Answer
Different systems may contain different timestamps, telemetry, warnings or user actions. Preserving both can help reconstruct the event and resolve inconsistencies.
Explanation
Redundant data sources strengthen an investigation when handled carefully.