  Crash fault tolerant (CFT) consensus algorithms are commonly used in
scenarios where system components are trusted -- e.g., enterprise settings and
government infrastructure. However, CFT consensus can be broken by even a
single corrupt node. A desirable property in the face of such potential
Byzantine faults is \emph{accountability}: if a corrupt node breaks protocol
and affects consensus safety, it should be possible to identify the culpable
components with cryptographic integrity from the node states. Today, the
best-known protocol for providing accountability to CFT protocols is called
PeerReview; it essentially records a signed transcript of all messages sent
during the CFT protocol. Because PeerReview is agnostic to the underlying CFT
protocol, it incurs high communication and storage overhead. We propose
CFT-Forensics, an accountability framework for CFT protocols. We show that for
a special family of \emph{forensics-compliant} CFT protocols (which includes
widely-used CFT protocols like Raft and multi-Paxos), CFT-Forensics gives
provable accountability guarantees. Under realistic deployment settings, we
show theoretically that CFT-Forensics operates at a fraction of the cost of
PeerReview. We subsequently instantiate CFT-Forensics for Raft, and implement
Raft-Forensics as an extension to the popular nuRaft library. In extensive
experiments, we demonstrate that Raft-Forensics adds low overhead to vanilla
Raft. With 256 byte messages, Raft-Forensics achieves a peak throughput 87.8\%
of vanilla Raft at 46\% higher latency ($+44$ ms). We finally integrate
Raft-Forensics into the open-source central bank digital currency OpenCBDC, and
show that in wide-area network experiments, Raft-Forensics achieves 97.8\% of
the throughput of Raft, with 14.5\% higher latency ($+326$ ms).
