Often, the data collected by an IDS aids in tracing the source of the attack, which may prove helpful in identifying the attacker. IDS logs, for instance, could provide forensic evidence if legal action is taken against an attacker. So, even if an IDS does not detect an attack early enough to help prevent it, it may be of considerable value.