For internal SOC teams and DFIR consultants alike, collecting triage data from an infected system is often one of the few things they do when an incident comes in.