A Survey on Trustworthy and Automated Digital Forensics: Hardware-Assisted Integrity, Domain-Specific Languages, and ATT&CK-Mapped Analysis

Investigations today stretch across mixed endpoints, connected devices, compiled programs and hardware whose trustworthiness is often unclear, yet whatever is gathered from them must still stand up from the moment of acquisition to the moment of presentation. In practice, forensic workflows are usually stitched together from separate tools, platform-specific procedures and records kept by hand. This survey examines six recent studies (2025–2026) on hardware-security assessment, hardware Trojan detection, cryptographic hardware, third-party device trust, binary-code analysis and resource-aware password-recovery computation, together with 41 works drawn from their bibliographies. The studies are compared by problem, method, reported outcome and limitation, and the discussion is built around four themes: trustworthy hardware and supply-chain assurance, cryptographic support and roots of trust, behavioural and binary analysis, and automation through domain-specific languages (DSLs) with cross-platform execution. A gap recurs across the material. The techniques for individual layers are strong, but none of the studies shows one workflow that joins investigator-authenticated acquisition, interpretation and a tamper-evident evidence history. We therefore derive a six-layer reference architecture: a constrained, investigator-oriented DSL; a compiler that yields reviewable execution plans; lightweight endpoint agents; central correlation with ATT&CK-aligned interpretation; hash-chained provenance; and hardware-assisted investigator authentication. Block diagrams, a trust-boundary analysis, a threat model and an evaluation framework accompany it. The architecture is a design proposal, and no performance results are claimed.