“…The design proceeds through a phased approach outlined in Figure 1. A digital forensic investigation in engineering workstations or control rooms in CIs includes all electronic devices that are interconnected with each other for sending/receiving messages or two-way communications, such as, mobile phones, laptops, computers, tablets, PDAs, programmable logic controllers, human machine interfaces, and supervisory control and data acquisition systems [16]. These systems and devices have their own storage systems.…”