A crime scene, accident scene, infrastructure site, or security incident is not limited to what can be observed from ground level.

Modern forensic investigations increasingly require investigators to understand the relationship between physical space, digital evidence, geographic position, movement, distance, elevation, visibility, and time.

This is where Drone and Aerial Forensics can provide an additional layer of technical evidence.

Greyhawk Manila is developing the Greyhawk Aerial Forensic System, an aerial evidence and scene-reconstruction capability designed to integrate drone imagery, geospatial information, measurement data, 3D reconstruction, and digital forensic workflows into a traceable investigation process.

The objective is not simply to fly a drone over a scene.

The objective is to transform aerial observations into documented, measurable, reproducible and evidence-linked forensic information.

---

What Is Aerial Forensics?

Aerial forensics is the structured collection and forensic examination of information obtained from aerial platforms and remote-sensing systems.

Depending on the investigation, this may include:

• high-resolution aerial photographs;
• 4K or higher-resolution video;
• thermal imagery;
• GPS coordinates;
• RTK positioning;
• altitude;
• heading;
• aircraft attitude;
• gimbal orientation;
• camera parameters;
• timestamps;
• flight-path information;
• ground control points;
• photogrammetric measurements;
• three-dimensional models;
• orthomosaics;
• digital elevation models;
• terrain information; and
• relationships between aerial evidence and other evidence sources.

The important distinction is that aerial imagery becomes significantly more valuable when it can be correlated with measurable physical information.

A photograph can show a road.

A properly documented aerial forensic acquisition can help establish the road’s geometry, reference points, relative positions, distances and spatial relationships—subject to the quality and calibration of the underlying data.

---

From Drone Footage to Forensic Evidence

A conventional drone operation may produce hundreds or thousands of photographs and video frames.

A forensic workflow asks a different set of questions:

Where was the drone?

When was the image captured?

What was the camera orientation?

What was the altitude?

What geographic reference was used?

Can the scene be reconstructed?

Can measurements be performed?

Can the results be correlated with other evidence?

Can the original evidence be preserved and its integrity demonstrated?

These questions transform aerial collection from ordinary photography into a structured forensic acquisition.

---

The Greyhawk Aerial Forensic Architecture

The Greyhawk approach is designed around an integrated architecture:

DRONE / SENSOR

↓

GREYHAWK CAPTAIN

↓

JERA 5.0

↓

FORENSIC EVIDENCE RECORD

↓

ANALYSIS / RECONSTRUCTION / REPORT

The drone provides the physical observation layer.

Greyhawk Captain provides the acquisition, telemetry and evidence-management layer.

Jera 5.0 provides the analytical, correlation and forensic intelligence layer.

This architecture allows aerial evidence to become part of a larger digital-forensics workflow rather than remaining isolated inside a drone’s media folder.

---

1. Evidence Acquisition

The first stage is controlled acquisition.

Depending on the platform and mission, the system may preserve information such as:

• original image/video;
• capture timestamp;
• GPS coordinates;
• RTK status;
• altitude;
• heading;
• aircraft orientation;
• gimbal orientation;
• camera settings;
• flight trajectory;
• mission identifier;
• drone identifier;
• sensor information; and
• operator/mission information.

Where technically available, this information can provide important context for later analysis.

The original acquisition should remain preserved separately from derivatives created during forensic processing.

---

2. Cryptographic Evidence Integrity

Forensic evidence should not simply be copied, edited and redistributed without maintaining provenance.

Greyhawk’s evidence workflow can incorporate cryptographic integrity verification, including SHA-256 hashing, where appropriate.

A simplified evidence workflow is:

Acquire

↓

Preserve Original

↓

Generate Hash

↓

Create Working Copy

↓

Analyze

↓

Generate Derivatives

↓

Document Findings

↓

Preserve Final Evidence Package

This allows investigators to distinguish the original acquisition artifact from analytical derivatives.

---

3. RTK and High-Precision Positioning

One of the most important capabilities for aerial forensic work is positioning.

Standard GPS can provide useful geographic information, but higher-precision applications may require RTK or other appropriate positioning methodologies.

With appropriate equipment and conditions, RTK can improve positional accuracy and provide a stronger geographic reference for scene reconstruction.

This becomes particularly useful when the investigation requires measurements such as:

• distance between objects;
• roadway dimensions;
• lane width;
• vehicle position;
• pedestrian position;
• structure dimensions;
• elevation differences;
• camera-to-object distance;
• incident location;
• terrain geometry; and
• movement paths.

However, high-precision positioning does not automatically make every measurement forensic-grade.

The measurement methodology, calibration, reference points, image quality, environmental conditions and uncertainty must still be evaluated.

---

4. Ground Control Points

For photogrammetric reconstruction, appropriately established Ground Control Points (GCPs) can provide known spatial references.

These points can be used to improve the relationship between aerial imagery and the physical scene.

For example:

Known Ground Reference

↓

Aerial Image

↓

Photogrammetric Processing

↓

3D Scene

↓

Measured Coordinates

↓

Forensic Analysis

This can be particularly valuable when investigating large outdoor scenes where conventional ground photography does not provide sufficient spatial context.

---

5. 3D Scene Reconstruction

One of the most significant applications of aerial forensics is three-dimensional reconstruction.

Multiple overlapping images can potentially be processed into a three-dimensional representation of the scene.

Depending on the available data, this may produce:

• point clouds;
• textured 3D models;
• orthomosaics;
• elevation models;
• terrain models; and
• measurable spatial representations.

A reconstructed scene can provide investigators with a different perspective than a conventional photograph.

Instead of asking:

“What does this photograph show?”

the investigation can potentially ask:

“What measurable spatial relationship exists between these objects?”

---

6. Ground Measurement

Aerial forensic systems can potentially support measurements such as:

Point-to-point distance

Distance between two known locations or objects.

Roadway measurements

Lane width, roadway width, shoulder dimensions and other spatial characteristics.

Object positioning

Relative location of vehicles, structures, persons or physical evidence.

Elevation

Relative height and elevation differences within the scene.

Area and perimeter

Useful for property, damage, environmental and infrastructure investigations.

Camera-to-subject geometry

Potentially useful when correlating CCTV camera locations with observed subjects.

Flight-path reconstruction

Comparison of drone position and movement against the captured imagery.

The critical principle is traceability.

A measurement should be linked to its source data, methodology and assumptions.

---

7. CCTV + Drone Forensics

One of the most powerful applications is combining aerial information with CCTV evidence.

Consider a traffic incident captured by a roadside camera.

The CCTV may provide:

• subject movement;
• vehicle movement;
• timestamps;
• frame sequences;
• apparent orientation;
• observable events.

The aerial survey may provide:

• roadway geometry;
• lane dimensions;
• physical reference points;
• camera position;
• road elevation;
• sight lines;
• scene geometry.

These datasets can potentially be correlated.

The resulting workflow becomes:

CCTV

→ temporal evidence

Drone

→ spatial evidence

RTK / GCP

→ geographic reference

3D Reconstruction

→ scene model

Jera 5.0

→ analytical correlation

This can provide a much richer reconstruction than either evidence source alone.

---

8. Line-of-Sight Analysis

Aerial scene reconstruction may also support visibility analysis.

For example, an investigation may need to examine whether a particular location was potentially visible from another location.

The analysis can consider:

• camera position;
• observer position;
• elevation;
• obstacles;
• road geometry;
• structures;
• vegetation;
• terrain;
• camera orientation; and
• available video evidence.

However, a forensic report should distinguish between geometric visibility and actual human perception.

A scene may be geometrically visible without establishing that a person actually saw the object.

Therefore:

Geometric visibility ≠ proven perception.

This distinction is important in defensible forensic reporting.

---

9. Accident and Incident Reconstruction

Aerial evidence can also support technical reconstruction of:

• vehicle incidents;
• pedestrian incidents;
• industrial accidents;
• construction accidents;
• infrastructure failures;
• road incidents;
• property damage;
• environmental incidents; and
• security events.

For example, a scene model may help establish:

Vehicle position → roadway geometry → reference distances → movement path → physical constraints

When combined with appropriately calibrated temporal information from video, the result can support more structured technical analysis.

However, conclusions concerning fault, negligence, intent or legal liability remain matters for the appropriate legal authority.

---

10. Thermal Aerial Forensics

Where a suitable thermal sensor is available, aerial thermal imagery may provide another evidence layer.

Potential applications include:

• electrical infrastructure examination;
• equipment overheating;
• industrial incident assessment;
• fire investigation support;
• building envelope assessment;
• solar infrastructure inspection;
• thermal anomalies; and
• post-incident technical assessment.

Thermal imagery must be interpreted carefully.

A thermal anomaly is an observation requiring technical interpretation, not automatically proof of a particular cause.

---

11. Digital Evidence Classification

Greyhawk’s forensic reporting approach emphasizes evidence classification.

Aerial findings can therefore be categorized as:

OBSERVED

Directly visible or directly recorded in the source evidence.

CORROBORATED

Supported independently by multiple evidence sources.

INFERRED

A technically supported interpretation derived from observed evidence.

NOT DETERMINABLE

The available evidence is insufficient to establish the requested fact reliably.

This distinction is particularly important when dealing with reconstructed scenes.

A 3D model may be highly detailed while still containing uncertainty.

---

Jera 5.0: The Analytical Layer

The Greyhawk Aerial Forensic System is designed to integrate with Jera 5.0 as the analytical layer.

Potential Jera functions include:

• aerial evidence indexing;
• flight timeline analysis;
• telemetry correlation;
• GPS/RTK data correlation;
• image metadata examination;
• evidence hashing;
• scene reconstruction;
• object identification;
• measurement workflows;
• CCTV correlation;
• timeline synchronization;
• anomaly identification;
• evidence classification;
• report generation; and
• chain-of-custody documentation.

Jera should not replace the original evidence.

Instead, it should operate as an analytical layer over preserved source evidence.

---

The Greyhawk Captain Layer

The Greyhawk Captain component can serve as the bridge between the physical acquisition platform and Jera 5.0.

Conceptually:

Drone / Sensor
      │
      ├── Image
      ├── Video
      ├── GPS
      ├── RTK
      ├── IMU
      ├── Altitude
      ├── Heading
      └── Gimbal Data
              │
              ▼
       GREYHAWK CAPTAIN
              │
       Evidence Capture
       Metadata Preservation
       Hashing
       Mission Record
              │
              ▼
          JERA 5.0
              │
       Correlation
       Reconstruction
       Measurement
       Analysis
              │
              ▼
      FORENSIC REPORT

This creates a continuous evidence chain from sensor acquisition to analytical reporting.

---

Aerial Forensics Is Not Just Drone Photography

The distinction is important.

A drone photograph may document a scene.

Aerial forensics attempts to establish a structured relationship between the image, the physical environment, the acquisition parameters, the measurement methodology and the resulting analytical conclusion.

That means a forensic aerial workflow must consider:

• provenance;
• integrity;
• acquisition conditions;
• calibration;
• spatial reference;
• temporal reference;
• measurement uncertainty;
• processing methodology;
• analytical assumptions;
• limitations; and
• evidence preservation.

The technology is only one component.

The methodology is equally important.

---

Applications for Greyhawk Aerial Forensics

The Greyhawk Aerial Forensic System can be developed for applications including:

Digital & Cybercrime

Physical-site correlation for cyber incidents involving:

• data centers;
• server facilities;
• telecommunications infrastructure;
• network facilities; and
• compromised physical infrastructure.

Road and Traffic Investigation

• vehicle incidents;
• pedestrian incidents;
• roadway reconstruction;
• visibility analysis;
• measurement;
• CCTV correlation.

Corporate Investigation

• facility inspection;
• perimeter analysis;
• infrastructure documentation;
• incident reconstruction.

Industrial Investigation

• machinery incidents;
• plant environments;
• infrastructure failures;
• hazardous areas.

Construction

• site documentation;
• progress verification;
• structural observation;
• spatial measurement.

Environmental Investigation

• site mapping;
• land-use documentation;
• environmental incident documentation.

Solar / Energy Infrastructure

• panel inspection;
• thermal anomalies;
• infrastructure mapping;
• equipment documentation.

Disaster and Emergency Documentation

• damage mapping;
• access-route assessment;
• structural documentation;
• scene mapping.

---

Evidence Preservation Comes First

The most sophisticated reconstruction system cannot compensate for poorly preserved source evidence.

Greyhawk therefore treats the original acquisition as the foundation of the forensic process.

A simplified workflow is:

1. Authorize

Define the scope and authority.

2. Acquire

Capture the aerial evidence under documented conditions.

3. Preserve

Maintain original source artifacts.

4. Hash

Generate appropriate cryptographic integrity records.

5. Document

Record equipment, mission and acquisition parameters.

6. Process

Create working derivatives.

7. Reconstruct

Generate spatial/3D representations where appropriate.

8. Correlate

Compare aerial evidence with CCTV, photographs, measurements and other evidence.

9. Analyze

Perform technical examination.

10. Report

Clearly separate observations, corroborated findings, inferences and limitations.

---

The Future of Scene Investigation

Forensic investigation is increasingly moving from isolated evidence examination toward multi-dimensional evidence correlation.

A single photograph may answer one question.

A synchronized evidence environment can potentially answer many more:

Where?

When?

How far?

How high?

From where?

Along what path?

What was visible?

What changed?

What evidence corroborates the observation?

What remains uncertain?

This is the direction Greyhawk is pursuing with the Greyhawk Aerial Forensic System.

The goal is not simply to put a drone into the sky.

The goal is to connect the physical scene, digital evidence, geographic reference, temporal information and forensic analysis into one traceable investigative workflow.

---

Greyhawk Aerial Forensic System

From aerial acquisition to measurable forensic evidence.

The Greyhawk Aerial Forensic System is being developed as part of the broader Greyhawk forensic technology ecosystem, integrating aerial sensing, RTK positioning, evidence preservation, 3D reconstruction, measurement, digital forensics and Jera 5.0 analytical capabilities.

Where technically and legally appropriate, aerial evidence can provide investigators with a powerful additional perspective on the physical environment surrounding a digital or physical incident.

But the fundamental forensic principle remains unchanged:

Collect carefully. Preserve the original. Measure transparently. Correlate independently. Report what the evidence supports—and clearly identify what it does not.

---

Greyhawk Manila
Greyhawk Forensics & Cybersecurity

Digital Forensics | Cybersecurity | Video Forensics | Hardware Forensics | Aerial Forensics | Digital Evidence

Greyhawk Forensics & Cybersecurity