A modular forensic-ready logging framework for medical device systems (FRLF)

Medical device software systems rely heavily on logging to support monitoring, debugging, regulatory activities, and post-incident investigation. However, existing logging practices often lack the structure, context, traceability, and integrity required for reliable forensic reconstruction. While forensic readiness frameworks emphasise evidence availability and preservation, they provide limited guidance on what constitutes a forensic-ready log or how such logging should be implemented as a software design feature. This research proposes the Forensic-Ready Logging Framework (FRLF), a technology-agnostic approach that formalises forensic-ready logging as explicit design input requirements covering specificity, traceability, integrity, ordering, interoperability, integrity mechanism selection, availability and retention, and privacy. These requirements are realised through a standardised log event schema and modular processing architecture. The framework is evaluated at proof-of-concept level across simulated heterogeneous medical device system components representing both full-feature and resource-constrained environments. Unit-level verification, integration testing, and scenario-based evaluation demonstrate the feasibility of implementing the defined forensic properties and producing consistent, verifiable, correlated, and interpretable records across these components. The FRLF demonstrates how forensic-ready logging can be treated as an explicit and verifiable software design feature rather than an operational by-product, providing a structured approach for integrating forensic readiness into medical device software development.