  Industrial Control Systems (ICS) are used worldwide in critical
infrastructures. An ICS system can be a single embedded system working
stand-alone for controlling a simple process or ICS can also be a very complex
Distributed Control System (DCS) connected to Supervisory Control And Data
Acquisition (SCADA) system(s) in a nuclear power plant. Although ICS are widely
used to-day, there are very little research on the forensic acquisition and
analyze ICS artefacts. In this paper we present a case study of forensics in
ICS where we de-scribe a method of safeguarding important volatile artefacts
from an embedded industrial control system and several other sources
