Collect Evidence For LLM Incident Investigation