A sequence is easier to assess
Review related observations in order instead of relying on disconnected log rows. The available record sets the limits of what can be replayed.
Evidence remains evidence
Replay does not invent missing activity or convert a correlation into proof of compromise. Keep uncertainty visible when reviewing a situation.