(1) Background: The digital traces of unmanned aerial vehicles (UAVs) are becoming increasingly important in criminal incidents, the violation of airspace and in military operations, thus making the reconstruction of the digital traces a critical task. But, current tools like DatCon, Autopsy and GRYPHON cannot recover telemetry when the flight logs are logically damaged, fragmented or partially deleted and don’t offer any quantitative measurement of the confidence of the recovered information. (2) Methods: A unified hardware-software complex, including a forensic workstation, a hardware write-blocker and SD/microSD/eMMC adapters; a set of software modules for extracting artifacts from files, structural parsing of DAT/BIN/CSV log, neural network reconstruction of missing telemetry using a two-layer LSTM architecture; a multi-source correlation module that combines flight logs, telemetry, media metadata and controller artifacts; a module, Confidence Score (CS), that computes a reliability measure in $[0,1]$; and a visualization module to generate a reconstructed trajectory on an electronic map. (3) Results: The complex has been tested on 105 flights on 10 different UAVs, 492 flight logs were gathered, 10,435 were the media item files and 624 GB was the amount of storage during acquisition. The carving stage recovers 98.7% of artifacts across the eight signature classes, the LSTM module recovers all five telemetry parameters with $R^2>0.99$ and a single-step horizontal position error of 6.8 m, which is reduced to 4.7 m after multi-source correlation (below the 5 m operational target consistent with consumer-GNSS precision); the dependence on gap length is described by the empirical growth law ${\epsilon }_{\mathrm{horiz}}\approx 4.84·G^{1.44}$ m; 46.8% of recovered records fall within the high-confidence band of $\mathrm{CS}\ge 0.8$; and the complex outperforms DatCon, Autopsy + DJI Analyzer and GRYPHON by 22–35 percentage points in end-to-end record recovery and by a factor of ∼2.6 in mean horizontal error (4.7 m vs. 12.4–18.7 m). (4) Conclusions: The combined write-blocked hardware acquisition, neural reconstruction of telemetry, and quantitative confidence index provides a forensically structured pipeline that fills an existing gap in UAV digital forensics; we note that technical reconstruction accuracy does not by itself confer legal admissibility, which remains a function of jurisdiction-specific evidentiary standards discussed in the Conclusions.

Examiners read drone flight logs with open-source parsers, and published comparisons of these parsers count the rows a tool writes or note whether it crashed. We tested whether such counts say anything about the evidence. Six parsers (DatCon, DROP, DRDP, Fodogu, pymavlink and GRYPHON) were run three times on each of the 72 files of four NIST CFReDS drone datasets, 1,296 runs with pinned versions and hashed inputs and outputs. Every coordinate a tool wrote was compared with two reference decoders: one accepts a DJI packet only when its checksum verifies, the other reproduces the Mission Planner exports shipped with the ArduPilot logs. On the DJI Phantom 3 files, DatCon and DROP wrote no unsupported position and agreed exactly wherever both reported one; 729,793 reference records (82.4%) are reproduced by both. The count differences earlier read as complementary recovery come from repeated rows and from two undocumented display rules: DROP blanks positions logged with two or fewer satellites, and DatCon writes nothing before a flag set by the first record with non-zero position and height. At the rate used here, 98.3% of DatCon's GPS-receiver rows repeat an earlier value (97.9% at its 30 Hz default). Runs that ended with status zero and no coordinates from a file holding them made up 21 of 126 runs on formats a tool claims to support and 61 of 120 on other formats. On the ArduPilot logs, 545 of 927 positions that pass a plain latitude and longitude range test were logged without a three-dimensional fix. All 431 completed run triples were bit-identical. The procedure is stated as a formal model, so that each reported quantity has a definition.

The article discusses specifics of the operating system Windows 8.1 (x64) while conducting a forensic investigation of the registry based on the example of a criminal case of confidential information theft.

The article addresses the issue of extending the range of technical arsenal of forensic divisions by developing a domestic software product in digital forensic field as part of the "Cybershield of Kazakhstan" state program [1].

The exponential growth of digital data and the increasing sophistication of cyber threats have made traditional data recovery methods, which rely on file system metadata and signature-based carving, inadequate for modern forensic investigations. Solid-state drives with TRIM and wear leveling, file fragmentation and partial corruption frequently leave investigators with incomplete evidence and without any quantitative measure of its reliability. The aim of this study is to develop and validate a machine learning-based ensemble framework for intelligent byte-level data recovery and integrity assessment. The proposed method extracts an 18-dimensional feature vector describing the statistical, structural, entropy and pattern properties of each file segment and combines three complementary models: a Random Forest that predicts individual byte values from contextual windows, a Gradient Boosting model that reconstructs pattern-level structure, and a multilayer perceptron that estimates structural recovery confidence. Their outputs are merged through weighted voting with weights optimized by cross-validation, followed by structural validation and a multi-metric confidence assessment. The framework was evaluated on 10,247 files (PDF, JPEG, PNG, DOCX, MP4) stored on NTFS, ext4 and APFS and subjected to 15 synthetic corruption scenarios, including bit errors, block deletion, header damage, fragmentation, zero padding and pseudo-encrypted regions. The ensemble achieved 89.3% recovery accuracy and 92.1% precision, substantially surpassing Autopsy (62.4%), FTK Imager (58.7%) and EnCase (74.5%), and all improvements were statistically significant (p < 0.001). Accuracy remained stable across file systems (87.1–91.7%), and the confidence scores were well calibrated, with an Expected Calibration Error of 1.48%. The price of this gain is a longer processing time of 45.2 s per file. The results show that combining ensemble byte-level reconstruction with calibrated integrity assessment yields more complete evidence together with quantitative confidence measures suitable for legal proceedings, providing a practical complement to existing forensic tools.