{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,16]],"date-time":"2024-09-16T09:40:38Z","timestamp":1726479638341},"reference-count":22,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2022,1,7]],"date-time":"2022-01-07T00:00:00Z","timestamp":1641513600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Forensic Science International: Digital Investigation"],"published-print":{"date-parts":[[2022,4]]},"DOI":"10.1016\/j.fsidi.2022.301339","type":"journal-article","created":{"date-parts":[[2022,3,24]],"date-time":"2022-03-24T23:42:52Z","timestamp":1648165372000},"page":"301339","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":6,"special_numbering":"S","title":["Memory forensic analysis of a programmable logic controller in industrial control systems"],"prefix":"10.1016","volume":"40","author":[{"given":"Muhammad Haris","family":"Rais","sequence":"first","affiliation":[]},{"given":"Rima Asmar","family":"Awad","sequence":"additional","affiliation":[]},{"suffix":"Jr.","given":"Juan","family":"Lopez","sequence":"additional","affiliation":[]},{"given":"Irfan","family":"Ahmed","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"issue":"12","key":"10.1016\/j.fsidi.2022.301339_bib1","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/MC.2012.325","article-title":"SCADA systems: challenges for forensic investigators","volume":"45","author":"Ahmed","year":"2012","journal-title":"Computer"},{"issue":"6","key":"10.1016\/j.fsidi.2022.301339_bib2","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1109\/MSP.2017.4251102","article-title":"Programmable logic controller forensics","volume":"15","author":"Ahmed","year":"2017","journal-title":"IEEE Secur. Privacy"},{"key":"10.1016\/j.fsidi.2022.301339_bib3","series-title":"15th IEEE Workshop on Offensive Technologies (WOOT)","article-title":"Empirical study of plc authentication protocols in industrial control systems","author":"Ayub","year":"2021"},{"year":"2013","series-title":"Firmware Counterfeiting and Modification Attacks on Programmable Logic Controllers, Tech. Rep","author":"Basnight","key":"10.1016\/j.fsidi.2022.301339_bib4"},{"issue":"2","key":"10.1016\/j.fsidi.2022.301339_bib5","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1016\/j.ijcip.2013.04.004","article-title":"Firmware modification attacks on programmable logic controllers","volume":"6","author":"Basnight","year":"2013","journal-title":"Int. J. Critical Infrastruct. Protect."},{"key":"10.1016\/j.fsidi.2022.301339_bib6","doi-asserted-by":"crossref","first-page":"S26","DOI":"10.1016\/j.diin.2017.06.005","article-title":"Leveraging the srtp protocol for over-the-network memory acquisition of a ge fanuc series 90-30","volume":"22","author":"Denton","year":"2017","journal-title":"Digit. Invest."},{"key":"10.1016\/j.fsidi.2022.301339_bib7","first-page":"102","article-title":"Plcblockmon: data logging and extraction on plcs for cyber intrusion detection","volume":"vol. 5","author":"Findrik","year":"2018"},{"year":"2017","series-title":"Hey, My Malware Knows Physics! Attacking Plcs with Physical Model Aware Rootkit","author":"Garcia","key":"10.1016\/j.fsidi.2022.301339_bib8"},{"key":"10.1016\/j.fsidi.2022.301339_bib9","series-title":"Proceeding of the 2019 NDSS Workshop on Binary Analysis Research","article-title":"CLIK on PLCs! Attacking control logic with decompilation and virtual PLC","author":"Kalle","year":"2019"},{"key":"10.1016\/j.fsidi.2022.301339_bib10","series-title":"International Conference on Critical Infrastructure Protection","first-page":"45","article-title":"Analysis of field devices used in industrial control systems","author":"Mulder","year":"2012"},{"key":"10.1016\/j.fsidi.2022.301339_bib11","series-title":"Information Security","first-page":"402","article-title":"Automated reconstruction of control logic for programmable logic controller forensics","author":"Qasim","year":"2019"},{"key":"10.1016\/j.fsidi.2022.301339_bib12","first-page":"301013","article-title":"Control logic forensics framework using built-in decompiler of engineering software in industrial control systems","volume":"33","author":"Qasim","year":"2020","journal-title":"Forensic Sci. Int.: Digit. Invest."},{"key":"10.1016\/j.fsidi.2022.301339_bib13","series-title":"Critical Infrastructure Protection XV","article-title":"Attacking iec-61131 logic engine in programmable logic controllers","author":"Qasim","year":"2021"},{"key":"10.1016\/j.fsidi.2022.301339_bib14","series-title":"Proceedings of the ACM\/IEEE 12th International Conference on Cyber-Physical Systems, ICCPS \u201921","first-page":"177","article-title":"Spatiotemporal g-code modeling for secure fdm-based 3d printing","author":"Rais","year":"2021"},{"key":"10.1016\/j.fsidi.2022.301339_bib15","doi-asserted-by":"crossref","first-page":"102200","DOI":"10.1016\/j.addma.2021.102200","article-title":"Dynamic-thermal and localized filament-kinetic attacks on fused filament fabrication based 3d printing process","volume":"46","author":"Rais","year":"2021","journal-title":"Add. Manufact."},{"key":"10.1016\/j.fsidi.2022.301339_bib16","first-page":"301196","article-title":"Jtag-based plc memory acquisition framework for industrial control systems","volume":"37","author":"Rais","year":"2021","journal-title":"Forensic Sci. Int.: Digit. Invest."},{"key":"10.1016\/j.fsidi.2022.301339_bib17","series-title":"Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, CODASPY \u201918","first-page":"319","article-title":"Denial of engineering operations attacks in industrial control systems","author":"Senthivel","year":"2018"},{"author":"Statista","key":"10.1016\/j.fsidi.2022.301339_bib18"},{"issue":"4","key":"10.1016\/j.fsidi.2022.301339_bib19","first-page":"7","article-title":"Exploring the use of plc debugging tools for digital forensic investigations on scada systems","volume":"10","author":"Wu","year":"2015","journal-title":"J.\u00a0Digital Foren. Secur. Law"},{"key":"10.1016\/j.fsidi.2022.301339_bib20","series-title":"ICT Systems Security and Privacy Protection","first-page":"33","article-title":"Control logic injection attacks on industrial control systems","author":"Yoo","year":"2019"},{"key":"10.1016\/j.fsidi.2022.301339_bib21","first-page":"1","article-title":"Avatar: a framework to support dynamic security analysis of embedded systems' firmwares","volume":"23","author":"Zaddach","year":"2014","journal-title":"NDSS"},{"key":"10.1016\/j.fsidi.2022.301339_bib22","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1016\/j.ijcip.2016.12.002","article-title":"A\u00a0methodology for determining the image base of arm-based industrial control system firmware","volume":"16","author":"Zhu","year":"2017","journal-title":"Int. J. Critical Infrastruct. Protect."}],"container-title":["Forensic Science International: Digital Investigation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281722000087?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281722000087?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2022,3,24]],"date-time":"2022-03-24T23:43:09Z","timestamp":1648165389000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2666281722000087"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4]]},"references-count":22,"alternative-id":["S2666281722000087"],"URL":"https:\/\/doi.org\/10.1016\/j.fsidi.2022.301339","relation":{},"ISSN":["2666-2817"],"issn-type":[{"type":"print","value":"2666-2817"}],"subject":[],"published":{"date-parts":[[2022,4]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Memory forensic analysis of a programmable logic controller in industrial control systems","name":"articletitle","label":"Article Title"},{"value":"Forensic Science International: Digital Investigation","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.fsidi.2022.301339","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2022 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"301339"}}