With the increasing threat of sophisticated attacks on critical infrastructures, it is vital that forensic investigations take place immediately following a security incident. This paper presents an existing SCADA forensic process model and proposes a structured SCADA forensic process model to carry out a forensic investigations. A discussion on the limitations of using traditional forensic investigative processes and the challenges facing forensic investigators. Furthermore, flaws of existing research into providing forensic capability for SCADA systems are examined in detail. The study concludes with an experimentation of a proposed SCADA forensic capability architecture on the Siemens S7 PLC. Modifications to the memory addresses are monitored and recorded for forensic evidence. The collected forensic evidence will be used to aid the reconstruction of a timeline of events, in addition to other collected forensic evidence such as network packet captures.
In 2013 Tina Wu et al REF proposed SCADA Forensics Architecture and the increasing threat of sophisticated attacks on critical infrastructures, the limitations of using traditional forensic investigative processes and the challenges facing forensic investigators and there are no methodologies or data acquisition tools to extract data from embedded devices such as PLCs.
Towards a SCADA Forensics Architecture
ICS-CSR
Engineering Computer Science