Those in DFIR what are some of the things you wish the client had when responding?

I’ll go first - I wish the client had some sort of centralized logging. Without it, it made responding much more difficult. Literally follow the breadcrumbs.

What about you?

breadcrumbs client cybersecurity dfir logging sort things