{"id":"https://openalex.org/W4364856165","doi":"https://doi.org/10.1109/comst.2023.3264680","title":"A Survey on Industrial Control System Digital Forensics: Challenges, Advances and Future Directions","display_name":"A Survey on Industrial Control System Digital Forensics: Challenges, Advances and Future Directions","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4364856165","doi":"https://doi.org/10.1109/comst.2023.3264680"},"language":"en","primary_location":{"id":"doi:10.1109/comst.2023.3264680","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2023.3264680","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://eprints.gla.ac.uk/297100/","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091479151","display_name":"Marco M. Cook","orcid":"https://orcid.org/0000-0002-5232-2381"},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Marco Cook","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0002-5232-2381","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021412159","display_name":"Angelos K. Marnerides","orcid":null},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Angelos Marnerides","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0002-7996-6216","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105770625","display_name":"Chris Johnson","orcid":"https://orcid.org/0000-0003-2791-6871"},"institutions":[{"id":"https://openalex.org/I126231945","display_name":"Queen's University Belfast","ror":"https://ror.org/00hswnk62","country_code":"GB","type":"education","lineage":["https://openalex.org/I126231945"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Chris Johnson","raw_affiliation_strings":["School of Electronics, Electrical Engineering and Computer Science, Queens University Belfast, Belfast, U.K","School of Electronics, Electrical Engineering and Computer Science, Queens University Belfast, Belfast, Northern Ireland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electronics, Electrical Engineering and Computer Science, Queens University Belfast, Belfast, U.K","institution_ids":["https://openalex.org/I126231945"]},{"raw_affiliation_string":"School of Electronics, Electrical Engineering and Computer Science, Queens University Belfast, Belfast, Northern Ireland","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5021350142","display_name":"Dimitrios P. Pezaros","orcid":"https://orcid.org/0000-0003-0939-378X"},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Dimitrios Pezaros","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0003-0939-378X","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5091479151"],"corresponding_institution_ids":["https://openalex.org/I7882870"],"apc_list":null,"apc_paid":null,"fwci":24.0332,"has_fulltext":false,"cited_by_count":54,"citation_normalized_percentile":{"value":0.99544827,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"25","issue":"3","first_page":"1705","last_page":"1747"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9886000156402588,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.8287023305892944},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6850900650024414},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6474260687828064},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5759816765785217},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5732417106628418},{"id":"https://openalex.org/keywords/computer-forensics","display_name":"Computer forensics","score":0.48926135897636414},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.4817926287651062},{"id":"https://openalex.org/keywords/maturity","display_name":"Maturity (psychological)","score":0.43347084522247314},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.42710548639297485},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.41333815455436707},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3936886787414551},{"id":"https://openalex.org/keywords/systems-engineering","display_name":"Systems engineering","score":0.3234543800354004},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.2077268660068512},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.13775554299354553},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.12546107172966003}],"concepts":[{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.8287023305892944},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6850900650024414},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6474260687828064},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5759816765785217},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5732417106628418},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.48926135897636414},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4817926287651062},{"id":"https://openalex.org/C101433766","wikidata":"https://www.wikidata.org/wiki/Q3543263","display_name":"Maturity (psychological)","level":2,"score":0.43347084522247314},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.42710548639297485},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.41333815455436707},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3936886787414551},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.3234543800354004},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2077268660068512},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.13775554299354553},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.12546107172966003},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C138496976","wikidata":"https://www.wikidata.org/wiki/Q175002","display_name":"Developmental psychology","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/comst.2023.3264680","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2023.3264680","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"},{"id":"pmh:oai:eprints.gla.ac.uk:297100","is_oa":true,"landing_page_url":"https://eprints.gla.ac.uk/297100/","pdf_url":null,"source":{"id":"https://openalex.org/S4210235606","display_name":"ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam)","issn_l":"2622-8912","issn":["2622-8912","2622-8920"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},{"id":"pmh:oai:pure.qub.ac.uk/portal:publications/6ed9a7e5-02f1-47d4-8af5-aca1a960a840","is_oa":false,"landing_page_url":"https://pure.qub.ac.uk/en/publications/6ed9a7e5-02f1-47d4-8af5-aca1a960a840","pdf_url":null,"source":{"id":"https://openalex.org/S4306402319","display_name":"Research Portal (Queen's University Belfast)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I126231945","host_organization_name":"Queen's University Belfast","host_organization_lineage":["https://openalex.org/I126231945"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cook , M , Marnerides , A , Johnson , C & Pezaros , D 2023 , ' A survey on industrial control system digital forensics: challenges, advances and future directions ' , IEEE Communications Surveys and Tutorials , vol. 25 , no. 3 , pp. 1705-1747 . https://doi.org/10.1109/comst.2023.3264680","raw_type":"article"}],"best_oa_location":{"id":"pmh:oai:eprints.gla.ac.uk:297100","is_oa":true,"landing_page_url":"https://eprints.gla.ac.uk/297100/","pdf_url":null,"source":{"id":"https://openalex.org/S4210235606","display_name":"ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam)","issn_l":"2622-8912","issn":["2622-8912","2622-8920"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},"sustainable_development_goals":[{"score":0.5299999713897705,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[{"id":"https://openalex.org/G1708471004","display_name":null,"funder_award_id":"EP/N033957/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G4791733040","display_name":"Industrial CASE Account - University of Glasgow 2017","funder_award_id":"EP/R511936/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G521268540","display_name":"PETRAS 2","funder_award_id":"EP/S035362/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G8186088439","display_name":"Network Measurement as a Service","funder_award_id":"EP/N033957/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":181,"referenced_works":["https://openalex.org/W7870703","https://openalex.org/W13926338","https://openalex.org/W16946696","https://openalex.org/W26759578","https://openalex.org/W121325148","https://openalex.org/W185406290","https://openalex.org/W195047088","https://openalex.org/W210115924","https://openalex.org/W236656208","https://openalex.org/W1177028454","https://openalex.org/W1539707978","https://openalex.org/W1545599162","https://openalex.org/W1553076703","https://openalex.org/W1570459469","https://openalex.org/W1580326605","https://openalex.org/W1590786596","https://openalex.org/W1604717907","https://openalex.org/W1617459194","https://openalex.org/W1625303491","https://openalex.org/W1969228310","https://openalex.org/W1990067238","https://openalex.org/W1990614609","https://openalex.org/W1992208352","https://openalex.org/W1997209646","https://openalex.org/W2000621030","https://openalex.org/W2001292291","https://openalex.org/W2006942880","https://openalex.org/W2008105825","https://openalex.org/W2009166708","https://openalex.org/W2009429512","https://openalex.org/W2011143165","https://openalex.org/W2016124028","https://openalex.org/W2016828421","https://openalex.org/W2031397481","https://openalex.org/W2039427951","https://openalex.org/W2041078517","https://openalex.org/W2067503796","https://openalex.org/W2072880522","https://openalex.org/W2077699686","https://openalex.org/W2078419795","https://openalex.org/W2083351328","https://openalex.org/W2094991181","https://openalex.org/W2095379156","https://openalex.org/W2116820421","https://openalex.org/W2117227183","https://openalex.org/W2122646361","https://openalex.org/W2123965969","https://openalex.org/W2130501758","https://openalex.org/W2131050969","https://openalex.org/W2137130182","https://openalex.org/W2141411329","https://openalex.org/W2142993476","https://openalex.org/W2146330317","https://openalex.org/W2157356660","https://openalex.org/W2161630727","https://openalex.org/W2170673199","https://openalex.org/W2182092823","https://openalex.org/W2182454100","https://openalex.org/W2184058014","https://openalex.org/W2184517626","https://openalex.org/W2188079924","https://openalex.org/W2267647354","https://openalex.org/W2283878449","https://openalex.org/W2285617549","https://openalex.org/W2285923621","https://openalex.org/W2293276716","https://openalex.org/W2294760324","https://openalex.org/W2296721859","https://openalex.org/W2336157635","https://openalex.org/W2341183948","https://openalex.org/W2341697730","https://openalex.org/W2342408547","https://openalex.org/W2462751245","https://openalex.org/W2474685028","https://openalex.org/W2497431353","https://openalex.org/W2500936479","https://openalex.org/W2513445928","https://openalex.org/W2514178610","https://openalex.org/W2515990616","https://openalex.org/W2524919294","https://openalex.org/W2527619560","https://openalex.org/W2545128618","https://openalex.org/W2570433379","https://openalex.org/W2578943040","https://openalex.org/W2601924125","https://openalex.org/W2604206920","https://openalex.org/W2614042168","https://openalex.org/W2742236820","https://openalex.org/W2743823417","https://openalex.org/W2744632709","https://openalex.org/W2750629981","https://openalex.org/W2768270002","https://openalex.org/W2769208058","https://openalex.org/W2770525875","https://openalex.org/W2774522941","https://openalex.org/W2781892241","https://openalex.org/W2782983291","https://openalex.org/W2791587036","https://openalex.org/W2810579294","https://openalex.org/W2885024929","https://openalex.org/W2887195793","https://openalex.org/W2889239165","https://openalex.org/W2889436848","https://openalex.org/W2896851637","https://openalex.org/W2899684127","https://openalex.org/W2901874618","https://openalex.org/W2904474291","https://openalex.org/W2905281036","https://openalex.org/W2906941112","https://openalex.org/W2908133708","https://openalex.org/W2912047161","https://openalex.org/W2921976480","https://openalex.org/W2937619061","https://openalex.org/W2951530623","https://openalex.org/W2954648558","https://openalex.org/W2955535915","https://openalex.org/W2955712831","https://openalex.org/W2966748955","https://openalex.org/W2967079810","https://openalex.org/W2968664144","https://openalex.org/W2970761526","https://openalex.org/W2971297766","https://openalex.org/W2972531726","https://openalex.org/W2981622519","https://openalex.org/W2982586338","https://openalex.org/W2986254563","https://openalex.org/W2990623250","https://openalex.org/W2998298992","https://openalex.org/W2999472659","https://openalex.org/W3004344782","https://openalex.org/W3010894240","https://openalex.org/W3011215978","https://openalex.org/W3017165746","https://openalex.org/W3020448654","https://openalex.org/W3029946226","https://openalex.org/W3032941015","https://openalex.org/W3036099181","https://openalex.org/W3036981874","https://openalex.org/W3042229408","https://openalex.org/W3047586848","https://openalex.org/W3094138310","https://openalex.org/W3104227430","https://openalex.org/W3107765100","https://openalex.org/W3127943761","https://openalex.org/W3128032258","https://openalex.org/W3129506420","https://openalex.org/W3129524550","https://openalex.org/W3158902163","https://openalex.org/W3165880105","https://openalex.org/W3167618552","https://openalex.org/W3169498651","https://openalex.org/W3171138449","https://openalex.org/W3186345182","https://openalex.org/W3195892385","https://openalex.org/W3196672685","https://openalex.org/W3211510811","https://openalex.org/W4210698279","https://openalex.org/W4214911557","https://openalex.org/W4221103416","https://openalex.org/W4226163120","https://openalex.org/W4226248997","https://openalex.org/W4247143357","https://openalex.org/W4247200422","https://openalex.org/W4285310015","https://openalex.org/W4290996071","https://openalex.org/W4386881452","https://openalex.org/W6607448945","https://openalex.org/W6634975365","https://openalex.org/W6677243974","https://openalex.org/W6679195039","https://openalex.org/W6683915950","https://openalex.org/W6685472168","https://openalex.org/W6695919700","https://openalex.org/W6697297259","https://openalex.org/W6737892506","https://openalex.org/W6745965060","https://openalex.org/W6760319606","https://openalex.org/W6771038748","https://openalex.org/W6778590303","https://openalex.org/W6780045405","https://openalex.org/W6780889804"],"related_works":["https://openalex.org/W49061614","https://openalex.org/W2372416526","https://openalex.org/W2741294679","https://openalex.org/W2204328961","https://openalex.org/W831794578","https://openalex.org/W2028547439","https://openalex.org/W2523853946","https://openalex.org/W2041229035","https://openalex.org/W2074106648","https://openalex.org/W2962417627"],"abstract_inverted_index":{"Operational":[0],"Technology":[1],"(OT)":[2],"systems":[3],"have":[4,67,147,264],"become":[5],"increasingly":[6],"interconnected":[7],"and":[8,45,59,71,96,100,127,144,181,200,202,239,247,261,274,282,295,334,351,357],"automated,":[9],"consequently":[10],"resulting":[11],"in":[12,50,113,228],"them":[13,76,196],"becoming":[14,31],"targets":[15],"of":[16,25,118,137,151,160,183,243,309,320,332],"cyber":[17,163],"attacks,":[18,324],"with":[19,106],"the":[20,36,47,83,92,124,148,158,179,206,215,231,259,288,326,366],"threat":[21],"towards":[22],"a":[23,90,110],"range":[24],"critical":[26],"national":[27],"infrastructure":[28],"(CNI)":[29],"sectors":[30,52],"heightened.":[32],"This":[33],"is":[34,103,121,141,167,297],"particularly":[35],"case":[37],"for":[38,80,165,250,271],"Industrial":[39],"Control":[40],"Systems":[41],"(ICS),":[42],"which":[43],"control":[44],"operate":[46],"physical":[48,84],"processes":[49,248],"CNI":[51],"such":[53],"as":[54,153,176,212,214],"water":[55],"treatment,":[56],"electrical":[57],"generation":[58],"manufacturing.":[60],"Unlike":[61],"information":[62],"technology":[63],"(IT)":[64],"systems,":[65],"ICS":[66,132,138,166,184,225,251,272,290,323,346,367],"unique":[68,170],"cyber-physical":[69],"characteristics":[70],"related":[72,130],"safety":[73],"requirements,":[74],"making":[75],"an":[77,189,318],"attractive":[78],"target":[79],"attacks":[81,102],"given":[82,253],"consequences":[85],"that":[86,174,263,301,360],"can":[87,361],"occur.":[88],"As":[89],"result,":[91],"requirement":[93],"to":[94,122,131,178,230,268,279,307,364],"respond":[95],"learn":[97],"from":[98],"previous":[99],"new":[101],"also":[104,219,298],"increasing,":[105,168],"digital":[107,133,139,155,232,244,291,347,368],"forensics":[108,140,233,348,369],"playing":[109],"significant":[111],"role":[112],"this":[114,119,222,304,315,339],"process.":[115],"The":[116,135,241],"aim":[117],"paper":[120,316,340],"discuss":[123],"main":[125],"issues":[126],"existing":[128],"limitations":[129],"forensic.":[134],"field":[136],"relatively":[142],"under-developed":[143],"does":[145],"not":[146],"same":[149],"levels":[150],"maturity":[152],"IT":[154],"forensics.":[156],"Although":[157],"amount":[159],"research":[161,349],"on":[162,192,344],"security":[164],"many":[169],"challenges":[171],"still":[172],"exist":[173],"pose":[175],"barriers":[177],"development":[180],"deployment":[182],"forensic":[185,226,237,245,280,292],"capabilities.":[186],"We":[187],"provide":[188],"extensive":[190],"discussion":[191],"these":[193,209],"challenges,":[194],"categorising":[195],"into":[197,287],"technical,":[198],"socio-technical,":[199],"operational":[201],"legal":[203],"themes.":[204],"Furthermore,":[205,221],"relationship":[207],"between":[208],"challenge":[210],"themes":[211],"well":[213],"inter-challenge":[216],"dependencies":[217],"are":[218,252],"examined.":[220],"work":[223],"discusses":[224],"advances":[227],"relation":[229],"life":[234],"chain,":[235],"specifically":[236],"readiness":[238],"investigations.":[240],"areas":[242,359],"training":[246],"models":[249],"particular":[254],"focus.":[255],"Moreover,":[256],"we":[257],"assess":[258],"technologies":[260],"tools":[262],"been":[265],"either":[266],"applied":[267],"or":[269],"developed":[270],"components":[273],"networks,":[275],"giving":[276],"special":[277],"attention":[278],"acquisition":[281],"analysis":[283],"methods.":[284],"An":[285],"examination":[286],"specific":[289,327],"data":[293,311,330],"sources":[294],"artefacts":[296,331],"presented,":[299],"highlighting":[300],"until":[302],"recently,":[303],"was":[305],"limited":[306],"descriptions":[308],"generic":[310],"formats.":[312],"In":[313],"addition,":[314],"provides":[317],"overview":[319],"several":[321],"key":[322],"summarising":[325],"techniques":[328],"used,":[329],"interest,":[333],"proposing":[335],"lessons":[336],"learnt.":[337],"Finally,":[338],"presents":[341],"open":[342],"discussions":[343],"future":[345],"directions":[350],"on-going":[352],"issues,":[353],"covering":[354],"both":[355],"short":[356],"long-term":[358],"be":[362],"addressed":[363],"improve":[365],"capability.":[370]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":29},{"year":2024,"cited_by_count":13},{"year":2023,"cited_by_count":6}],"updated_date":"2026-05-05T08:41:31.759640","created_date":"2025-10-10T00:00:00"}