Modern digital forensics is no longer confined to computers, mobile phones and cloud accounts. Increasingly, the evidence we are asked to interpret is embedded in cyber-physical systems, autonomous platforms, sensors, navigation systems and radio-frequency environments. Nowhere is this more apparent than in incidents involving drones, GPS spoofing, GNSS jamming and contested airspace.
This talk examines what happens when location evidence can no longer be taken at face value. If a drone enters restricted airspace, deviates from its intended route, crashes, or appears to have been redirected by electronic warfare, the central forensic question is not simply where it was found. The more difficult question is whether the recorded location history reflects reality, manipulation, interference, system failure, operator action, or some combination of these.
Using drone and GNSS interference scenarios as a practical case study, the talk will explore how a forensic investigation should be approached when GPS lies. It will consider the evidential value and limitations of flight controller data, telemetry, GNSS logs, inertial navigation artefacts, firmware, mission planning records, RF spectrum evidence, radar tracks, recovered storage, network traces and physical damage. It will also examine the investigative challenge of correlating digital evidence with external sources such as airspace records, signal interference reports, video, witness accounts and environmental context.
The broader argument is that cyber-physical incidents demand a more mature forensic mindset. Investigators must be able to distinguish between compromise, interference, malfunction and misuse, while also recognising when the available evidence cannot support a confident conclusion. In an era of drones, spoofed signals and hybrid conflict, the future of digital forensics will depend on our ability to investigate not only devices, but the physical reality those devices claim to record.
