Controllers, Historians, Engineering Workstations and Remote Access

OT, ICS and SCADA Forensics for Controller and Historian Analysis

A setpoint moved, a controller rebooted or a process drifted, and nobody in the control room can say why. Global Digital Forensics preserves the controller logic, historian data, engineering workstation sessions and remote access logs around the event without stopping the process, and shows what changed, when and by whose hand.

Get a Free Consultation Call (800) 868-8189

Water treatment and electrical utility infrastructure.

Preserve the Record Before the Restore Overwrites It

The evidence that explains an industrial event lives in the places recovery erases. A reloaded controller project overwrites the logic that was running, a rebuilt engineering workstation takes its session history with it, and a historian never set to keep high resolution data rolls over on its own schedule. The first step on every OT forensics engagement is agreeing with the operator which records matter most and how each can be captured without touching the process. Controller and project files, historian and alarm records, engineering workstations, remote access systems and network evidence are collected under a documented method, any state the collection itself changes is recorded, and a running process is never interrupted just to take an image.

With the record preserved, we compare the logic and settings that were actually running against an identified, authorized baseline, and line up event times using measured clock offsets rather than timestamps at face value. The opinion separates an observed change from what the operator intended, and it rests on the records that survived, each with its coverage stated.

Your output includes the preserved records and their coverage, a source and time map, logic and configuration comparisons, and an event timeline with the alternative explanations tested against it, written so the examiner can support it by declaration, in deposition or at trial.

The method follows NIST SP 800-82 Rev. 3, Guide to Operational Technology Security and NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, applied to your installed systems during scoping.

If a controller has already been reloaded or a workstation rebuilt, call (800) 868-8189 before anything else is touched, and we will work out what the remaining sources can still show.

Technical methods and scope

Collection Planned Around Safety Systems and the Process

We examine the digital records around cyber events, malfunctions, unexplained process changes and suspected unauthorized access. Every collection is planned with engineering and the process owners around the safety systems, controller timing, availability requirements and any recovery already underway, because a method that suits an office laptop can trip a line or leave a controller half written. Our methods start from the operating conditions and work outward.

Before anything is touched we document the alarms, operator actions, network state, affected zones, current logic and any emergency changes already made. Sources are taken in order of how quickly they expire and how much operating risk their collection carries, and a controller memory capture proceeds only under an approved method that accounts for its effect on the process and on the evidence.

Map the Industrial Evidence That Actually Exists

Sources include engineering workstations, HMI and SCADA servers, historians, jump hosts, firewalls, VPN and identity systems, controller logic, backups, field gateways, safety systems and passive network captures. For each one we record the owner, time source, retention, acquisition method and any device specific export restriction, so the examination rests on the evidence that exists rather than the evidence a diagram implies.

Call (800) 868-8189 or request a scoping call to plan the assessment around production.

Compare Logic, Configuration and Firmware With the Baseline

We compare controller and engineering records with the approved project files, backups and change records, looking for differences in logic, setpoints, timers, communications, users, firmware and safety settings. Maintenance, replacements, commissioning problems and undocumented operator changes are weighed alongside cyber explanations before any cause is named, because a technician's unlogged change produces the same symptom as an intrusion.

Binary and firmware review runs against a supported comparison or a known good image, and the report states the extraction coverage and the effect of signing, encryption or proprietary formats, so every comparison has a clear technical basis.

One Timeline Across Systems That Disagree About Time

Network records, historian values, operator logs, controller events and enterprise identity evidence are reconciled using documented clock offsets. Drift, local time settings, power resets and missing time sources are measured first, and only then do we separate the initiating event, the control actions, the process effects and the response changes. A timeline built this way survives the engineer who checks it.

Describe the plant and the constraints your operators set and the first call plans the work around them.

Findings Engineers Can Verify Line by Line

The report can include the collection matrix, the normalized timeline, the logic and setting comparisons and, where scoped, the network paths and affected assets. It separates source observations from causal opinions and records the collection related changes and the safety constraints that shaped the work. Our examiners have testified in federal and state courts, and the report is written so an engineer can check it and a court can follow it.

Methodology

Agree, Preserve, Validate and Report

Agree operational authority and safety limits

Process owners, operating windows, excluded actions, stop conditions, communication channels and recovery support are agreed before a single record is collected, starting with who can say stop.
Observe and preserve the industrial record

Assets, protocols, zones, remote routes and engineering station traffic are observed with approved passive methods, and the sources that expire first are preserved first.
Validate the relevant technical findings

Findings that matter are validated in a laboratory, on a representative setup or inside a controlled operating window chosen for the actual process risk, and never by experimenting on production.
Report the supported findings

Each supported change and access path is tied to its source records and its effect on the process, in a report the examiner who wrote it will defend.

Evidence commonly examined

Industrial Event Evidence We Examine

Passive traffic and flow records show the communication around the event, while asset, firmware and configuration records establish the system state for comparison. Firewall, remote access and identity records connect activity to the paths it travelled, and HMI, historian and engineering station logs add the recorded operating and change context.

Controller logic and approved backups supply the baseline comparison, and operating procedures and recovery plans set the constraints the examination respects.

What you can expect

Send the sites, the control systems and the windows you can offer, and a senior assessor will propose the scope.

Your Preserved Records and Event Findings

You receive an evidence inventory naming the preserved sources and the event coverage each provides, and a validation record documenting the approved methods, the tested conditions and the observed results.

The findings explain the operating effect of each supported change and cite the records behind it, and the examiner who wrote them supports them by declaration, in deposition or at trial.

If the event is still unfolding, our OT, ICS and SCADA incident response team runs this preservation alongside the operator's recovery.

Plan the Examination With a Senior Examiner

Bring the event, the control environment and the operating constraints to a free initial consultation. A senior examiner agrees the authorized collection, the examination questions and the reporting your engineers and executives need before any record is touched.

Preview the report contents

Every OT forensic report follows the same structure.

A source inventory lists each preserved record with its owner, time source and coverage. A normalized timeline places operator actions, control changes and process effects in order with the clock offsets stated. The findings tie each observed change to the record that shows it, and the report is built to carry a declaration, a deposition or trial testimony.

Get a Free Consultation

Frequently asked

Planning Industrial Forensics Around Plant Operations

What should we define before an industrial forensic examination begins?

The industrial event as your operators experienced it and the historian, controller and network records you believe exist. Preserve the operating context, including shift notes and any emergency changes, and tell us about known clock differences between systems so the timeline accounts for them.

How is the work planned around plant operations?

Safety requirements, authorized methods and operating windows are agreed with your engineers before collection starts. Any active step is scoped explicitly with the operator, and when production validation is unsuitable the work moves to a representative or laboratory system.

What access and information do you need from us?

Network diagrams, asset details and the remote access arrangements for vendors and staff. With those we define the authorized access and the preservation plan before work begins, so nobody decides at the console what is safe to collect.

How do we agree on deliverables?

During scoping we agree the engineering and management audiences, the form of the report, the corrective priorities and any later validation. The report you receive is the one you planned for, written for the people who have to act on it.

Free consultation

Find Out What Changed Before the Event

On the first call a senior examiner hears which process changed and when, identifies the controller, historian and workstation records to hold before recovery overwrites them, and outlines a collection plan your operators can approve.

Founded in 1992, with a 24/7 hotline.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.