That’s what telemetry services are for. If you have all the logs and metrics from the host, then you can research and construct the story from those. You don’t necessarily need the host to be alive anymore.