Improper shutdown leads to overwritten data?

[reporter23]

Hi,

I'm a reporter going over some police documents and am seeking anyone's help regarding the Mavic 2 Pro. A Mavic police took into custody following a fatal police shooting was submitted to the Secret Service. There, a technician says the internal and external data still had its folder structure intact but all of the data had been rewritten to 0s (none of the videos of that night were recoverable).

The technician put in his report that after some research he found that DJI devices can "overwrite" files when the device is improperly shutdown.

Has anyone ever heard of something like this happening before? It seems an odd thing to have happen, considering the footage would have been of a police shooting. If it does happen, what kind of ways can the drone be shut down to cause this kind of file corruption.

Any and all help is appreciated.

 

[BigAl07]

It's not unusual for a Video that is being written to the card to become corrupt if the aircraft is not allowed to do a full shutdown. Is this the issue in question?

 

[BigAl07]

If the answer is YES it's possible the video can be salvaged IF the data is still on the same card and has not been altered. I've actually had this happen on TWO different times and this thread allowed me to get the video "restored" and operable again

App to fix corrupted Video Files (new one)

If you have the original (i.e., unmodified) file from your SD card, then you may be able to repair it using our (free) "djifix" software: Repairing Corrupt DJI Video Files Thank you. My micro SD card was accidentally formatted using the DJI Go App, the files were recovered using Recuva, Recuva...

phantompilots.com

 

[sar104]

Hi,

I'm a reporter going over some police documents and am seeking anyone's help regarding the Mavic 2 Pro. A Mavic police took into custody following a fatal police shooting was submitted to the Secret Service. There, a technician says the internal and external data still had its folder structure intact but all of the data had been rewritten to 0s (none of the videos of that night were recoverable).

The technician put in his report that after some research he found that DJI devices can "overwrite" files when the device is improperly shutdown.

Has anyone ever heard of something like this happening before? It seems an odd thing to have happen, considering the footage would have been of a police shooting. If it does happen, what kind of ways can the drone be shut down to cause this kind of file corruption.

Any and all help is appreciated.

Setting aside my skepticism of this account, if the aircraft is shut down improperly while recording, for example by simply disconnecting the battery, then it is common for the video file not to be correctly closed leading to it not being readable by most video programs. It has nothing to do with being overwritten with zeros - that doesn't happen. The simple fix is to put the video card back into a Mavic and then power it up, which causes the file to be recognized and closed. Now it is readable.

 

[reporter23]

I think so. I don't know if or why it was improperly shutdown, as the tech is only guessing that's how it may have happened. But a screenshot of the files shows all zeros. Could that happen if someone rips the battery out? Or are there other ways it's not allowed to properly shutdown?

It's odd because this would have been the only direct footage of the shooting and it's entirely unusable.

(And thanks for responding and your time.)

It's not unusual for a Video that is being written to the card to become corrupt if the aircraft is not allowed to do a full shutdown. Is this the issue in question?

 

[Meta4]

I think so. I don't know if or why it was improperly shutdown, as the tech is only guessing that's how it may have happened. But a screenshot of the files shows all zeros. Could that happen if someone rips the battery out? Or are there other ways it's not allowed to properly shutdown?

If the drone is shut down while recording video, without stopping the camera first, the video file has been written to continually while shooting, but the file does not get closed properly and won't be able to be played.

The video data is still on the card and it's not corrupted although people suggest that it is all the time.
It just has no end of file marker that the player software needs.
The data would only be overwritten with zeros if someone has made a conscious effort to scrub the disk to prevent reading the data.

 

[Meta4]

There, a technician says the internal and external data still had its folder structure intact but all of the data had been rewritten to 0s (none of the videos of that night were recoverable).

The technician put in his report that after some research he found that DJI devices can "overwrite" files when the device is improperly shutdown.

This doesn't make proper sense.
If you got this directly from the technician, they are going beyond their level of expertise,
or if the information came from another source, someone has confused whatever a technician might have said.

 

[reporter23]

There have already been accusations of evidence destruction in the case, including an investigation opened by the state attorney general. That's the core of my question, which I think you're helping me better understand.

More details: a paramedic (a profession that regularly interacts with police) was flying a drone to capture reports of mass vandalism and looting last June. He happened to be recording when police rolled up and a detective shot a 22-year-old kid in the head.

Police body camera doesn't actually show the victim before he was killed, which the police chief first described as one similar to surrendering. The cop with three shootings already under his belt "mistook" a hammer for a gun and shot through the windshield of still-moving unmarked police truck. The police union has fought to keep his name from officially being released and the head of the union is the one accused of destroying evidence (the windshield) in the case.

So this drone and SD card make it to federal forensic experts and only has zeros in its files. That's either a terrible design flaw that hopefully other users would have noticed by now, or something happened to that data from when it was handed off from a paramedic to police.

Again, any help with knowledge regarding data storage of the Mavic 2 Pro, including what happens when the device is "improperly shutdown," is greatly appreciated.

This doesn't make proper sense.
If you got this directly from the technician, they are going beyond their level of expertise,
or if the information came from another source, someone has confused whatever a technician might have said.

 

[Kilrah]

Never heard of that happening, and I've been using and talking about Mavics since they came out.
There are programs that do exactly this though...

If the phone/mobile device that was used to fly it was also seized then there could be cached footage on it, people may not think of getting rid of that.

 

[BigAl07]

........

Again, any help with knowledge regarding data storage of the Mavic 2 Pro, including what happens when the device is "improperly shutdown," is greatly appreciated.

@Meta4 and @sar104 both very accurately answered your question. If power was cut (battery pull most likely case) before the video file was properly "closed" it will merely needs to be "closed" by the aircraft. During "normal" operation the aircraft will keep power on (even after the shutdown sequence has been initiated) to allow the video file to be "completed/closed" properly. Many of us have seen this when shooting video and needing to do a quick battery swap while flying.

If nothing else has happened to the data or the card it would be a matter of simply putting it back into the aircraft, powering it on, and letting it recognize & complete/close the video properly. That's if the data is still intact, on the original card, and it can be placed back into the same aircraft. I doubt those options are possible at this point in the "game".

I suspect that due to certain circumstances this isn't possible in this instance and you'll need to potentially use the program I eluded to in my link to the video thread on PhantomPilots. That program uses an existing video file (that was closed properly), records the method it should be closed, and attempts to apply the same methods to the improperly closed video file. It's worth a shot but if the DATA is legitimately now written with "all 0's" the file has been intentionally scrubbed. If that is the case, you have a whole other "case" within the original case at this point and it's time to get the Big Dogs involved at a much higher level.

My thoughts are that a competent Forensics Lab would be able to see this and recognize it (and note when it happened as well) from the get-go.

Maybe the lab tech who originally inspected this file isn't familiar with electronic data??

 

[Dave Maine]

The removing of power from the drone before the video is properly closed leaves al, the frames intact but no proper index of where these frames are on the SD. As many have said, putting the card back in the same drone and powering it up again, the drone will detect this problem and write the index properly in the file and everything will be fine.

The problem occurs if the SD is used in any way between the improper shutdown and proper closing. Since the index does not exist, any SD write is free to use the space used by the existing frames, as it has no way of knowing that they are in use. This is a random process. Sometimes the frames will get over written, and sometimes not. If the frames are not overwritten recovery software has a good chance of recovering the frames and reconstructing the index. If individual frames are damaged by being partly overwritten with other data, the recovery will fail slightly or catastrophically.

 

[reporter23]

Thank you all for your replies. I was able to find a local expert to help me sort this out (including getting the right model and being able to explain it to someone who used to know nothing about the DJI Mavic 2 Pro), read the report, and give his expert opinion on the record. We even checked what happened when you put the battery back in after a battery pull and let the drone and app catch up (which he didn't know about and we both learned from you all). Here's a link to my story, which is important because it involves a fatal police shooting and a department already accused of destroying evidence: Drone files raise new questions of evidence destruction in Vallejo police killing of Sean Monterrosa

 

[sar104]

Thank you all for your replies. I was able to find a local expert to help me sort this out (including getting the right model and being able to explain it to someone who used to know nothing about the DJI Mavic 2 Pro), read the report, and give his expert opinion on the record. We even checked what happened when you put the battery back in after a battery pull and let the drone and app catch up (which he didn't know about and we both learned from you all). Here's a link to my story, which is important because it involves a fatal police shooting and a department already accused of destroying evidence: Drone files raise new questions of evidence destruction in Vallejo police killing of Sean Monterrosa

That's an interesting account, and it doesn't instill much confidence in the capabilities of the NCFI.

The Mavic 2 creates one onboard flight log (DAT file) each time it is powered up that contains all the flight data. It is stored in internal memory on the aircraft. Presumably this is the "black box" referred to here. It is most easily retrieved by connecting the aircraft to the DJI Assistant 2 application running on a Mac or Windows computer. It is encrypted but can be read by various software options, none of which are among those listed in the article.

The aircraft also has some limited internal memory to store photos and video, but generally those are stored on the removable micro SD card. The unreadable video problem occurs when power is lost while video is recording, resulting in the video file not being closed properly. As noted, that is easily fixed simply by putting the card into an aircraft and powering up, at which point the file is detected and closed. There are also a couple of computer applications that achieve the same thing, although somewhat less reliably. Video is not generally saved to the app - only the four most recent compressed images.

In addition to the aircraft DAT file, the DJI GO 4 app or whatever control app is being used on the iPad creates one or more flight data log files. The DJI app creates another DAT file, similar to the aircraft DAT file but containing fewer data fields at a lower data rate (10 Hz). It also creates a TXT log file with yet another set of flight data. The mobile device DAT and TXT files can be retrieved from the app file system on the iPad and are both readable with appropriate software.

So the account of what was found is annoyingly incomplete. Video files that contain all zeros have unambiguously been deliberately wiped and overwritten, but that would be a very incompetent way to hide evidence since it is so easily detected. With regard to the lack of log files, it is hard to tell whether that was because they had been deleted or simply lack of knowledge on the part of the NCFI to retrieve and read them.