Flight Forensic Platform
Case-oriented, evidence-preserving investigation for UAV crash analysis and anomaly investigation. Run locally. No cloud required.
Investigation workflow
Evidence-preserving, case-oriented, and fully local — every finding traces back to its source.
SHA-256/512 hashing on ingest. Original evidence is never mutated. Chain of custody built in.
Every investigation lives in a named case. Evidence, findings, hypotheses, and exports are all case-scoped.
ULog parsed with diagnostics: format confidence, missing streams, corruption indicators, timebase anomalies.
Crash detection, battery sag, GPS health, EKF, vibration, motor saturation, attitude tracking, RC signal, failsafe detection, wind estimation, compass health, thermal analysis, and more.
Every finding cites its evidence, plugin version, confidence score, and trust state. No finding without evidence.
Auto-generated root-cause candidates (crash, power, navigation, vibration) with supporting and contradicting finding links.
Plugins declare manifest metadata, trust state, and required streams. Built-in plugins are verified. Community plugins are labeled.
Case bundles export all findings, hypotheses, diagnostics, and plugin versions. Replay verification detects version drift.
Open the web GUI and create an investigation case. Every case is a self-contained workspace with its own evidence, findings, and hypotheses.
Upload your .ulg log file. It is hashed (SHA-256/512) and stored immutably. The original evidence is never modified.
The ULog parser runs with full diagnostics: confidence score, stream coverage, corruption indicators, and timebase anomalies.
17 plugins run deterministically on the parsed data. Plugin trust state and required streams are checked before each run.
Browse evidence-linked findings with severity, confidence, plugin provenance, and evidence references. Every finding cites its source.
Auto-generated root-cause candidates with supporting and contradicting finding links. Crash, power, navigation, vibration — all scored.
Export a replayable case bundle with all findings, diagnostics, and plugin versions. Replay verification detects version drift.
A clean pipeline from raw log bytes to evidence-backed findings — no magic, no black boxes.
.ulg (PX4 ULog) | [ Parser Layer ] Format confidence, stream coverage, corruption indicators, timebase check | [ Evidence Store ] SHA-256/512 hash · immutable · chain of custody | [ Plugin Engine ] 17 deterministic analyzers Manifest · trust state · required streams | [ ForensicFinding Pipeline ] EvidenceReference · confidence · plugin version | [ Hypothesis Generator ] Root-cause candidates · supporting/contradicting links | ┌────┴────┐ | | [ API ] [ Web GUI ] FastAPI Investigation workspace REST Cases · Findings · Hypotheses Export · Replay verification
Parses PX4 ULog with full diagnostics. Reports format confidence, missing streams, corruption indicators, and timebase anomalies. ArduPilot and MAVLink parsers coming.
Immutable ingest with SHA-256/512 hashing. Original log files are never mutated. Chain of custody is maintained for every evidence item in a case.
17 deterministic analyzers run against parsed data. Each plugin declares its manifest, trust state, and required streams. BUILTIN_TRUSTED plugins are verified; community plugins are labeled.
Every finding carries an EvidenceReference, confidence score, plugin version, and trust state. The Hypothesis generator links root-cause candidates to supporting and contradicting findings.
17 built-in analyzers · formal plugin contract · trust-state model · write your own in Python
crash_detectionBUILTIN_TRUSTEDMotor failure, power loss, GPS loss, impact signature detection
Detects rapid altitude loss (>5 m/s sustained), sudden attitude divergence (>30 deg in <2s), motor output drops to zero, and high-g impact signatures. Classifies crashes as motor_failure, power_loss, gps_loss, pilot_error, mechanical, or unknown with confidence scoring.
vibrationBUILTIN_TRUSTEDAccelerometer RMS/peak analysis, clipping, bearing degradation
Computes RMS and peak vibration per axis against PX4 thresholds: good <15 m/s², warning 15–30, bad >30. Detects accelerometer clipping/saturation and bearing degradation trends over flight duration.
battery_sagBUILTIN_TRUSTEDVoltage sag under load, brownout risk, cell health
Measures voltage drop under load, minimum cell voltage (warning <3.5V, critical <3.3V), brownout risk detection (>0.5V drop in <1s), and battery temperature monitoring.
gps_healthBUILTIN_TRUSTEDSatellite count, HDOP, dropout detection, jamming
Monitors satellite count (warning <10, critical <6), HDOP quality (warning >2.0, critical >4.0), GPS dropout detection, fix type degradation, and jamming indicators.
motor_saturationBUILTIN_TRUSTEDOutput limits, asymmetry, failure signatures
Detects motors hitting 100% output (saturated), motor asymmetry between axes, motor failure signatures (output drops to 0 while others compensate), and remaining motor headroom.
ekf_consistencyBUILTIN_TRUSTEDInnovation monitoring, filter health, fault detection
Checks velocity and position innovation ratios (warning >0.8, critical >1.0), magnetometer consistency, EKF reset detection, and estimator fault flags.
rc_signalBUILTIN_TRUSTEDRSSI monitoring, dropout detection, stuck channels
Monitors RSSI minimum and average (warning <70%, critical <50%), signal dropout detection (gaps >2s), stuck channel detection, and RC failsafe event tracking.
attitude_trackingBUILTIN_TRUSTEDRoll/pitch/yaw error vs setpoint, oscillation
Compares roll/pitch/yaw actual vs setpoint, computes RMS tracking error per axis (warning >5 deg, critical >15 deg), detects PID oscillation via sign-change rate analysis.
position_trackingBUILTIN_TRUSTEDPosition error vs commanded, hover drift
Measures horizontal position error via Haversine calculation (warning >3m, critical >10m), vertical altitude error (warning >2m, critical >5m), and hover drift detection during low-velocity flight.
failsafe_eventsBUILTIN_TRUSTEDFailsafe triggers, emergency mode transitions
Catalogs all failsafe triggers with timestamps, identifies emergency mode transitions (RTL, LAND, emergency), distinguishes failsafe-triggered vs pilot-initiated mode changes.
log_healthBUILTIN_TRUSTEDData integrity, dropouts, rate checks
Checks for data dropouts (timestamp gaps >1s), verifies all expected data streams are present, validates data rates (warning if <1 Hz), and cross-checks measured duration against metadata.
damage_impact_classificationBUILTIN_TRUSTEDStructural failure mode classification, impact signature scoring
Classifies damage type from sensor signatures: hard landing, motor failure, structural separation, or unknown. Scores impact severity from peak-G, attitude divergence, and post-impact sensor behaviour.
environment_conditionsBUILTIN_TRUSTEDEnvironmental factor assessment — wind, pressure, temperature anomalies
Estimates wind speed and direction from GPS ground-track vs commanded heading. Detects barometric pressure anomalies and temperature excursions that could affect sensor calibration or motor performance.
link_telemetry_healthBUILTIN_TRUSTEDRC link and telemetry quality — RSSI trends, data gaps, link degradation
Monitors RC link RSSI trends beyond simple threshold checks: sustained degradation, intermittent dropouts, and correlation between link quality and autopilot state changes. Separate from rc_signal failsafe detection.
mission_phase_anomalyBUILTIN_TRUSTEDPer-phase anomaly scoring — takeoff, cruise, approach, landing
Segments the flight into phases and scores anomaly density per phase. Identifies whether issues were concentrated in a specific phase (e.g., landing approach) vs spread across the full flight.
operator_action_sequenceBUILTIN_TRUSTEDOperator input pattern analysis — mode changes, stick inputs, interventions
Reconstructs the operator action timeline from mode-change events, RC stick inputs, and failsafe interventions. Distinguishes pilot-initiated from autopilot-initiated transitions.
payload_change_detectionBUILTIN_TRUSTEDIn-flight payload change detection — mass shift, CG changes, jettison events
Detects sudden changes in flight dynamics consistent with payload drop, mass shift, or centre-of-gravity change. Uses attitude-control effort and motor output asymmetry as detection signals.
geofencehelp wantedMonitor position against defined boundaries, detect breaches
View issue →wind_estimationhelp wantedEstimate wind speed/direction from GPS ground track vs airspeed
View issue →compass_healthhelp wantedDetect magnetic interference, compass-motor calibration issues
View issue →thermal_analysishelp wantedMonitor ESC/motor/battery temperatures for overheating
View issue →propulsion_efficiencyhelp wantedCalculate thrust-to-weight, power consumption per meter
View issue →noise_analysishelp wantedDetect EMI/electrical noise affecting sensors
View issue →lidar_healthhelp wantedValidate rangefinder readings against barometer/GPS altitude
View issue →terrain_followinghelp wantedCheck terrain-relative altitude accuracy
View issue →Plugins declare a manifest, trust state, and required streams. Every finding must cite its evidence.
Each plugin declares its name, version, description, required streams, and trust state. BUILTIN_TRUSTED plugins are verified. LOCAL_UNSIGNED and COMMUNITY plugins are labeled clearly in findings.
What plugins return. Title, severity, confidence score (0–100), evidence references, plugin version, trust state, and optional hypothesis links. No finding is emitted without an evidence reference.
Every finding cites the specific evidence it drew from — stream name, timestamp range, value excerpts. Findings are traceable back to raw log data.
Plugins emit structured diagnostics alongside findings: streams consumed, streams missing, confidence rationale. Provides full audit trail for every analysis run.
Trust state model
BUILTIN_TRUSTEDVerified built-in plugins. Shipped with Goose-Core.
LOCAL_UNSIGNEDLocal plugins without a cryptographic signature.
COMMUNITYThird-party plugins from the community registry.
BLOCKEDPlugins explicitly blocked by policy.
analyze()ForensicFinding objects with evidence references and confidence scores — no finding without evidencePluginDiagnostics with streams consumed, streams missing, and confidence rationaleCheck the GitHub issues for plugins tagged good first issue — planned plugins are waiting for community authors.
| Format | Autopilot | Status |
|---|---|---|
| ULog (.ulg) | PX4 | Supported |
| DataFlash (.bin/.log) | ArduPilot | Supported |
| MAVLink tlog (.tlog) | GCS recordings | Planned |
| CSV | Custom autopilots | Supported |
Pro extends the open-source core with fleet-scale analysis, GPS-denied validation, forensic reporting, and full audit trail — all still local, no cloud required.
Validate navigation accuracy without GPS. Compare flight trajectories against RINEX ground-truth data. Quantify position drift, heading error, and dead-reckoning reliability across the full mission.
Group multiple flights into campaigns. Track health trends, compare anomaly rates, and surface systemic issues across a mission series. Identify whether a problem is flight-specific or fleet-wide.
Monitor your entire vehicle fleet in one view. Per-aircraft health scores, flight history, and comparative anomaly rates. Spot the outlier aircraft before it becomes an incident.
Generate professional forensic reports with executive summary, findings table, hypothesis narrative, and evidence appendix. Export for regulators, insurers, or internal review.
Reconstruct the full 3D flight path from GPS and estimator data. Overlay anomaly events on the trajectory. Visualize altitude profile, velocity vectors, and attitude through the mission.
Every analysis action is logged with timestamp, plugin version, and operator identity. Immutable audit trail from evidence ingest to report export — required for regulatory submissions.
Case and evidence foundation
GUI case workflow and API
Formal parser contract with diagnostics
Canonical forensic model: ForensicFinding, Hypothesis
Plugin contract, manifests, trust state
Full investigation workspace GUI
Replay/export subsystem, API modularization
React frontend v2.0 — full UI redesign · PDF report export · RINEX ground truth parser
Goose Pro — GPS-denied validation, fleet management, campaign analysis, audit trail · Cryptographic plugin signing · Multi-log comparison · Enterprise trust policies
Python + FastAPI backend · React 19 + TypeScript frontend · Vite build
Open source, no strings attached. Build on it, fork it, ship it.
Apache-2.0