With the rise of attacks against critical infrastructure, SCADA environments, and industrial control systems, security practitioners must leverage digital forensics in increasingly complex ways. By collecting, aggregating, and analyzing forensics data, breaches and attacks are able to be discovered and remediated. However, there exists a significant gap in the complexity, generality, and versatility of forensics tools, techniques, and methodologies for SCADA environments compared to the realm of IT-based forensics.