A Field Study of Digital Forensics of Intrusions in the Electrical Power Grid

The paper describes the findings of a field study that we conducted to practically determine the digital forensics processes, tools, and technical considerations that apply to investigations of computer intrusions into the electrical power grid. Our findings are based on technical interactions with industry and law enforcement, as well as on actual applied research in the lab. In the paper, we discuss the most widespread vulnerabilities of industrial control systems, and thus build on those preliminaries to describe the inner workings of control system forensics in the real world. Several advanced works on control systems forensics abstract from low-level fundamentals, assuming that those are easily doable. The main contribution made by this paper is the focus on those fundamentals, with the goal of laying the foundation for further developments of practical and hence usable digital forensics in the electrical power grid.