Agent forensics in five minutes: what it did, and proof the log wasn't edited

An agent incident ends one of two ways. Without an audit trail, you guess: what it did, when, with...