With the increasing advent of smart buildings and smart cities, the use of Operational Technology (OT) and Industrial control systems (ICSs) has been rising. Recent trends of cyber attacks on OT demand more attention for forensic and security analysis of such environments. As such in this paper, we examine a widely used PLC, the Beckhoff CX9020 PLC from a digital forensic perspective. First, we configure the PLC to log as much activity as possible using the available options. Next, we test a set of basic cyber attacks on the PLC. Finally, we devise forensic acquisition and analysis of the system.