2020 ICS Cyber Security Conference | USA

With the increased number and sophistication of cyber-attacks, digital forensics has proven to be a powerful data collection tool. Forensic value is operationalized through data preservation as evidence in order to assess the root cause of a system failure or cyber incident for both IT and OT systems. While the IT domain has matured approaches and methodologies to collect and analyze volatile memory, options for OT domain embedded devices are limited at best. In this presentation, hardware forensic techniques to collect and analyze volatile memory content of specific embedded devices are discussed.