{"id":"https://openalex.org/W7160155803","doi":"https://doi.org/10.1016/j.fsidi.2026.302111","title":"Cybercrime investigations in practice: Insights from the LockerGoga ransomware attack on Norsk Hydro","display_name":"Cybercrime investigations in practice: Insights from the LockerGoga ransomware attack on Norsk Hydro","publication_year":2026,"publication_date":"2026-05-01","ids":{"openalex":"https://openalex.org/W7160155803","doi":"https://doi.org/10.1016/j.fsidi.2026.302111"},"language":"en","primary_location":{"id":"doi:10.1016/j.fsidi.2026.302111","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2026.302111","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Forensic Science International: Digital Investigation","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.fsidi.2026.302111","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083887994","display_name":"Odin Heitmann","orcid":null},"institutions":[{"id":"https://openalex.org/I1321605679","display_name":"Statistics Norway","ror":"https://ror.org/02e50va28","country_code":"NO","type":"government","lineage":["https://openalex.org/I1321605679"]},{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":true,"raw_author_name":"Odin Heitmann","raw_affiliation_strings":["Norwegian University of Science and Technology (NTNU), Teknologivegen 22, 2815 Gj\u00f8vik, Norway","The National Criminal Investigation Service (Kripos), Postboks 2094 Vika, 0125 Oslo, Norway"],"raw_orcid":"https://orcid.org/0009-0002-3937-4715","affiliations":[{"raw_affiliation_string":"Norwegian University of Science and Technology (NTNU), Teknologivegen 22, 2815 Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]},{"raw_affiliation_string":"The National Criminal Investigation Service (Kripos), Postboks 2094 Vika, 0125 Oslo, Norway","institution_ids":["https://openalex.org/I1321605679"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5020770718","display_name":"Jan William Johnsen","orcid":null},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Jan William Johnsen","raw_affiliation_strings":["Norwegian University of Science and Technology (NTNU), Teknologivegen 22, 2815 Gj\u00f8vik, Norway"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Norwegian University of Science and Technology (NTNU), Teknologivegen 22, 2815 Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5083887994"],"corresponding_institution_ids":["https://openalex.org/I1321605679","https://openalex.org/I204778367"],"apc_list":{"value":2950,"currency":"USD","value_usd":2950},"apc_paid":{"value":2950,"currency":"USD","value_usd":2950},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.57258331,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"57","issue":null,"first_page":"302111","last_page":"302111"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.3937999904155731,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.3937999904155731,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.18549999594688416,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.05050000175833702,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cybercrime","display_name":"Cybercrime","score":0.6967999935150146},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.5633000135421753},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.34130001068115234},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.3077000081539154},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.2930000126361847},{"id":"https://openalex.org/keywords/sanctions","display_name":"Sanctions","score":0.2840000092983246}],"concepts":[{"id":"https://openalex.org/C2779390178","wikidata":"https://www.wikidata.org/wiki/Q29137","display_name":"Cybercrime","level":3,"score":0.6967999935150146},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5633000135421753},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.555899977684021},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5217000246047974},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.34130001068115234},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3301999866962433},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.3077000081539154},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.30090001225471497},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.2930000126361847},{"id":"https://openalex.org/C2778069335","wikidata":"https://www.wikidata.org/wiki/Q32098","display_name":"Sanctions","level":2,"score":0.2840000092983246},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.2775000035762787},{"id":"https://openalex.org/C522325796","wikidata":"https://www.wikidata.org/wiki/Q471880","display_name":"Identity theft","level":2,"score":0.2757999897003174},{"id":"https://openalex.org/C190253527","wikidata":"https://www.wikidata.org/wiki/Q295354","display_name":"Law and economics","level":1,"score":0.26669999957084656},{"id":"https://openalex.org/C2779295839","wikidata":"https://www.wikidata.org/wiki/Q3544090","display_name":"Punishment (psychology)","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.2612999975681305},{"id":"https://openalex.org/C136264566","wikidata":"https://www.wikidata.org/wiki/Q159810","display_name":"Economy","level":1,"score":0.258899986743927},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.fsidi.2026.302111","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2026.302111","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Forensic Science International: Digital Investigation","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.fsidi.2026.302111","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2026.302111","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Forensic Science International: Digital Investigation","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320323299","display_name":"Norges Forskningsr\u00e5d","ror":"https://ror.org/00epmv149"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":1,"referenced_works":["https://openalex.org/W3129823553"],"related_works":[],"abstract_inverted_index":{"Cybercrime":[0,63],"investigations":[1,186],"demand":[2],"new":[3],"approaches":[4],"as":[5],"digitalization":[6],"expands":[7],"the":[8,38,47,84,91,129],"crime":[9],"landscape,":[10],"and":[11,18,30,75,98,121,124,146,149,163,170,187],"complex":[12,196],"technical":[13],"systems,":[14,138],"massive":[15],"data":[16],"volumes,":[17],"delayed":[19],"notification":[20],"to":[21,45,83,174,191],"law":[22],"enforcement":[23],"make":[24],"close":[25],"collaboration":[26],"with":[27,100,159],"victim":[28],"organizations":[29],"incident":[31,58,102],"response":[32,103],"teams":[33],"critical.":[34],"This":[35],"study":[36],"applies":[37],"Integrated":[39],"Cyber":[40],"Investigation":[41],"Process":[42],"(ICIP)":[43],"framework":[44,70],"analyze":[46],"2019":[48],"LockerGoga":[49],"ransomware":[50,197],"attack":[51],"on":[52],"Norsk":[53],"Hydro,":[54],"a":[55,68,160,165],"globally":[56],"significant":[57],"investigated":[59],"by":[60],"Norway\u2019s":[61],"National":[62],"Centre":[64],"(NC3).":[65],"ICIP":[66,158],"is":[67],"phase-based":[69],"that":[71,142],"integrates":[72],"criminal":[73],"investigation":[74],"digital":[76,116],"forensics":[77],"for":[78,131,144,152,168,184],"cyber":[79,193],"investigations.":[80],"Direct":[81],"access":[82],"investigative":[85,92,133],"team":[86],"provided":[87],"unique":[88],"insights":[89],"into":[90],"process,":[93],"evidence":[94],"handling,":[95],"cross-sector":[96,145,177],"collaboration,":[97],"engagement":[99],"private-sector":[101],"teams.":[104],"Using":[105],"ICIP,":[106],"we":[107],"examine":[108],"how":[109],"investigators":[110],"managed":[111],"over":[112],"80":[113],"TB":[114],"of":[115],"evidence,":[117],"coordinated":[118],"international":[119],"partners,":[120],"traced":[122],"infrastructure":[123],"cryptocurrency":[125],"flows.":[126],"Findings":[127],"emphasize":[128],"need":[130],"proactive":[132],"preparedness":[134],"through":[135],"structured":[136],"case-management":[137],"pre-agreed":[139],"information-sharing":[140,172],"protocols":[141],"account":[143],"jurisdictional":[147],"constraints,":[148],"collaborative":[150],"platforms":[151],"real-time":[153],"coordination.":[154],"We":[155],"propose":[156],"extending":[157],"preparatory":[161],"phase":[162],"introducing":[164],"conceptual":[166],"model":[167],"directional":[169],"conditional":[171],"flows":[173],"support":[175],"lawful":[176],"exchange.":[178],"These":[179],"contributions":[180],"inform":[181],"best":[182],"practices":[183],"cybercrime":[185],"guide":[188],"policy":[189],"development":[190],"strengthen":[192],"resilience":[194],"in":[195],"scenarios.":[198]},"counts_by_year":[],"updated_date":"2026-06-18T08:10:14.011955","created_date":"2026-05-05T00:00:00"}