Comment by woodruffw

That’s why I’m talking about it purely in the context of incident response/forensics.