Digital forensics in industrial safety: Tracking physical-cyber failures in Iranian power plant maintenance operations

The integration of cyber-physical systems in Iranian power plants has introduced hybrid failures that blend cybersecurity breaches with physical safety incidents, yet these remain poorly understood due to the absence of systematic forensic analysis. This study develops and tests a digital forensics framework to track physical-cyber failures in maintenance operations, addressing their impact on industrial safety and operational efficiency. Using a case study approach at the Isfahan Power Plant, three incidents (2021 turbine failure, 2022 cooling system disruption, 2023 generator anomaly) were analyzed through log reviews, network traffic analysis, and stakeholder interviews. Findings reveal that digital forensics can effectively trace cyber triggers such as unauthorized access or malware to physical outcomes, like equipment malfunctions, offering a novel tool for safety management. However, implementation faces barriers, including limited training, resource constraints under sanctions, and organizational resistance, reflecting Iran’s unique industrial context. These failures impose significant costs, estimated at $200-300 million annually, alongside heightened safety risks and operational downtime. The validated framework, tested in a 2025 pilot, reduced unresolved incidents by 25%, demonstrating its potential to enhance resilience. This research bridges industrial management and digital forensics, providing a localized model for Iran while contributing to global discourse on cyber-physical safety. Future work should scale this approach across facilities and address technological limitations. By illuminating the hidden cyber dimensions of safety incidents, this study underscores the urgency of forensic integration in critical infrastructure protection.