This presentation is concerned about the investigation of ATM incidents from past to present years, the tools that were created for it and the possibility of developing a new generation of software systems to be used for investigation.