Cybercrimes have posed significant challenges in the modern connected world, including wireless network-controlled drones, introducing new vulnerabilities and threats if misused. For example, a network-controlled drone could be hacked, enabling attackers to access live videos, insert malware, and even manipulate drones. Most existing work has focused on analyzing the drone telemetry or recorded video data while identifying the intruder’s information, which remains an open challenge. We assess the hacking vulnerability of a commercial Wi-Fi-controlled drone and investigate the mobile app and drone forensics methods to trace the attacker’s Personal Identifiable Information (PII). The key finding is that mobile app forensics can recover the attacker's login information, such as username, email address, and key tokens related to the DJI account. We further develop and demonstrate a forensic tool customized for PII by utilizing the Sleuth Kit library, which is much faster than Autopsy, thus expediting drone and mobile app forensics in the fields.