'Best' is often a long set of trade offs between requirements, staffing levels, and development intervals.
Service Observing (SO), Single Step Conference (SSC) and Multiple Registrations per Device (MR) are the three predominate application enablement services recording strategies, with session border controller based SIPREC growing in popularity.
You are using the term forwarded differently than the industry norm. What you appear to be talking about is transferring a call. A forwarded call occurs while it is being routed to a destination... i.e. party B forwards all calls to party C. Subsequently, if A calls B the call actually rings at C, and is answerable there. Often B only receives a short burst of alerting to indicate that a call was forwarded (to remind them that the feature is enabled).
Service Observing, as you have found, adds the recorder (observing party) to calls which are active at the observed station. That should get you a recording of customer to agent conversation, up to the point that the agent holds to then call the second agent,. At that point the SO party is released. While the Agent dials the call to Agent 2 and listens to ringback, the SO party does not receive media. Once the second agent answers, the recording would again start (IIRP) due to the SO party being added into the call. When Agent 1 transfers to Agent 2 the recording would stop because Agent 1 is no longer in a call, and the SO party is observing calls at Agent 1. A SO on Agent 2 would generate yet a third recording that covered the Agent 1 to Agent 2 discussion, along with the Agent 2 to customer discussion.
The application could merge these three recordings into a unified view by making use of Universal Call Identifier (UCID) information. Care must be taken to properly track UCID through conference/transfer scenarios within the application. See this writeup on that topic:
https://www.devconnectprogram.com/fileMedia/download/2f97cad6-c21f-4a56-98ab-1627e604bcb0
For continous recording of a call as it passed from one agent to another, SSC is viewed as a better strategy since once the recorder is added to teh call it remains in the call till it is dropped explicitly or the call ends. One downside of SSC recording is due to the nature of the recorder being added by the recording application, it can join the call late and the beginning of the call be missed. SSC also requires an extra TSAPI license per recorder as compared to other strategies.
Applications, (including those using SSC) are best to have a pool of recorders that are always registered. Trying to do device registration of the recorder 'on the fly' causes even more delay and in extreme situations the call can be over before the recorder can be added into the call - in short it is not recommended approach to register devices multiple times over the application's lifespan (once a day is tolerable - once per call is not).
Multiple Registrations per Device, like service observing, tracks calls at an extension and does not follow a call once it is transferred.
Since SIPREC occurs as the call transitions the Session Border Controller, it will track a call as it is transferred - Additional applcation monitors/logic is necessary to track the transfer using one of the CTI protocols (TSAPI, JTAPI or DMCC Call Control service); It is not possible to record the agent to agent 'consult' period before the transfer is completed with SIPREC unless the agents are SIP Remote Workers.
This document covers some of the tradeoffs in the various call recording approaches that utilize Applications Enablement Services. Unfortunately it has not been updated to cover 'Custom Media Streams' nor SIPREC.
https://www.devconnectprogram.com/fileMedia/download/7eeb6799-15a6-4701-ae96-57d819b482eb
There are a number of FAQs covering call recording topics on the DevConnect portal: I point you to one that may be of interest to you.
https://www.devconnectprogram.com/site/global/products_resources/avaya_aura_application_enablement_services/support/faq/dmcc/index.gsp?tab=register&accordion=faq-15
