Besides his forensic responsibilities he is involved in security related research activities and Siemens internal consulting. While the forensic analysis of security breaches in office networks is a well documented and developed field, investigation of security incidents in industrial control systems and other industrial products currently encounters various obstacles. There is a lack of documentation, of tools and of basic procedures for working in these environments. This talk adresses the various challenges posed by industrial systems and presents a framework and toolset for the forensic investigator when the call comes: "Help, my turbine got hacked!"