{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,21]],"date-time":"2025-12-21T06:25:10Z","timestamp":1766298310493,"version":"build-2065373602"},"reference-count":33,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2025,3,22]],"date-time":"2025-03-22T00:00:00Z","timestamp":1742601600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006701","name":"Umm al-Qura University","doi-asserted-by":"publisher","award":["25UQU4361220GSSR01"],"award-info":[{"award-number":["25UQU4361220GSSR01"]}],"id":[{"id":"10.13039\/501100006701","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>The Digital Twin (DT) technology shifts the monitoring and control of physical assets into cyberspace through IoT, network, and simulation technologies. However, new challenges have arisen regarding the admissibility of evidence collected from Digital Twin environments. In this paper, we examine the features and challenges that the Digital Twin technology presents to digital forensic science. We propose a new architectural model to guide the implementation of a forensically sound environment. Additionally, we introduce a new knowledge model representation that encompasses all forensic requirements to ensure the admissibility of evidence replicas. We propose a new forensic adversary model to formally analyze the preservation of forensic requirements.<\/jats:p>","DOI":"10.3390\/computers14040115","type":"journal-article","created":{"date-parts":[[2025,3,24]],"date-time":"2025-03-24T04:48:18Z","timestamp":1742791698000},"page":"115","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["ForensicTwin: Incorporating Digital Forensics Requirements Within a Digital Twin"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1781-2908","authenticated-orcid":false,"given":"Aymen","family":"Akremi","sequence":"first","affiliation":[{"name":"College of Computing, Umm Al-Qura University (UQU), Makkah 21955, Saudi Arabia"}]}],"member":"1968","published-online":{"date-parts":[[2025,3,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Kieseberg, P., and Weippl, E. (2018, January 16\u201319). Security challenges in cyber-physical production systems. Proceedings of the Software Quality: Methods and Tools for Better Software and Systems: 10th International Conference, SWQD 2018, Vienna, Austria. Proceedings 10.","DOI":"10.1007\/978-3-319-71440-0_1"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Akremi, A., Sallay, H., Rouached, M., Sriti, M.F., Abid, M., and Bouaziz, R. (2015, January 19\u201320). Towards a built-in digital forensics-aware framework for web services. Proceedings of the 2015 11th International Conference on Computational Intelligence and Security (CIS), Shenzhen, China.","DOI":"10.1109\/CIS.2015.95"},{"key":"ref_3","unstructured":"Dietz, M., Englbrecht, L., and Pernul, G. (2021, January 1\u20132). Enhancing industrial control system forensics using replication-based digital twins. Proceedings of the Advances in Digital Forensics XVII: 17th IFIP WG 11.9 International Conference, Virtual Event. Revised Selected Papers 17."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"125458","DOI":"10.1016\/j.eswa.2024.125458","article-title":"Structural digital Twin for damage detection of CFRP composites using meta transfer Learning-based approach","volume":"261","author":"Liu","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"ref_5","first-page":"301210","article-title":"The complexity of internet of things forensics: A state-of-the-art review","volume":"38","author":"Lutta","year":"2021","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Tyou, I., Ohashi, S., Yu, J., Miura, T., Hosoi, T., and Matsuura, K. (2024, January 19\u201322). Leveraging Timestamps to Create Secure and Feeless Evidence Management. Proceedings of the 2024 IEEE International Conference on Blockchain (Blockchain), Copenhagen, Denmark.","DOI":"10.1109\/Blockchain62396.2024.00026"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"14965","DOI":"10.1109\/JIOT.2023.3263909","article-title":"A survey on digital twins: Architecture, enabling technologies, security and privacy, and future prospects","volume":"10","author":"Wang","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ren, C., Xu, J., Chen, C., Zhu, S., Ma, Y., and Guan, X. (IEEE Trans. Autom. Sci. Eng., 2025). Digital Twin Enabled Flight Control System Testing: Design, Development and Implementation, IEEE Trans. Autom. Sci. Eng., early access.","DOI":"10.1109\/TASE.2025.3532632"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"7956","DOI":"10.1007\/s11227-020-03594-3","article-title":"A comprehensive and holistic knowledge model for cloud privacy protection","volume":"77","author":"Akremi","year":"2021","journal-title":"J. Supercomput."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Almusayli, A., Zia, T., and Qazi, E.u.H. (2024). Drone Forensics: An Innovative Approach to the Forensic Investigation of Drone Accidents Based on Digital Twin Technology. Technologies, 12.","DOI":"10.3390\/technologies12010011"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"669","DOI":"10.1109\/TII.2019.2938885","article-title":"A digital twin based industrial automation and control system security architecture","volume":"16","author":"Gehrmann","year":"2019","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Lo, C., Win, T.Y., Rezaeifar, Z., Khan, Z., and Legg, P. (2024, January 28\u201330). Digital Twins of Cyber Physical Systems in Smart Manufacturing for Threat Simulation and Detection with Deep Learning for Time Series Classification. Proceedings of the 2024 29th International Conference on Automation and Computing (ICAC), Sunderland, UK.","DOI":"10.1109\/ICAC61394.2024.10718749"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Pisani, J., Cavone, G., Pascucci, F., and Giarr\u00e9, L. (2023, January 6\u20138). Using Digital Twin to Detect Cyber-Attacks in Industrial Control Systems. Proceedings of the IEEE EUROCON 2023-20th International Conference on Smart Technologies, Torino, Italy.","DOI":"10.1109\/EUROCON56442.2023.10198927"},{"key":"ref_14","unstructured":"Leao, B.P., Vempati, J., Bhela, S., Ahlgrim, T., and Arnold, D. (2023). Augmented Digital Twin for Identification of Most Critical Cyberattacks in Industrial Systems. arXiv."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Lucchese, M., Salerno, G., and Pugliese, A. (2024). A Digital Twin-Based Approach for Detecting Cyber\u2013Physical Attacks in ICS Using Knowledge Discovery. Appl. Sci., 14.","DOI":"10.3390\/app14198665"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"346","DOI":"10.1016\/j.jmsy.2020.06.017","article-title":"Review of digital twin about concepts, technologies, and industrial applications","volume":"58","author":"Liu","year":"2021","journal-title":"J. Manuf. Syst."},{"key":"ref_17","unstructured":"Palmer, G. (2001, January 7\u20138). A road map for digital forensic research. Proceedings of the First Digital Forensic Research Workshop, Utica, NY, USA."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"17","DOI":"10.4018\/IJWSR.2020010102","article-title":"Applying digital forensics to service oriented architecture","volume":"17","author":"Akremi","year":"2020","journal-title":"Int. J. Web Serv. Res. (IJWSR)"},{"key":"ref_19","first-page":"522","article-title":"Trust in digital records: An increasingly cloudy legal area","volume":"28","author":"Duranti","year":"2012","journal-title":"Comput. Law Secur. Rev."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Grobler, C., Louwrens, C., and von Solms, S.H. (2010, January 15\u201318). A framework to guide the implementation of proactive digital forensics in organisations. Proceedings of the 2010 International Conference on Availability, Reliability and Security, Krakow, Poland.","DOI":"10.1109\/ARES.2010.62"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Bitton, R., Gluck, T., Stan, O., Inokuchi, M., Ohta, Y., Yamada, Y., Yagyu, T., Elovici, Y., and Shabtai, A. (2018, January 3\u20137). Deriving a cost-effective digital twin of an ICS to facilitate security evaluation. Proceedings of the Computer Security: 23rd European Symposium on Research in Computer Security, ESORICS 2018, Barcelona, Spain. Proceedings, Part I 23.","DOI":"10.1007\/978-3-319-99073-6_26"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"26358","DOI":"10.1109\/ACCESS.2023.3257171","article-title":"Security analysis of a digital twin framework using probabilistic model checking","volume":"11","author":"Shaikh","year":"2023","journal-title":"IEEE Access"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"34312","DOI":"10.1109\/JIOT.2024.3421895","article-title":"Securing distributed network digital twin systems against model poisoning attacks","volume":"11","author":"Zhang","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Eckhart, M., and Ekelhart, A. (2018, January 15\u201319). A specification-based state replication approach for digital twins. Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and Privacy, Toronto, Canada.","DOI":"10.1145\/3264888.3264892"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"701","DOI":"10.1016\/j.future.2024.07.017","article-title":"Digital twin and federated learning enabled cyberthreat detection system for IoT networks","volume":"161","author":"Salim","year":"2024","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Xu, Q., Ali, S., and Yue, T. (2024, January 27\u201331). Digital twin-based anomaly detection in cyber-physical systems. Proceedings of the 2021 14th IEEE Conference on Software Testing, Verification and Validation (ICST), Toronto, ON, Canada.","DOI":"10.1109\/ICST49551.2021.00031"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Eckhart, M., and Ekelhart, A. (2019). Digital twins for cyber-physical systems security: State of the art and outlook. Security and Quality in Cyber-Physical Systems Engineering: With Forewords by Robert M. Lee and Tom Gilb, Springer.","DOI":"10.1007\/978-3-030-25312-7_14"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"S102","DOI":"10.1016\/j.diin.2015.01.014","article-title":"Leveraging CybOX\u2122 to standardize representation and exchange of digital forensic information","volume":"12","author":"Casey","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.diin.2017.08.002","article-title":"Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language","volume":"22","author":"Casey","year":"2017","journal-title":"Digit. Investig."},{"key":"ref_30","unstructured":"Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and The Internet, Academic Press."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"e841","DOI":"10.7717\/peerj-cs.841","article-title":"A forensic-driven data model for automatic vehicles events analysis","volume":"8","author":"Akremi","year":"2022","journal-title":"PeerJ Comput. Sci."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"68","DOI":"10.1007\/s12083-024-01890-w","article-title":"A privacy preserving batch audit scheme for IoT based cloud data storage","volume":"18","author":"Ganesh","year":"2025","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"ref_33","unstructured":"Akremi, A. (December, January 29). An adaptative and compliant forensics admissibility metrics generation methodology. Proceedings of the 23rd International Conference on Information Integration and Web Intelligence, Linz, Austria."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/4\/115\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:58:28Z","timestamp":1760029108000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/4\/115"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,22]]},"references-count":33,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,4]]}},"alternative-id":["computers14040115"],"URL":"https:\/\/doi.org\/10.3390\/computers14040115","relation":{},"ISSN":["2073-431X"],"issn-type":[{"type":"electronic","value":"2073-431X"}],"subject":[],"published":{"date-parts":[[2025,3,22]]}}}