The Role of Digital Forensics in Protecting Critical Energy Infrastructure from Cyberattacks

Energy infrastructure is increasingly being targeted by cyberattacks, and this trend is expected to continue due to the infrastructure's critical role in national security. This research combines a systematic literature review, theoretical analysis and comparative case study analysis in which prominent real-world incidents (Stuxnet, Triton/Trisis, the Ukraine blackouts, and the Colonial Pipeline attack) were analysed from the forensics perspective, as a methodology framework. This study focuses on integrating digital forensics as a proactively used tool into the strategic defence and protection model for critical energy infrastructure. An additional focus of the study is on the concrete barriers to fully incorporating digital forensics into energy infrastructure.