Hacking Airplanes at the NTSB

Two vehicle recorder specialists from the National Transportation Safety Board's lab explain how their team pulls usable data from accident devices that arrive broken, wet, or with no documentation. They describe the agency as an independent investigator rather than a regulator. They contrast crash-hardened flight recorders, whose manufacturers must help with downloads, with smaller avionics such as engine monitors and handheld GPS units, where no such obligation exists.

The middle of the talk covers three case studies. In the first, an avionics chip had a readable file system, but its logs were raw binary. An analyst widened a hex editor window until repeated airport identifiers lined up, revealing 2,048-byte records, then wrote a short script to extract time and position and found a GPS rollover bug. In the second, the logs sat outside the file system. The team searched for the destination airport code, found 512-byte blocks holding typed, variable-length messages, and rebuilt engine and flight trends. The third covered an underwater camera whose SD card held encrypted data. After long exchanges with the manufacturer, the team moved the flash chip to a surrogate board and recovered images, though none came from the accident dive.

The takeaway is a practical workflow: start with the easiest source, such as a CSV file on a card, use string searches and known values as anchors, and expect heavy inference when documentation is missing.