Why ECS Actually Matters for DFIR