Digital forensics in industrial control systems

Abstract

The increasing complexity of industrial control systems (ICS) and interconnection with other systems poses more safety- and/or security-related challenges due to a rising number of attacks and errors. The event reconstruction is the goal of the new field of ICS forensics differing from well-established Desktop-IT forensics. We identify ICS properties, implications and the impact on the forensic process. Our primary contribution is the identifcation of ICS specific properties and their impact on the forensic process in order to foster forensic capabilities and forensic readiness in ICS. An existing model for Desktop-IT forensics is successfully adapted for use in ICS.