What forensics workflow helps returned field devices?

For returned devices, capture flash logs, last OTA result, bond count, power history, and crash counters before reflashing or wiping. Compare them with cloud telemetry for the same serial. A one-page forensics report for each gateway or sensor helps hardware and software teams split root cause without losing evidence.