What is OT/ICS/SCADA forensics?

OT/ICS/SCADA forensics is the process of collecting, preserving, and analyzing digital evidence from operational technology environments after a cyber incident, equipment malfunction, or suspected sabotage. It covers SCADA systems, programmable logic controllers (PLCs), distributed control systems (DCS), remote terminal units (RTUs), human-machine interfaces (HMIs), and the industrial networks connecting them. The discipline requires specialized knowledge of industrial protocols, safety-critical systems, and regulatory frameworks that do not apply to conventional IT forensics.

How does OT forensics differ from IT forensics?

OT forensics differs from IT forensics in several critical ways. OT systems often cannot be taken offline for imaging because they control physical processes that affect safety and continuous operations. Many industrial devices use proprietary protocols (Modbus, DNP3, EtherNet/IP) and real-time operating systems that standard forensic tools cannot handle. Evidence sources in OT environments include PLC memory, ladder logic programs, historian databases, and industrial protocol traffic rather than traditional file systems and email servers. The triage process must prioritize safety, coordinating with plant operations before any evidence collection begins.

What types of critical infrastructure does GDF Miami support?

GDF Miami performs OT/ICS/SCADA forensic analysis for water and wastewater treatment plants, power generation facilities, electrical transmission and distribution systems, oil and gas pipeline operations, railroad signaling and transportation networks, traffic management systems, and manufacturing environments. Our analysts hold GICSP and GRID certifications specific to industrial control system security, and our forensic reports are structured to support CIRCIA, NERC CIP, EPA, and TSA compliance requirements.

Can forensic analysis be performed without shutting down the control system?

In most cases, yes. GDF Miami uses non-disruptive collection methods that prioritize safety and operational continuity. Network-based evidence (packet captures, historian exports, firewall logs) can be collected passively without affecting running processes. PLC memory and configuration data can often be read using vendor diagnostic interfaces in read-only mode. When more invasive collection is required, GDF Miami coordinates timing with plant operations to schedule activities during planned maintenance windows or reduced-load periods, ensuring that evidence collection never compromises safety or process availability.

Operational Technology

OT, ICS and SCADA Forensics for Post-Incident Reconstruction

When an incident touches a control system, the useful reconstruction has to answer three questions: what actually happened in the process, how the attacker (or the misconfiguration, or the third-party device) reached the position from which it happened, and what artifacts survive to support the record. All three answers depend on evidence that has a very short half-life in OT environments.

What OT Forensics Actually Answers

What happened in the process. Reconstruction of the operational sequence: which setpoint changes, which control-loop actions, which safety-instrumented-system responses, in what order, at what precise times.
How the actor reached the position that produced the outcome. Whether through a compromised HMI, a compromised engineering workstation, a third-party maintenance device, a vendor remote-access path or the IT/OT boundary. The answer determines the corrective action.
Whether the operator is responsible. The initial narrative in many OT incidents blames the human on shift. The reconstruction determines whether the record supports that or contradicts it. Both outcomes matter to the operator and to the operator’s counsel.
What the compliance and reporting obligations are. CISA reporting under CIRCIA, sector-specific notification, USCG reporting for MTSA facilities, and the operator’s own regulator engagement all depend on the technical facts.
What corrective action the environment actually requires. A defensible finding on causation is the input to a defensible corrective-action plan.

Evidence Acquisition in OT Environments

OT evidence has a short half-life. Volatile memory is lost when the affected device is power-cycled to restore operation. Historian rings roll over. Switch and firewall telemetry is often retained only briefly by default. Restoration of a controller from backup destroys the compromised state. Every acquisition decision has to balance the evidentiary value of preserving state against the operational requirement to restore the process.

Immediate triage of what can be captured without disturbing operations, and what will require a coordinated operational pause.
Volatile-memory capture from HMIs, engineering workstations and historians before any restart.
Controlled disk imaging of the affected systems, coordinated with the operations team and with counsel.
Network-telemetry preservation across the switches, firewalls, IDS sensors and any OT-native monitoring the environment carries, before the retention window rolls over.
Controller-state acquisition where the analytical question requires it, including PLC program dumps and firmware capture where the on-device state is potentially compromised.
Third-party device analysis where a contractor, maintenance or vendor device is potentially the initial vector.
Chain of custody documented from the first touch, because the record often lands in regulatory proceedings or litigation.

Analysis and Reconstruction

Acquisition produces the raw material. Reconstruction produces the answer. The two-layer report anchors on a technical account of the acquired evidence and a plain-language narrative that counsel, executives, regulators and the tribunal can work with.

Timeline reconstruction across all acquired sources, cross-referenced to the operational record and to any human-recorded log.
Control-logic and firmware analysis where the on-device state is potentially compromised or where a specific attack technique targeted the logic.
Network reconstruction across the OT and boundary telemetry, identifying the paths the actor traversed and the artifacts the traversal left.
Attribution posture where the evidence supports it, distinguishing between opportunistic commodity activity and targeted attribution based on what the evidence actually shows.
Corrective-action support that ties the causation finding to the specific architectural or procedural change required to close the exposure.

Case in point

HMI compromise at a manufacturing plant that cleared the operator

A South Florida manufacturing plant experienced anomalous operational behavior on a specific production line: setpoint changes that had not been requested by the operator on shift, followed by a controlled trip of the line by the safety instrumented system. Initial internal review focused on the possibility of operator error or intentional interference, and specific attention fell on the engineer who had been logged into the HMI during the incident window.

We were retained by outside counsel to perform a defensible forensic reconstruction independent of the initial internal narrative. Volatile memory capture from the surviving HMI, controlled acquisition of the historian and engineering-workstation systems, and preservation of the switch and firewall telemetry across the incident window were completed before the plant returned the line to service.

Reconstruction across the acquired sources established that the setpoint changes were issued by a legitimate authenticated session on the HMI, but the session had been initiated from a maintenance laptop that had been physically connected to the engineering-workstation network segment approximately forty minutes before the first setpoint change. The maintenance laptop belonged to a third-party contractor who had performed unrelated work on an adjacent system earlier that day and had not disconnected the laptop before leaving the site. Analysis of the laptop (recovered with the contractor’s consent) identified a specific piece of commodity malware with a documented capability to enumerate and pivot into ICS environments through opportunistic network access.

The report documented the acquisition methodology, the reconstruction, and the specific evidence that the setpoint changes originated from the compromised contractor laptop rather than from the operator on shift. The operator was cleared. The corrective-action plan addressed the physical-access control on the engineering segment, the third-party device policy, and the residual monitoring gap that had allowed the pivot to occur before the safety system tripped the line.

Full Critical Infrastructure Cybersecurity Compliance

Post-incident forensic work is one arm of the full Critical Infrastructure Cybersecurity Compliance suite our Miami practice runs, integrated with the vulnerability management, network assessment, testing and program-level compliance work the operator relies on continuously. Incident engagements are scoped against the specific reporting and evidence-preservation obligations the operator carries under the applicable framework, so the causation record supports both the immediate response and the compliance file the incident produces.

Incident reports are structured so the record supports both the immediate response and the compliance file that the incident produces: CISA reporting under CIRCIA where triggered, sector-specific notification (NERC event reporting for bulk electric system incidents, EPA notification for public water systems, USCG reporting for MTSA facilities, TSA reporting for pipeline and rail), and the operator’s own regulator engagement. Evidence preservation runs to the retention expectation the compliance framework requires, not to the operator’s default IT retention.

Where Our Miami OT Forensics Practice Runs Deepest

Water and wastewater incidents

Treatment plant and distribution SCADA incidents, with EPA notification support and the coordination with local health authority that many incidents in this sector require.

Manufacturing and cold-chain incidents

Production-line disruptions, safety-instrumented-system trips, product-quality incidents traced to control-system anomalies. Coordination with the operator’s product-liability and insurance carrier on any downstream exposure.

Port and maritime incidents

Terminal operating system incidents, crane and gate system incidents, and vessel-side incidents that reach into shore infrastructure. USCG reporting coordination for MTSA facilities.

Power and generation incidents

Substation, generation, and cogeneration control-system incidents, with NERC event reporting coordination for bulk electric system entities and coordination with the operator’s reliability compliance team.

Airport and aviation-adjacent OT

Airport ground-system, fuel-infrastructure and terminal-facility control-system incidents. Coordinates with the aviation cybersecurity practice on airworthiness-adjacent scope.

Third-party and supply-chain vector incidents

Where the initial vector is a contractor device, a vendor remote-access path or a supply-chain compromise, the analysis documents the specific vector and supports the operator’s recovery matter against the responsible third party.

Standards and Standing

Methodology draws on NIST SP 800-82 Rev.3, NIST SP 800-61 Rev.2, IEC 62443, SWGDE best practices, and the sector-specific incident reporting frameworks each operator is accountable to. Analysts hold GICSP, GRID, GCFR, GCFA, GREM and CISSP among other credentials. Reports are structured for authentication under Fla. Stat. § 90.901 and Federal Rules of Evidence 902(13) and 902(14), and for admissibility analysis under Daubert / Frye. The analyst who performed the acquisition is available for deposition and trial testimony.

Last updated: September 4, 2026

Preserve the Record Before the Restart

OT evidence is lost fast. Volatile state disappears on power cycle. Historian rings roll over. Network telemetry retention windows close. Rapid engagement preserves the fullest evidence base and produces the causation finding the operator, counsel and the regulator will need.

Request Consultation Call (786) 219-1210