mainly for ad-hoc situations, gotten a report of a potentially compromised system. The system has no other tooling (for a variety of reasons) and so I need to be able to quickly and easily collect data consistently so I can start the IR process and identify scope, current system state, issues, etc