FROHA - Forensic Recorder for Operator HMI Activities
Year: 2026
Type: article
Abstract: Industrial Control Systems (ICS) are vulnerable to a wide range of cyber attacks. Remote attackers can interfere with control room's ability to monitor and control physical processes, impairing operational safety. To comprehend such attacks, digital forensics are essential to trace the impact and generate evidence, which includes a reconstruction of operator activities on the Human-Machine Interfaces (HMI). However, due to differences between office IT and operational technology (OT), established IT forensics cannot be directly applied. While newer ICS provide extensive server-side event logging for operational and security purposes, they capture client-side interactions at a high level, not covering further low-level data sources such as visualized process states and detailed HMI interactions (e.g., pushed buttons, displayed plant areas). To complement server-side logging, retrofit legacy ICS with security logging, and enable reconstruction of operator actions and views as well as cross-validation against server logs, we present a host-based forensic logging system FROHA for HMI clients that combines: (1) Graphics API hooking to capture rendered HMI content, (2) RAM memory scanning to track physical process variable changes, and (3) External event monitoring via Windows UI Automation APIs to track operator inputs such as mouse clicks and window interactions. By analyzing volatile data sources in conjunction with windows mechanisms to capture their related data, we establish a vendor-independent logging system which generates forensic audit logs regarding the operator's view and actions. We validate our approach by implementing and applying it to a virtualized live copy of a productive ABB 800xA Distributed Control System (DCS) operated by an energy supplier, demonstrating its applicability for forensic analysis in ICS environments.
DOI: 10.1145/3848417
Authors: Alexios Karagiozidis, Martin Gergeleit
Institution: RheinMain University of Applied Sciences
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7221458722