@SecureOwl Yeah, so we have to be a lot more gentle with industrial devices and process networks because the real life consequences of altering or modifying them can be life, safety, and damage. We don't want to cause worse consequences than the adversaries doing DFIR. So that means we have to be way more light touch and passive in our investigations - and often times we cannot even install things on machines without risking them or voiding a warranty.

The second thing that''s wildly different is the technologies. There's no XDR/EDR or agent-based forensics in most of these networks. It would cause those problems that I talked about. There's a ton of legacy devices, sometimes back to Windows 3.1 that are still doing critical functions. So a lot of gentle, legacy forensics, manually and by hand, system by system. Very different from most modern IR.

Finally, as @MisuseCase points out, we also have to be able to do forensics on niche documented/undocumented legacy network protocols and their process impact, as well as low-level devices (not usually level 0) that don't run Linux or Windows, like PLCs and RTUs.