Abstract While approaches aimed at developing forensic-ready systems are starting to emerge, it is still primarily a theoretical concept. This paper presents a case study of integrating forensic readiness capabilities into SensitiveCloud, an information system for storing and processing sensitive data. A risk-based approach to forensic readiness design is followed to achieve it. Consequently, weaknesses in both processes and systems are identified, and forensic readiness requirements are formulated. This case study reports on lessons learned in a practical implementation of a forensic-ready system, its impact on security, and its support towards ISO/IEC 27k.

With the increasing threat of cybercrime, there is also an increasing need for the forensic investigation of those crimes. However, the topic of systematic preparation on the possible forensic investigation during the software development, called forensic readiness, has only been explored since recently. Thus, there are still many challenges and open issues. One of the obstacles is ensuring the correct implementation. Moreover, the growing volume and variety of digital evidence produced by the systems have to be put into consideration. It is especially important in the critical information infrastructure domain where potential cyberattacks could impact the safety of people. In this paper, we present research towards verification of forensic readiness in software development, with a focus on digital evidence they produce, to assist the advancement of this research domain. Furthermore, we formulate a process that serves a template for designing, developing, and refining a verification method for forensic-ready software systems.