The first rule of any security incident is to record everything.