Evaluating forensic log readiness in simulated 6G networks

The forensic readiness of future 6G networks will depend not only on advanced detection systems but also on maintaining the integrity, availability, and timeliness of the system and event logs. In high-speed, ultra-low-latency environments, the risk of delayed or compromised logs is an issue for incident response and post-incident forensic analysis. This paper evaluates local and remote log collection mechanisms in a simulated 6G network environment. Benign (low intensity) and adversarial (high intensity) traffic was generated to measure log collection performance in a Cisco router and a centralised Linux server. The results show that while log completeness is maintained in both cases, recording local logs on the router can exhibit delays up to 50s (peak delay) under high-intensity traffic, whereas remote logs are unaffected. These findings highlight the trade-off between speed and forensic reliability in high-throughput environments and show the importance of log adaptability to improve forensic readiness in the face of next-generation communication systems.