Abstract

Due to increasing reliance on information and communication technology (ICT), the global shipping industry which plays a pivotal role in international trade is growing more vulnerable to sophisticated cyber risks. GPS spoofing, onboard system hacking, and shipping company ransomware attacks are just a few of the many cyber incidents that put maritime operations at risk. More often than not, the industry lacks comprehensive and effective policies for incident investigation and response, integrating standardized frameworks suitable for maritime operations. This study focuses on global shipping operations, investigating the possible application of computer forensic methodologies as an organized framework for cyber incident investigation. Traditionally the realm of corporate and law enforcement sectors, computer forensics encompasses the identification, preservation, analysis, and presentation of digital evidence. Adapted for maritime settings, computer forensics provides immense aid in the investigation of cyberattacks, system compromise analysis, and post-attack evidence preservation for legal proceedings. The proposed framework incorporates computer forensic methods while taking into account the specifics of operational and IT/OT system integration in shipping, evidence collection challenges in high seas, and the need to control and account for those International Domain custody. The methodology consists of incident analysis: detection, digital evidence acquisition, forensic analysis, and structured reporting. Utilizing contemporary cyber incidents at sea and consulting with industry experts, the study illustrates how incorporating computer forensics into maritime cybersecurity frameworks can improve responsiveness, responsibility, and deterrence. These results suggest that the shipping industry must begin to consider forensics as part of their strategic planning in order to defend against increasingly sophisticated cyber-attacks.