There is a perception that control systems, including field devices, have cyber forensic capabilities similar to those of IT systems. That perception is wrong. A control system generally has a Microsoft front-end human-machine interface (HMI) that should have adequate cyber forensics.
Look. I don't want to diminish the importance or complexity of securing our critical infrastructure from Evil Doers, Bad Actors, Wingnuts, Doofuses and Well-Intentioned Idiots. It's an important job that has to be done much better than we've done it so far.