I find it resembles the techniques we find ourselves doing in software engineering. Given good practice clear logs of events for traceability. As in a mass ou

I find it resembles the techniques we find ourselves doing in software engineering. Given good practice clear logs of events for traceability. As in a mass outage which everyone sees, which can be tracked backwards for root cause analysis and well as interviews with anyone connected to systems or vicinity at the time of event. As in cases of anyone possibly interacting with a production server, there may be interviews with those who may have "logged in" or accessed to such systems to help find a root cause.