Respond / Incident Analysis
Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.
The family keeps a record of what steps they took when investigating a problem, like writing down what they checked when the power went out.