Forensic Investigations; Forensic Evidence Substation; Wide Area Monitoring Protection and Control; PMUs etc. Abstract The global trend is to go digital, in other words, go 'smart'. Like the rest of the world, power sector is also getting smarter hence the term smart power grids and substations. Such capability comes at the price of heightened risk of potential cyber threats to substations. With all such potential risks, we must be able to trace back and attribute any potential threats to its root. In this paper, we're exploring substations to find potential evidence in case a forensic investigation becomes a necessity. Moreover, a forensic experimental testbed is proposed for digital forensic analysis. Finally, a mapping of attack-based forensic evidence is presented.