Orbital Forensics: An Investigation into Forensics in a Simulated Space Environment

Space systems, a central part of today’s telecommunications ecosystem, are facing escalating cyber threats. However, there is no established methodology for conducting digital forensics on spacecraft, as they are often unique systems running real-time flight software and operating systems with limited resources.

This study measures the real-time scheduling impact of collecting common Linux forensic artifacts on a virtual satellite flight software environment running in a real-time kernel. The target system runs NASA's Core Flight System (cFS) on a PREEMPT_RT Linux kernel, and the dependent variable is scheduling latency as recorded by cyclictest. The experimental environment uses two virtual machines: a ground station running SIFT Workstation (SANS Institute, n.d.) with COSMOS command and telemetry software (Melton, 2016), and a satellite target running a PREEMPT_RT Linux kernel with NASA's cFS.

Forensic collection techniques are organized into four tiers of increasing resource impact, ranging from volatile data collection to full disk and memory acquisition. They are tested under both idle and simulated payload-workload conditions. Scheduling latency is measured using cyclictest as a proxy for cFS real-time thread timing. Results demonstrate that Tiers 1 through 3, which collect volatile data, configuration, persistence, and log artifacts, produced no operationally significant degradation in real-time scheduling performance, adding only 10-25 microseconds to average scheduling latency. These Tiers are likely mission-safe and unlikely to affect overall latency. Tier 4, including disk and memory acquisition, posed a mission risk to resource-limited real-time systems.

This study represents the first systematic empirical measurement of the impact of forensic collection techniques on cFS real-time scheduling, providing evidence-based guidance for incident responders operating on systems where mission survival is essential.