This is pretty neat! The next step: create an array of common-clocked RTL-SDRs connected to patch antennas, and mount them on a rail. Use beamforming techniques

This is pretty neat! The next step: create an array of common-clocked RTL-SDRs connected to patch antennas, and mount them on a rail. Use beamforming techniques so you don't have to manually wand the device. Connect an antenna to a signal generator to roughly calibrate your array response. Slightly more expensive (the big cost would be a signal generator, but a lab should have one of these anyway), but a lot more potential for automation. I actually built something similar to the above setup for work, years ago. RTL-SDR wasn't available back then, so it was a lot more expensive. It would be awesome to go back and do it over again, just to see how much it would cost today.