The global trend is to go digital, in other words go 'smart'. Like the rest of the world getting smarter, so is the power sector hence the term smart power grids and substations. Such capability comes at a price, in this case increasing risk of potential cyber threats to substations. With all such potential risks, it is important that we are able to trace back and attribute any potential threats to its root. In this paper, we're exploring substations to find potential evidences in case a forensic investigation becomes a necessity. Moreover, a forensic experimental test bed is proposed for digital forensic analysis. Finally, a mapping of attack-based forensic evidences is presented.