The quick digitalisation of the key infrastructure and industry control systems has contributed to a high level of operational efficiency, automation, and connectivity. Nevertheless, it is this technological reliance that has also led to an increase in the cyber threat environment, especially when it comes to systems that handle critical services like power, industrial production, defence, and water cleanup. These environments are the most sensitive of them all; one being the air-gapped systems, which are based on physical isolation in protecting critical missions. Although they believe that their infrastructure is safe, real-life experience has shown that even air-gapped infrastructure can fall prey to advanced cyberattacks. The given paper is a detailed analysis of hacking methodology and the specifics of infrastructure hacking in air-gapped systems. It categorically examines the nature of hacking in terms of intent and legality, such as ethical hacking, malicious hacking, hacktivism, cyber espionage, insider threats and supply chain attacks. The paper also discusses the special attack vectors used against air-gapped systems, including infected removable media, breached maintenance systems, insider activities, and supply chain weaknesses. One of the key contributions of this paper is the fact that it provides an in-depth examination of how the forensic investigation process is conducted in air-gapped infrastructure attacks. It identifies the problems of the limited logging, the constraints of the operation, and the safety-critical environment, and the significance of the multidisciplinary approach to forensics. Digital forensics, malware and memory analysis, industrial control system forensics, firmware and hardware analysis and correlation of cyber-physical systems are comprehensively discussed. The paper shows limitations of physical isolation and the importance of forensic intelligence in protecting infrastructure by discussing real-world cases like Stuxnet, German steel mills attack and the intrusion of the Ukrainian power grid. The results support the need to prepare forensically, adopt an integrated approach to security, and maintain a continuous risk evaluation to protect air-gapped critical infrastructure against the changing cyber threats.

 KEY WORDS:

Air-Gapped Systems, Infrastructure Hacking, Cyber Forensics, Industrial Control Systems (ICS), Critical Infrastructure Security.