\linewidth]{Proposed Method.png}}
\caption{Proposed Method.}
\label{fig}
\end{figure*}

The main objective of this research is to obtain, examine, and analyze digital artifacts from the DJI series drone control devices. To achieve this, this research developed a special parser that functions to extract flight logs and integrate them into an integrated forensic platform, namely ALEAPP, as illustrated in Fig. 1.

The proposed method architecture comprises four stages consisting of: (1) data acquisition, (2) development of a flight log parser, (3) implementation of four forensic case studies, and (4) integration of the parser into the ALEAPP framework. The results of this method are expected to serve as important reference material for investigators in solving drone-related cases. Details of each stage will be discussed in the following subsections, while the list of drone devices used in this experiment is presented in Table I.



\subsection{Data Acquisition From DJI Series Drones}\label{AA}


This study focuses on data extraction from drone control devices, specifically Android phones connected to the DJI series drones. The main data source used is the CFReDS dataset, which is publicly available. Analysis of the Android device revealed the existence of two types of flight log files. First, TXT files were found in the /DJI/dji.go.v4/FlightRecord directory with the naming format DJIFlightRecord YYYY-MM-DD [HH-MM-SS].txt. These files contain essential flight data such as timestamp, longitude, and latitude.

Second, more extensive flight data are found in DAT format in the /DJI/dji.go.v4/MCDatFlightRecords directory. These files are named in the format YY-MM-DD [HH-MM-SS] FLY\#\#\#.DAT and contain a much larger collection of flight data. For both file types, the timestamp in the file name indicates the start time of recording.

\subsection{Development of Drone Flight Log Parser}

\begin{algorithm}[H]
\caption{Pseudocode of the Parser Process}
\label{alg:dat_parsing_numbered}
\scriptsize
\begin{algorithmic}[1] 
\item \textit{// Prepare a master list for all results.}
\item Initialize `masterGPSResults` as an empty list
\item \textit{// Go through each file provided.}
\item \textbf{For each} `file` in `listOfInputFiles:
\begin{enumerate}
\item \textit{// Open containers if needed.}
\item `listOfDocuments` $\leftarrow$ ExtractFromContainerIfNeeded(`file`)
\item \textit{// Check every document found.}
\item \textbf{For each} `document` in `listOfDocuments`:
        \begin{enumerate}
            \item \textit{// Make sure it's the right kind of document.}
            \item \textbf{If} `document` is a valid flight log:
            \begin{enumerate}
                \item \textit{// Start searching within this valid document.}
                \item \textbf{While} there is still data to read in `document`:
                \begin{itemize}
                \item Find the next valid `record` (check marker 0x55 and CRC)
                    \item \textbf{If} a valid `record` was found \textbf{and} its topic is GPS:
                    \begin{itemize}
                        \item Decode the `record`'s content
                        \item Get (`Time`, `Latitude`, `Longitude`) from decoded content
                        \item Add (`Time`, `Lat`, `Lon`) to `masterGPSResults`
                    \end{itemize}
                \end{itemize}
            \end{enumerate}
        \end{enumerate}
    \end{enumerate}
    \item \textit{// Return the complete list of all GPS data found.}
    \item \textbf{Return} `masterGPSResults`
END
\end{algorithmic}
\end{algorithm}



\begin{table*}
    \centering
    \caption{Specifications of Drones Used in Research}
    \label{tab:drone_specs_rotated}
    \tiny
    \begin{tabular}{llllllll}
        \toprule
        \textbf{Specifications} & \textbf{DJI Mavic 2} & \textbf{DJI Mavic 2 Ent.} & \textbf{DJI Mavic Air} & \textbf{DJI Mavic Pro} & \textbf{DJI Phantom 3} & \textbf{DJI Phantom 4} & \textbf{DJI Phantom 4 Pro V2} \\
        \midrule
        Cost (USD) & \$1,449 & \$1,999 & \$899 & \$2,199 & \$1,259 & \$1399 & \$1,799 \\
        Release Date & Aug 2018 & 2018 & 2018 & Oct 2016 & Apr 2015 & 2016 & May 2018 \\
        Weight & 907 g & 905 g & 430 g & 734 g & 1280 g & 1380 g & 1388 g \\
        Internal Storage & 8 GB & 24 GB & 8 GB & 8 GB & microSD card & N/A & microSD card \\
        External Storage & micro SD & micro SD & micro SD & micro SD & micro SD & micro SD & micro SD \\
        Transmission System & Wi-Fi & Wi-Fi & Wi-Fi & Wi-Fi & Wi-Fi & Wi-Fi & Wi-Fi \\
        Camera Resolution & 20 MP 4K/HD & 48 MP 4K/HD & 12MP 4K/HD & 12MP 4K/HD & 12MP 4K/HD & 12MP 4K/HD & 20MP 4K/HD \\
        Flight Time(M)/Range (Km) & 31 minutes & 31 minutes & 21/10 & 27 minutes & 25 minutes & 28/7 & 30 minutes \\
        Max Speed (kph) & 72 kph & 72 kph & 68 kph & 40 kph & 57.6 kph & 72 kph & 72 kph \\
        Return to Home Location & Yes & Yes & Yes & Yes & Yes & Yes & Yes \\
        Operating System & Android / iOS & Ubuntu & Android / iOS & Android / iOS & Android / iOS & Ubuntu & Android / iOS \\
        Battery (Mah) & 3850 & 3850 & 2375 & 3830 & 4480 & 6000 & 5870 \\
        Operating Frequency Ghz & 2.4 \& 5.8 & 2.4 \& 5.8 & 2.4 \& 5.8 & 2.4 \& 5.8 & 2.4 \& 5.8 & 2.4 \& 5.8 & 2.4 \& 5.8 \\
        Flight Controller & mobile app & mobile app & mobile app & mobile app & mobile app & mobile app & mobile app \\
        \bottomrule
    \end{tabular}
\end{table*}


Based on the analysis flow illustrated in Fig. 1, a parser was developed to extract forensic data from DJI series drone control devices. This parser is designed to be integrated into the ALEAPP integrated platform and is capable of analyzing various types of files, including DAT and TXT, developed using Python. The fundamental process of this data extraction is described in detail in Algorithm 1. This process begins by iterating through each file in the listOfInputFiles. For each file, the algorithm extracts the listOfDocuments contained within it and validates each document to ensure that it is a valid flight log. If a document is valid, the system scans each record within it; if the record is identified as GPS data, the information is decoded and added to the final results list, masterGPSResults.


This integrated parser allows the simultaneous processing of multiple types of flight logs in a single interface, making the analysis process more efficient than sequential processing. Users can operate this tool through the ALEAPP graphical interface (aleappGUI.py), which provides specific modules (such as droneDATfiles, droneTXTfiles) to parse each file type from the specified directory. The extraction process can be further customized through input parameters during execution.

Files .TXT and .DAT are analyzed as flight log artifacts generated by the DJI GO and DJI Fly drone control applications. .TXT files contain flight session summaries and light telemetry in the form of randomized data. The parsing process is performed by extracting an initial 11-byte header to determine the size of the record area and session metadata (e.g., timestamp, longitude, and latitude). Next, the encrypted records are decoded using the CRC64-based GetScrambleBytes function to obtain the actual telemetry data.

Meanwhile, the .DAT file is a compressed binary telemetry log with a higher level of detail. Parsing is performed in several stages, namely decompression using zlib, identification of valid sub-blobs using the byte magic “BUILD”, segmentation of records based on the 0x55 marker byte, and integrity validation using a 16-bit CRC table. Data extraction is performed on records with type == 2096, where the Protobuf structure is mapped using struct.unpack(“<IIii”, payload[:16]) to obtain information about Date, Time, Longitude, and Latitude. This process enables the retrieval of accurate telemetry data, resulting in comprehensive forensic evidence for investigative purposes.


\subsection{Integration of Drone Flight Logs Parser into ALEAPP Framework}

This research uses ALEAPP (Android Log Events And Protobuf Parser), an open-source forensic framework designed for Android device analysis. The main purpose of ALEAPP is to serve as a rapid triage tool in forensic laboratories, especially when commercial equipment is unavailable or during mass investigations. In the context of this study, ALEAPP was specifically used to analyze the Android operating system on drone control devices. The specific contribution of this study is the development and integration of a series of new parsers into ALEAPP to automate the process of parsing drone artifacts. After evaluating various existing artifacts, the author built a Python script capable of parsing flight log file types (droneDATfiles, and droneTXTfiles). 


\section{Result and Analysis}

In this section, we describe the details of the dataset used, which consists of several types of DJI series drones. Next, we describe the experimental setup by creating a parser that we use to extract flight log that are integrated into the ALEAPP platform. Next, we discuss the performance of our proposed parser. The performance of our proposed parser is then compared with existing methods. Finally, we reveal the challenges and limitations of our research that we encountered during the experiment. 

\subsection{Dataset Preparation}

This study uses a flight log dataset obtained from various drone models in the DJI series to ensure that the developed parser has compatibility and robustness in handling data format variations. The dataset consists of forensic data collected from mobile devices connected to drones during flight operations. The specifications of the dataset used are summarized in Table II.


\subsection{Experimental Setup}

The experimental setup in this study was designed to develop and integrate a specialized parser into the ALEAPP forensic platform to extract forensic artifacts from DJI drone flight logs. The parser was developed using Python under the names droneDATFiles and droneTXTfiles, which were specifically designed to process binary files with the extensions .DAT and .TXT. The development of the parser involved reverse engineering the DJI format through analysis of the binary data structure, including zlib compression decoding, mapping of critical data offsets, and implementation of a CRC checksum algorithm for data integrity validation. The parser is equipped with GPS decoding capabilities for record type 0x830 (2096) and supports more than 20 DJI drone models through acconfig dictionary configurations covering the Mavic, Phantom, and Matrice series. The parser was then integrated as an official module in ALEAPP version 3.4.0 with the file search pattern **/*. DAT or **/*.TXT  to automatically detect target files. The extraction results are generated in three different formats: interactive HTML reports via ArtifactHtmlReport, TSV files for structured data analysis, and temporal timelines for chronological flight analysis, utilizing the ALEAPP standard reporting framework to ensure output consistency and seamless integration with other forensic modules. Experiments were conducted in a controlled environment with ALEAPP v3.4.0 configured on the Windows 11 operating system using Python 3.11.6.


\begin{figure}[htbp]
\centerline{\includegraphics[width=0.7\linewidth]{ALEAPP.png}}
\caption{ALEAPP Interface}
\label{fig:aleapp_interface}
\end{figure}

\begin{table*}[h!]
\centering
\caption{List of primary data used}
\label{tab:my_professional_table}
\scriptsize
\begin{tabular}{lllll}
\toprule
\textbf{Drone type} & \textbf{Dataset} & \textbf{Year / Month} & \textbf{Evidence Source} & \textbf{File name} \\
\midrule
\multirow{4}{*}{DJI Mavic Air} & df048\_DJI\_Mavic\_Air & 2018 / 04 & mobile\_android\_logical & MC 04.zip \\
 & df049\_DJI\_Mavic\_Air & 2018 / 06 & mobile\_android\_logical & Android\_Logical.zip \\
 & df050\_DJI\_Mavic\_Air & 2018 / 06 & mobile\_android\_logical & MC 05.zip \\
 & df050\_DJI\_Mavic\_Air & 2018 / 04 & mobile\_android\_logical & MC 06.zip \\
\addlinespace % Menambah spasi antar grup
\multirow{3}{*}{DJI Mavic Pro} & df019\_DJI\_Mavic\_Pro & 2017 / 08 & - & - \\
 & df020\_DJI\_Mavic\_Pro & 2017 / 08 & - & - \\
 & df021\_DJI\_Mavic\_Pro & 2017 / 08 & mobile\_android\_logical & Android\_Logical.zip \\
\addlinespace
\multirow{3}{*}{DJI Mavic 2 Enterprise} & df080\_Mavic\_2\_Enterprise & 2018 / 11 & mobile\_android & mobile\_android\_logical.zip \\
 & df081\_Mavic\_2\_Enterprise & 2018 / 11 & mobile\_android & mobile\_android\_logical.zip \\
 & df082\_Mavic\_2\_Enterprise & 2018 / 11 & mobile\_android & mobile\_android\_logical.zip \\
\addlinespace
\multirow{3}{*}{DJI Mavic 2} & df067\_DJI\_Mavic\_2\_Zoom & 2018 / 09 & mobile\_android\_logical & Android\_Logical.zip \\
 & df068\_DJI\_Mavic\_2\_Zoom & 2018 / 09 & mobile\_android\_logical & Android\_Logical.zip \\
 & df069\_DJI\_Mavic\_2\_Zoom & 2018 / 09 & mobile\_android\_logical & Android\_Logical.zip \\
\addlinespace
\multirow{3}{*}{DJI Phantom 3} & df001\_DJI\_Phantom\_3 & 2017 / 06 & - & - \\
 & df002\_DJI\_Phantom\_3 & 2017 / 06 & mobile\_android & Media01.zip \\
 & df003\_DJI\_Phantom\_3 & 2017 / 06 & mobile\_android\_backup & DF002\_flight.zip \\
\addlinespace
\multirow{4}{*}{DJI Phantom 4} & df004\_DJI\_Phantom\_4 & 2017 / 06 & - & - \\
 & df005\_DJI\_Phantom\_4 & 2017 / 06 & flight\_logs & flight\_logs.zip \\
 & & 2018 / 06 & mobile\_android\_backup & DF005\_flight.zip \\
 & df006\_DJI\_Phantom\_4 & 2017 / 06 & mobile\_android\_backup & DF006\_flight.zip \\
\addlinespace
\multirow{3}{*}{DJI Phantom 4 Pro\_V2} & df061\_DJI\_Phantom\_4\_Pro & 2018 / 06 & mobile\_android\_logical & mobile\_android\_logical.zip \\
 & Df062\_DJI\_Phantom\_4\_Pro & 2018 / 06 & mobile\_android\_logical & DF062 305.zip \\
 & Df063\_DJI\_Phantom\_4\_Pro & 2018 / 06 & mobile\_android\_logical & Media01.zip \\
\bottomrule
\end{tabular}
\end{table*}

\subsection{Performance of the Proposed Parser}

The DroneFlightDATFiles and DroneFlightTXTFiles parsers developed demonstrate good performance in extracting forensic artifacts from DJI drone flight logs. Based on the results of execution on a dataset consisting of 5,631 .DAT and .TXT files from various DJI drone models. The extraction process ran successfully without errors and was completed in an efficient time, with an average of 30 seconds required for each drone module. The parser successfully extracted complete GPS data, including accurate temporal timestamps and latitude and longitude coordinates in decimal format from various file sources, including flight logs directly from the DJI Go application and SDK log files from various flight sessions. The extraction results were generated in three different formats, namely interactive HTML reports and TSV files for structured data analysis. After the parser was successfully integrated into the ALEAPP framework, as shown in Fig. 2, it proved to be stable and reliable without interfering with other forensic modules. The results of the extraction process are shown in Tables III and IV in the form of timestamps, longitude, and latitude, and a comparison of the results with the previously existing tool, DRDP. This demonstrates the success of the .DAT and .TXT flight log extraction process.


\section{Conclusions and Future Works}

This study addresses the limitations of existing drone data parsers by developing an integrated method within a unified platform, which was then tested on seven DJI Mavic and Phantom series drone models. The results show that this parser is effective in extracting important artifacts from log files (.DAT and .TXT), namely precise timestamp data and geospatial information in the form of longitude and latitude. This success confirms that time and coordinate data are valuable digital evidence that can be used to reconstruct the chronology and flight route in an investigation.

However, this research is still limited to drone models from DJI and only focuses on flight log. Therefore, future research will be expanded to include more models from various manufacturers and explore other types of digital artifacts stored on the devices. Furthermore, this method will be applied in various case scenarios, especially those involving illegal activities, in order to develop more comprehensive and applicable forensic investigation techniques.



\begin{table*}[t!]
    \centering
    \caption{Comparison of .DAT Parser Integration Between ALEAPP and DRDP}
    \label{tab:drone_data_modern}
    \tiny
    \begin{tabular}{l ccc ccc c} % Menggunakan 'l' dan 'c' tanpa garis vertikal
        \toprule
        \multirow{2}{*}{\textbf{Type of Drone}} & \multicolumn{3}{c}{\textbf{.DAT}} & \multicolumn{3}{c}{\textbf{DRDP}} & \multirow{2}{*}{\textbf{Accuracy}} \\
        \cmidrule(lr){2-4} \cmidrule(lr){5-7} % Garis parsial untuk memisahkan sub-header
        & \textbf{Timestamp} & \textbf{Longitude} & \textbf{Latitude} & \textbf{Timestamp} & \textbf{Longitude} & \textbf{Latitude} & \\
        \midrule
        \multirow{6}{*}{DJI Mavic Pro} & 2018-06-19 19:02:09 & -106.2162638 & 39.961152 & 2018-06-19 19:02:09 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:09 & -106.2162638 & 39.961152 & 2018-06-19 19:02:09 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 2018-06-19 19:02:10 & -106.2162638 & 39.961152 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Mavic Air} & 2018-06-19 18:47:37 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:37 & -106.2166723 & 39.9613782 & 100\% \\
        & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 100\% \\
        & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 100\% \\
        & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 100\% \\
        & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:38 & -106.2166723 & 39.9613782 & 100\% \\
        & 2018-06-19 18:47:39 & -106.2166723 & 39.9613782 & 2018-06-19 18:47:39 & -106.2166723 & 39.9613782 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Mavic 2} & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 2018-06-19 19:02:07 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:08 & -106.2162638 & 39.961152 & 2018-06-19 19:02:08 & -106.2162638 & 39.961152 & 100\% \\
        & 2018-06-19 19:02:08 & -106.2162638 & 39.961152 & 2018-06-19 19:02:08 & -106.2162638 & 39.961152 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Phantom 4} & 2017-06-29 21:15:28 & -106.216507 & 39.9611765 & 2017-06-29 21:15:28 & -106.216507 & 39.9611765 & 100\% \\
        & 2017-06-29 21:15:29 & -106.2165046 & 39.9611767 & 2017-06-29 21:15:29 & -106.2165046 & 39.9611767 & 100\% \\
        & 2017-06-29 21:15:29 & -106.2165017 & 39.9611754 & 2017-06-29 21:15:29 & -106.2165017 & 39.9611754 & 100\% \\
        & 2017-06-29 21:15:29 & -106.2164985 & 39.9611754 & 2017-06-29 21:15:29 & -106.2164985 & 39.9611754 & 100\% \\
        & 2017-06-29 21:15:29 & -106.2164959 & 39.9611745 & 2017-06-29 21:15:29 & -106.2164959 & 39.9611745 & 100\% \\
        & 2017-06-29 21:15:30 & -106.2164936 & 39.9611739 & 2017-06-29 21:15:30 & -106.2164936 & 39.9611739 & 100\% \\
        \midrule
        \multirow{8}{*}{DJI Phantom 4 Pro V2} 
        & 2018-06-19 20:11:14 & -106.2212904 & 39.958967 & 2018-06-19 20:11:14 & -106.2212904 & 39.958967 & 100\% \\
        & 2018-06-19 20:11:14 & -106.2212901 & 39.9589667 & 2018-06-19 20:11:14 & -106.2212901 & 39.9589667 & 100\% \\
        & 2018-06-19 20:11:15 & -106.2212897 & 39.9589665 & 2018-06-19 20:11:15 & -106.2212897 & 39.9589665 & 100\% \\
        & 2018-06-19 20:11:15 & -106.2212892 & 39.9589664 & 2018-06-19 20:11:15 & -106.2212892 & 39.9589664 & 100\% \\
        & 2018-06-19 20:11:15 & -106.2212892 & 39.9589664 & 2018-06-19 20:11:15 & -106.2212892 & 39.9589664 & 100\% \\
        & 2018-06-19 20:11:15 & -106.2212889 & 39.9589665 & 2018-06-19 20:11:15 & -106.2212889 & 39.9589665 & 100\% \\
        \bottomrule
    \end{tabular}
\end{table*}








\begin{table*}[h]
    \centering
    \caption{Comparison of .TXT Parser Integration in ALEAPP vs DRDP.}
    \label{tab:drone_data_2}
    \tiny % Menggunakan font lebih kecil agar data muat
    \begin{tabular}{l ccc ccc c}
        \toprule
        \multirow{2}{*}{\textbf{Type of Drone}} & \multicolumn{3}{c}{\textbf{.TXT}} & \multicolumn{3}{c}{\textbf{DRDP}} & \multirow{2}{*}{\textbf{Accuracy}} \\
        \cmidrule(lr){2-4} \cmidrule(lr){5-7}
        & \textbf{Timestamp} & \textbf{Longitude} & \textbf{Latitude} & \textbf{Timestamp} & \textbf{Longitude} & \textbf{Latitude} & \\
        \midrule
        \multirow{6}{*}{DJI Mavic Pro} 
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 2018-06-20 06:55:32 & -106.2164804 & 39.9611945 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Mavic Air} 
        & 2018-06-20 02:55:39 & -106.2164754 & 39.9611971 & 2018-06-20 02:55:39 & -106.2164754 & 39.9611971 & 100\% \\
        & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 100\% \\
        & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 100\% \\
        & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 2018-06-20 02:55:39 & -106.2164755 & 39.9611973 & 100\% \\
        & 2018-06-20 02:55:39 & -106.2164755 & 39.9611972 & 2018-06-20 02:55:40 & -106.2164755 & 39.9611972 & 100\% \\
        & 2018-06-20 02:55:40 & -106.2164755 & 39.9611972 & 2018-06-20 02:55:40 & -106.2164755 & 39.9611972 & 100\% \\
        \midrule
        \multirow{4}{*}{DJI Mavic 2 Enterprise} 
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 100\% \\
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 100\% \\
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 100\% \\
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 2018-11-21 05:55:49 & -105.262435 & 39.9919431 & 100\% \\
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919432 & 2018-11-21 05:55:49 & -105.262435 & 39.9919432 & 100\% \\
        & 2018-11-21 05:55:49 & -105.262435 & 39.9919432 & 2018-11-21 05:55:49 & -105.262435 & 39.9919432 & 100\% \\
        \midrule
        \multirow{4}{*}{DJI Mavic 2} 
        & 2018-06-20 02:50:34 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:34 & -106.2164676 & 39.9611977 & 100\% \\
        & 2018-06-20 02:50:34 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:34 & -106.2164676 & 39.9611977 & 100\% \\
        & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 100\% \\
        & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 100\% \\
        & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 100\% \\
        & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 2018-06-20 02:50:35 & -106.2164676 & 39.9611977 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Phantom 3} 
        & 2017-06-30 03:39:52 & -106.2164982 & 39.9611823 & 2017-06-30 03:39:52 & -106.2164982 & 39.9611823 & 100\% \\
        & 2017-06-30 03:39:52 & -106.2164982 & 39.9611823 & 2017-06-30 03:39:52 & -106.2164982 & 39.9611823 & 100\% \\
        & 2017-06-30 03:39:53 & -106.2164983 & 39.9611824 & 2017-06-30 03:39:53 & -106.2164983 & 39.9611824 & 100\% \\
        & 2017-06-30 03:39:53 & -106.2164983 & 39.9611824 & 2017-06-30 03:39:53 & -106.2164983 & 39.9611824 & 100\% \\
        & 2017-06-30 03:39:53 & -106.2164984 & 39.9611822 & 2017-06-30 03:39:53 & -106.2164984 & 39.9611822 & 100\% \\
        & 2017-06-30 03:39:53 & -106.2164984 & 39.9611822 & 2017-06-30 03:39:53 & -106.2164984 & 39.9611822 & 100\% \\
        \midrule
        \multirow{6}{*}{DJI Phantom 4} 
        & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 100\% \\
        & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 100\% \\
        & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 2017-06-30 02:52:13 & -106.2165090 & 39.9611894 & 100\% \\
        & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 100\% \\
        & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 100\% \\
        & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 2018-06-20 02:52:14 & -106.2165089 & 39.9611893 & 100\% \\
        \midrule
        \multirow{4}{*}{DJI Phantom 4 Pro V2} 
        & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 100\% \\
        & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 100\% \\
        & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:27 & -106.2164536 & 39.9611940 & 100\% \\
        & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 100\% \\
        & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 100\% \\
        & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 2018-06-20 04:08:28 & -106.2164536 & 39.9611940 & 100\% \\
        \bottomrule
    \end{tabular}
\end{table*}



%\section*{Acknowledgment}

%The preferred spelling of the word ``acknowledgment'' in America is without 
%an ``e'' after the ``g''. Avoid the stilted expression ``one of us (R. B. 
%G.) thanks $\ldots$''. Instead, try ``R. B. G. thanks$\ldots$''. Put sponsor 
%acknowledgments in the unnumbered footnote on the first page.

\bibliographystyle{IEEEtran}
\bibliography{reference}
\end{document}




