D7.1 Preliminary report on forensic analysis for industrial systems

The ability to analyze security breaches in industrial control systems (ICS) is vital for the fast remediation of compromises and thereby helps to improve the robustness of these systems in the face of attacks. Current forensic practice lacks specific tools and procedures for performing investigations in these environments. Furthermore, the specifics of industrial control systems in most cases prevent the application of existing standard forensic tools and approaches. In this paper we discuss the challenges posed by industrial control systems for forensic investigations. We derive design criteria for a forensic framework for such systems and describe the preliminary work that has been performed for implementing such a framework.