If you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can

If you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack. Without the time stamp and IP information you have zero chance at attribution during a security event. PCI and a bunch of other regs require log retention for 1 year or even more for this reason.