Most incident reports miss root causes. Our forensic approach, adapted from fire investigation, reveals: