Positive train control (PTC) or communication-based control systems (CBTC) control trains using wireless network infrastructures. Consequently, investigations of accidents involving PTC-or CBTC-controlled trains require network forensic analysis. This paper describes a forensic analysis framework that leverages the communications capabilities of PTC systems. The framework incorporates a centralized database architecture that securely stores PTC-related and other digital data, and provides for efficient and flexible querying of the data during accident analysis.