What's the DFIRence for ICS?
summary
Concrete collection steps for embedded ICS: pull configs, firmware, logs, memory dumps, and record physical state rather than vague theory. Examples target GE D20MX and Schweitzer SEL-3530 RTAC RTUs, showing console serial access, where a full 1 GB RAM dump can take 6 days to dump 1GB over 115200 baud. A prototype VXWorks DFIR tool caches pages, compares live memory to known-good images, and already finds injected changes (disabled firewall routine), with plans to open source.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:55Agenda
- 1:41Vxworks
- 2:07Digital Forensics
- 2:34How has ICS affected
- 3:41ICS Anomaly
- 5:23Forensic Evidence
- 6:00Control System Devices
- 6:40Physical Data
- 12:23Shells
- 13:17Main Shell
- 13:44Running Configuration
- 14:20Wireshark
- 14:48No Memory
- 15:31Seashell
- 15:59Memory
- 16:39Windows Reverse Engineer
- 16:49Solution
- 18:09Cool Features
- 19:14Demo
- 20:10Projects
- 20:41Future Plans
- 21:27Arktech
- 21:48Digital Data
- 22:23Example
- 23:43Research
- 24:40Use Case
related talks
49mDTM Components: Shadow Keys to the ICS Kingdom
14mDFIR - Don't Forget Your Roots!
48mDoors of Durin: The Veiled Gate to Siemens S7 Silicon
45mIntegrated Circuit Offensive Security
47mExfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
40mUnveiling the Secrets of Codesys V3: ZeroDays, Forensic Artifacts and More
24mDefeating the Transparency Feature of DBI
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA