DJI Fly App Forensics: Extracting and Analyzing Flight Logs on Android, iOS, and DJI RC

You often investigate incidents where a DJI aircraft is involved-flyaways, near-misses, restricted-area incursions, or simply reconstructing pilot actions. The DJI Fly app (dji.go.v5) is the default ground-control app for most recent DJI consumer drones, and it quietly records rich telemetry you can extract, preserve, and analyze for DFIR.

This guide shows you how it works, where to find the artifacts, and how to process them with current tools-on Android, iOS, and DJI RC-class smart controllers. You’ll also learn the common traps (Android scoped storage, missing DAT files, cropped logs, and cloud policy changes in the U.S.) and practical workflows to avoid data loss.

How It Works

• Dual logging model:
  • Mobile/app logs: Each flight creates a TXT flight log on the device running DJI Fly (phone, tablet, or smart controller). These TXT logs are easily parsed by community and commercial tools. (phantomhelp.com)
  • Aircraft/goggles logs: Many models also record a higher-frequency DAT log on the aircraft or goggles. However, newer DAT formats are often encrypted and not broadly supported; investigators typically rely on TXT for analysis unless vendor cooperation or specialized tooling is available. (app.airdata.com)
• Cloud sync (historical context, U.S.): DJI previously allowed syncing flight records to DJI servers. For U.S.-based pilots, DJI ended cloud sync in October-November 2024 and advised downloading any cloud log history. Local TXT logs on devices remain unaffected. This matters during incident response if the operator assumed “the cloud has it.” (viewpoints.dji.com)
• Transfer from goggles/RC: For FPV/Avata workflows, logs can sync from goggles to the phone’s DJI Fly app before you export or upload to analysis platforms. (app.airdata.com)

Technical Background

• TXT log structure: The TXT file is a compressed, encrypted container that tools can decrypt to expose hundreds of fields at ~10 Hz (e.g., OSD.latitude/longitude, altitude, attitude, speeds, RC stick inputs, battery metrics, and flight controller state). You can export to CSV/KML for mapping and time-series analysis. (phantomhelp.com)
• Representative fields you’ll use in investigations:
  • OSD.flyTime (ms), OSD.latitude, OSD.longitude, OSD.height, OSD.xSpeed/ySpeed/zSpeed
  • OSD.flycState (e.g., P-GPS, ATTI, RTH), SMART_BATTERY.battery, goHomeBattery, landBattery
  • RC.aileron/elevator/rudder/throttle (stick inputs) (mavicpilots.com)
• DAT logs: Even when present on the mobile device (MCDatFlightRecords), Fly may delete DATs after cloud sync and many modern airframes produce encrypted DATs-another reason TXT is the primary evidentiary source. (mavicpilots.com)
• Android storage model: Since Android 11, scoped storage blocks third-party file managers from freely browsing Android/data. Forensics often needs USB MTP, ADB, or a full file system extraction to reliably access DJI Fly’s app-specific external directory. (developer.android.com)

Step-by-Step Guide

1. Scope and triage

• Identify devices that ran DJI Fly: iPhone/iPad, Android phone/tablet, or DJI RC/RC Pro/RC 2. Ask whether goggles (FPV/Avata) were used and whether the pilot relied on cloud sync. This shapes where logs reside and whether a transfer step from goggles to phone is needed. (app.airdata.com)

2. Preserve mobile TXT logs (lowest friction)

• Android (user-level, no root):
  • Connect via USB (File Transfer/MTP). Navigate to: Internal storage/Android/data/dji.go.v5/files/FlightRecord. Copy TXT files (DJIFlightRecord_YYYY-MM-DD_[HH-MM-SS].txt). If present, also copy MCDatFlightRecords (may be empty). (phantomhelp.com)
  • If your file manager cannot see Android/data due to scoped storage, use a PC over MTP or ADB. Document access issues in your notes. (developer.android.com)
• iOS (no jailbreak):
  • Use Finder (macOS) or iTunes (Windows/macOS) File Sharing: select DJI Fly and save the FlightRecords folder to your workstation. Expect TXT logs; ignore MCDatFlightRecords for most cases. (phantomhelp.com)
• DJI smart controllers (RC/RC Pro/RC 2):
  • Connect via USB and acquire: Internal storage/Android/data/dji.go.v5/files/FlightRecord. (phantomhelp.com)

3. Acquire supporting media caches (contextual evidence)

• Android caches often reside under Internal storage/Android/data/dji.go.v5/files/MediaCaches (low-res video previews, thumbnails). Useful for timeline corroboration and quick previews when SD media is missing. (reddit.com)

4. Optional: Full app data (advanced, Android)

• On test or rooted devices, a full file system pull of /data/data/dji.go.v5 yields databases and shared_prefs. Examiners have observed appdb.db (drone identifiers) and analytics.db (timestamped events) under the app’s files. For production evidence, use a forensics platform capable of FFS extractions; on a research device, a rooted ADB tar works. (ogmini.github.io)

5. Aircraft/goggles DAT (if warranted)

• Export via DJI Assistant 2 when model support allows, but expect encryption on many newer airframes. Prefer TXT unless a specific question demands DAT and you have a decoder or vendor support. (app.airdata.com)

6. Process and analyze

• Choose a parser:
  • PhantomHelp DJI Flight Log Viewer (web): Decrypts TXT, produces CSV/KML for mapping in Google Earth. Great for quick triage. (phantomhelp.com)
  • Flight Reader (Windows): Local/offline processing with 400+ fields, reporting and charts-useful for repeatable lab workflows. (flightreader.com)
  • AirData UAV (cloud): Bulk ingestion, dashboards, and compliance features; also provides guidance for manual uploads from iOS/Android. (app.airdata.com)
• Create a timeline:
  • Export CSV, normalize to UTC, and chart OSD.flycState, battery %, altitude, distance, and RC inputs to explain “what the pilot did” vs. “what the aircraft did.” (mavicpilots.com)
• Map reconstruction:
  • Export KML from your parser and open in Google Earth for a 2D/3D reconstruction. Useful for incident site briefings. (phantomhelp.com)

Key Artifacts and Evidence

• TXT flight logs
  • Path (Android): Android/data/dji.go.v5/files/FlightRecord
  • Path (iOS): DJI Fly → FlightRecords via Finder/iTunes
  • Path (DJI RC/RC Pro/RC 2): Android/data/dji.go.v5/files/FlightRecord
  • File pattern: DJIFlightRecord_YYYY-MM-DD_[HH-MM-SS].txt. (phantomhelp.com)
• DAT flight logs (mobile device)
  • Subfolder: MCDatFlightRecords. Frequently empty; Fly may delete DAT after cloud sync and many new models encrypt DAT. (mavicpilots.com)
• Media caches (Android / RC): Android/data/dji.go.v5/files/MediaCaches (low-res proxies). (reddit.com)
• App-internal databases (Android, advanced): /data/data/dji.go.v5 (root/FFS) → appdb.db (drone IDs), analytics.db (events), encrypted shared_prefs. (ogmini.github.io)
• Cloud/account context: If the pilot used cloud sync historically, U.S.-based cloud records for Fly ceased mid-October 2024-acquire local device logs and advise the stakeholder accordingly. (viewpoints.dji.com)

Identification Techniques

• Confirm app authenticity
  • iOS: DJI Fly is on Apple’s App Store (verify version and change log). (apps.apple.com)
  • Android: Download only from DJI’s official Download Center or Samsung’s Galaxy Store (for supported devices) to avoid fakes that appear in Play search results. This matters when you seize a device and need to verify provenance. (pocket-lint.com)
• Locate flight logs quickly
  • Use known paths above or quick-reference lists from trusted communities and vendor partners. (phantomhelp.com)
• Handle Android scoped storage
  • Expect Android/data restrictions; prefer MTP from a workstation or ADB over on-device file managers. Document your method in notes to support repeatability. (developer.android.com)

Practical Examples

• Reconstruct a restricted airspace penetration
  1. Acquire TXT logs from Android/iOS as above; export CSV via Flight Reader or PhantomHelp. (phantomhelp.com)
  2. Normalize times to UTC; chart OSD.flycState to show entry into RTH or autoland triggers while plotting OSD.latitude/longitude and height. (mavicpilots.com)
  3. Export KML and present a 3D path to show exact ingress/egress relative to the ATC-defined area. (phantomhelp.com)
• Lost aircraft / flyaway claims
  1. If goggles or RC were used, ensure synchronization into the phone’s Fly app, then export TXT logs. (app.airdata.com)
  2. If DAT is requested by a manufacturer, attempt export via DJI Assistant 2; note likely encryption/limited support and preserve TXT as primary evidence. (app.airdata.com)
• Media corroboration
  1. Retrieve Android MediaCaches on controller/phone to quickly preview events when SD media is missing; these low-res proxies help validate timing and location with TXT. (reddit.com)

Common Pitfalls

• “I can’t see Android/data”
  • That’s scoped storage by design on Android 11+. Use MTP from a computer or ADB; many file managers lost this ability by Android 13. (developer.android.com)
• Missing or cropped flights on iPhone → third-party portals
  • Auto-sync in Fly can prematurely upload in-flight data, yielding cropped logs on platforms like AirData. Disable auto-sync before flying; re-enable after landing to upload the full record. (app.airdata.com)
• Chasing DAT at all costs
  • Newer aircraft DATs are encrypted and often unsupported; mobile-device DATs may be removed post-sync. Plan for TXT-first workflows. (app.airdata.com)
• Assuming “the cloud has it” (U.S.)
  • U.S. cloud sync ended for Fly in mid-October 2024; ensure local backup from devices. (viewpoints.dji.com)
• Fake/unauthorized Android apps
  • For seized devices, verify the app’s origin; fake “DJI Fly” apps have circulated in app stores and can complicate provenance and data integrity. (pocket-lint.com)

Best Practices

• Preserve first, parse second
  • Hash and store the entire FlightRecord and MediaCaches directories; then work on copies.
• Prefer TXT workflows
  • Use PhantomHelp for quick visualization, then Flight Reader for in-depth, offline analysis and reporting. (phantomhelp.com)
• Map for storytelling
  • Always export KML and include a 2D/3D map in your report; investigators and counsel understand paths better than tables. (phantomhelp.com)
• Document the environment
  • Record app version, OS version, controller type, and whether goggles were paired; these explain differences in where logs live and whether DAT was produced. (app.airdata.com)
• Educate stakeholders about U.S. cloud changes
  • Advise pilots and operators (especially fleets) to maintain local archives and consider third-party auto-sync (e.g., AirData) if policy permits. (airdata.com)
• Advanced Android artifacting
  • Where legally and technically permissible, a full file system extraction can enrich your case with appdb.db (drone IDs) and analytics.db (events). Validate against TXT timelines. (ogmini.github.io)

Toolbox (current, widely used)

• PhantomHelp DJI Flight Log Viewer (TXT → CSV/KML, web). (phantomhelp.com)
• Flight Reader (offline Windows, 400+ fields, charts, reports). (flightreader.com)
• AirData UAV (upload, compliance, auto-sync options, and help articles). (app.airdata.com)
• DJI Assistant 2 (for aircraft/goggles data exports when supported). (app.airdata.com)

By following this workflow, you’ll reliably capture DJI Fly’s flight evidence, explain the aircraft’s behavior with defensible timelines, and avoid the most common traps that lead to missing or partial records.

Takeaways

• Prioritize TXT flight logs from the device running DJI Fly; they’re widely parseable and sufficient for most reconstructions.
• Treat DAT logs as optional and model-specific; expect encryption and limited tool support without vendor cooperation.
• On Android, expect scoped storage path changes; use proper acquisition methods or app export features to avoid partial data.
• Keep lab baselines for app versions and paths across Android, iOS, and DJI RC; vendor updates and U.S. cloud policy shifts can change where evidence lives.