This session will examine the workings of Codesys V3 SDK, focusing on different ICS devices and vendors that commonly utilize the Codesys framework, the methods to gather all artifacts for a comprehensive forensics analysis, and how to use them to build an open-source tool. The research of Codesys led to the discovery of 31 zero days, affecting millions of Codesys-enabled devices around the world.