Investigating real-time system forensics

Abstract

Forensic investigations of real-time systems should differ from those of traditional systems. Real-time systems are unique in their requirements and specifications, and this uniqueness presents new challenges for forensic investigations. The ubiquity of real-time systems, coupled with their inherent differences, demands that a new, real-time system-specific forensic investigation framework be developed. This paper highlights the importance of real-time systems and the differences from traditional systems with respect to forensic investigations. From that discussion, a basis for conducting real-time system investigations is presented, along with an example scenario.