Incident Response, Threat Intelligence and Forensic Analytics

Introduction

Cyber incidents are rarely solved by a single artefact, tool or analyst. A reliable investigation combines incident response, digital forensics, threat intelligence and analytical reasoning. Incident response seeks to control and recover from a harmful event. Digital forensics preserves and interprets evidence. Threat intelligence provides knowledge about adversaries, campaigns, infrastructure and behaviours. Forensic analytics transforms large collections of observations into timelines, relationships, hypotheses and defensible conclusions.

The central professional challenge is to act quickly without destroying evidence, and to make decisions under uncertainty without overstating what the evidence proves. A response team may need to isolate a host before the full investigation is complete, while investigators must preserve volatile data and maintain chain of custody. Threat intelligence may suggest that an indicator is associated with a known group, but an indicator alone rarely proves attribution. These tensions require structured methods, explicit assumptions and carefully documented confidence.

This chapter presents an integrated approach suitable for security operations centres, digital forensic laboratories, incident response teams, internal audit functions and regulated organisations. It follows the broad principles of recognised guidance such as NIST incident-response practice, ISO/IEC 27035 incident management and ISO/IEC 27037 principles for identification, collection, acquisition and preservation of digital evidence. These standards should be consulted in their current editions and adapted to applicable law, organisational policy and sector regulation.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain how incident response, digital forensics and threat intelligence support one another.
2. Construct a defensible event timeline from heterogeneous evidence sources.
3. Correlate indicators, behaviours and entities while controlling false positives.
4. Form, test and revise investigative hypotheses.
5. Communicate investigative confidence and uncertainty appropriately.
6. Use forensic findings to support containment, eradication, recovery and lessons learned.
7. Evaluate legal, ethical, privacy and governance constraints during an investigation.

1. The Integrated Investigation Problem

An incident is a suspected or confirmed event that threatens the confidentiality, integrity or availability of information or systems. A security alert is an observation generated by a control, such as an endpoint detection, authentication alert or unusual network flow. An incident is established only after assessment of context, significance and credibility.

The four disciplines have different immediate purposes:

The disciplines operate as a feedback loop. An alert initiates triage; triage identifies evidence and intelligence requirements; forensic analysis produces facts and new indicators; intelligence enriches those indicators; and the resulting assessment informs containment and recovery. The loop is iterative rather than strictly linear.

A useful distinction is between facts, inferences and assumptions. A fact is directly supported by an observable source—for example, an authentication log records a successful login. An inference is a reasoned interpretation—for example, the login may represent account compromise. An assumption is a proposition temporarily accepted to enable analysis—for example, that a system clock was accurate before a known time synchronisation event. Reports should label these categories clearly.

2. Incident-Response Lifecycle and Forensic Decision Points

A practical lifecycle includes preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Organisations may name or group these phases differently, but the decision logic is similar.

Preparation

Preparation includes policies, playbooks, contact lists, logging standards, forensic tooling, evidence storage, legal authorities, backup testing, exercises and staff training. It also includes pre-approval for urgent actions such as isolating an endpoint or disabling a compromised account. Without preparation, responders lose time debating authority and evidence-handling procedures during a crisis.

Detection and analysis

Triage determines whether an alert is benign, suspicious or a confirmed incident. Analysts establish scope, affected assets, likely impact and immediate risks. Forensic acquisition should be proportionate to the question. A full disk image may be justified for a suspected compromise of a critical server, whereas a targeted collection may be sufficient for a low-impact endpoint if policy and legal requirements permit.

Containment

Containment limits further damage. Short-term containment might isolate a host, block a domain or revoke a token. Long-term containment may involve a clean replacement, segmentation or temporary access restrictions. Containment decisions should consider the risk of destroying volatile evidence, alerting an adversary, interrupting business operations and spreading malware through automatic recovery mechanisms.

Eradication and recovery

Eradication removes the cause and persistence mechanisms, such as malicious accounts, scheduled tasks, unauthorised keys or vulnerable software. Recovery restores systems from trusted sources, validates security controls and monitors for recurrence. A system should not be declared recovered merely because it is operational; its integrity and security posture must also be tested.

Lessons learned

Post-incident review examines both technical causes and organisational conditions. Useful questions include: Which control detected the activity? Which evidence was unavailable? Were decisions delayed by unclear authority? Did backups and logging function as expected? Which corrective actions have an owner, deadline and verification method?

3. Evidence Preservation During Response

Forensic value depends on authenticity, integrity, relevance and adequate documentation. Evidence handling should establish who collected an item, when and where it was collected, how it was acquired, what transformations occurred and where it was stored.

A typical order of volatility is not absolute, but it is often useful to consider CPU state and active connections, memory, temporary operating-system data, active files, less volatile storage and remote or archival records. The correct order depends on the investigative question. Capturing memory from a live system may reveal injected code or encryption keys, but it changes the system and may interrupt an attacker. The decision and its consequences should be recorded.

Cryptographic hashes help verify that a file or image has not changed since acquisition. For a cryptographic hash function H and evidence object E, integrity verification compares:

This equality supports the claim that the two byte sequences are identical, subject to the security properties and implementation of the chosen hash function. A matching hash does not prove that the evidence is truthful, complete or lawfully obtained; it supports integrity of the compared object. Strong modern hash functions should be selected according to current organisational and legal guidance.

Chain-of-custody records should include an evidence identifier, description, collector, date and time with time zone, acquisition method, storage location, hash values, transfers and access history. Access should be restricted, logged and appropriate to the sensitivity of the material.

4. Constructing Defensible Event Timelines

A timeline is an ordered representation of events from multiple sources. It helps investigators understand sequence, identify gaps, test claims and distinguish initial access, execution, persistence, lateral movement, collection and exfiltration. It is not simply a list sorted by a timestamp.

Sources and timestamp semantics

Common sources include endpoint event logs, authentication records, firewall and proxy logs, DNS, cloud audit trails, email systems, application databases, file metadata, memory captures and threat-intelligence feeds. Each source has different timestamp semantics. A log may record event creation time, receipt time, processing time or display time. File metadata may reflect copying or extraction rather than original creation. Analysts must record the source field and interpretation.

Time zones, daylight-saving changes, clock drift, delayed ingestion and replayed logs can produce apparent contradictions. Normalisation should preserve the original timestamp while adding a standard representation, commonly Coordinated Universal Time (UTC). If local time is t_local and the applicable offset from UTC is Δ, then:

Here, Δ is positive for a local time ahead of UTC and negative for a local time behind UTC. The equation is applicable only when the correct offset, including historical daylight-saving rules, is known. Analysts should not apply a single offset blindly across a long investigation.

A timeline record should ideally contain:

A useful distinction is between precision and accuracy. A timestamp with milliseconds may be precise in format but inaccurate because a host clock was wrong. An event may therefore be represented as an interval rather than an exact point. If an action occurred after event A and before event B, its time can be recorded as t_A < t_event < t_B, without pretending to know a more exact value.

Timeline example

Suppose a cloud audit record shows a successful login at 09:12 UTC, an endpoint records PowerShell execution at 09:16 UTC, a proxy records transfer to an external service at 09:23 UTC, and a memory capture at 09:30 UTC shows an active remote session. These observations support a sequence, but do not by themselves prove that the login, PowerShell process and transfer were performed by the same actor. That linkage requires correlation of account, host, process, destination, authentication context and other evidence.

5. Threat Intelligence and Indicator Correlation

Threat intelligence is processed information that supports a decision. It may be strategic, operational, tactical or technical. Strategic intelligence addresses risks to organisational priorities. Operational intelligence describes campaigns and adversary activity. Tactical intelligence concerns behaviours and techniques. Technical intelligence includes indicators such as domains, hashes, IP addresses, certificates and email artefacts.

An indicator is an observable associated with activity, but its meaning depends on context. An IP address may be shared by many customers, a domain may be compromised, and a malware hash may change after recompilation. A match is therefore a lead, not automatically a conclusion.

The intelligence lifecycle commonly includes direction, collection, processing, analysis, dissemination and feedback. Direction defines the decision that intelligence must support. For example, “Should outbound access to this infrastructure be blocked?” is more useful than “Collect everything about this actor.”

Correlation dimensions

Analysts can correlate evidence across:

• Time: events occur within a plausible sequence or window.
• Identity: the same account, device, certificate or token is involved.
• Infrastructure: domains, IP addresses, autonomous systems, hosting and certificates overlap.
• Behaviour: commands, persistence methods or access patterns resemble one another.
• Content: files, email subjects, URLs or configuration values share meaningful features.
• Context: geography, business role, maintenance windows and known third-party activity fit the interpretation.

Correlation should account for base rates and alternative explanations. A common administrative tool has high legitimate use and weak evidential specificity. A rare combination of a service account login, unusual geographic source, new scheduled task and outbound transfer is more informative than any single observation.

Indicators of compromise and indicators of attack

An indicator of compromise is evidence that a system may already have been affected, such as a malicious file hash or persistence artefact. An indicator of attack describes suspicious behaviour that may occur before compromise is confirmed, such as repeated authentication failures followed by a successful login and privilege change. Behavioural indicators are often more resilient than static indicators, but they also require more contextual analysis.

Threat intelligence should include confidence, source, first-seen and last-seen times, expected lifetime, false-positive considerations and handling restrictions. Intelligence marked “do not distribute” must not be copied into unauthorised systems.

6. Hypothesis-Driven Forensic Analytics

Investigations become unreliable when analysts search only for evidence supporting an initial story. A hypothesis-driven method makes propositions explicit and tests them against competing explanations.

A hypothesis is a testable proposition, such as: “An external actor used a compromised finance account to access the payroll server and stage files for exfiltration.” Competing hypotheses might include legitimate administrative work, an insider action, an automated integration or a false alert caused by clock errors.

A disciplined workflow is:

1. Define the investigative question and decision it will support.
2. State one or more competing hypotheses.
3. Identify predictions that should be observable if each hypothesis is true.
4. Collect relevant evidence while preserving provenance.
5. Assess reliability, relevance and independence of each item.
6. Compare evidence with all plausible hypotheses.
7. Record contradictions, gaps and alternative explanations.
8. Revise the hypotheses and communicate confidence.

A Bayesian formulation can clarify reasoning, although exact probabilities are often difficult to justify in operational investigations. For hypothesis H and evidence E:

Here, P(H|E) is the posterior probability of the hypothesis after considering evidence, P(E|H) is the likelihood of observing the evidence if the hypothesis is true, P(H) is the prior probability, and P(E) is the overall probability of the evidence. The formula assumes that the probabilities are meaningfully defined and that the evidence model is appropriate. It should not be used to create false precision from subjective guesses.

A simpler operational approach is a confidence statement based on converging evidence. For example, “High confidence that the account was used from an unauthorised host; moderate confidence that the activity was performed by an external actor; low confidence regarding the actor’s identity.” Confidence should be attached to individual claims, not merely to the incident as a whole.

Diagnostic value and likelihood ratios

When evidence is reasonably modelled, its comparative diagnostic value can be represented by a likelihood ratio:

An LR greater than 1 means the evidence is more expected under H₁ than H₂; an LR less than 1 favours H₂. This measure is useful only when the probabilities are defensible and the evidence is not incorrectly treated as independent from other evidence. In practice, qualitative labels such as strongly supports, moderately supports, weakly supports, neutral, contradicts or unresolved are often more honest.

7. Quantitative Measures for Investigative Quality

Analytics can evaluate detection and investigative performance, but metrics must be interpreted in context.

For a classification system, precision and recall are defined as:

TP denotes true positives, FP false positives and FN false negatives. Precision is the proportion of alerts classified as positive that are truly positive. Recall is the proportion of all true positive cases that were detected. These equations assume that a defensible ground truth exists and that the classification population is defined. In incident response, ground truth may be incomplete, delayed or disputed, so metrics should not be treated as exact measures of reality.

For example, if an analytic produces 40 alerts, 30 of which are confirmed malicious, its precision is 30 ÷ 40 = 0.75, or 75%. If investigators know that 50 malicious events existed and the analytic identified 30, its recall is 30 ÷ 50 = 0.60, or 60%. The first calculation does not establish recall unless the total number of malicious events is known.

Other useful measures include mean time to detect, mean time to contain, time to acquire critical evidence, percentage of incidents with complete chain-of-custody records, and the proportion of corrective actions verified by their due dates. Metrics should encourage sound behaviour. An organisation that rewards rapid closure may create pressure to downgrade uncertain cases rather than investigate them properly.

8. Applying Findings to Containment, Recovery and Lessons Learned

Forensic analysis is valuable when it changes a decision. A finding that a token was stolen may lead to token revocation and identity-provider review. Discovery of a persistence mechanism may require eradication across a host group rather than cleaning one machine. Evidence of data staging may influence notification, legal assessment and the preservation of cloud storage logs.

Containment recommendations should identify:

• the action and its technical scope;
• the risk reduced;
• possible effects on evidence and business operations;
• the authority required;
• a rollback or review condition; and
• the evidence that must be collected before action.

Recovery validation should test the original attack path. If the incident involved a compromised privileged account, resetting the password alone is insufficient. Investigators should review multifactor authentication, session tokens, delegated permissions, service accounts, conditional-access policies and signs of re-entry.

Lessons learned should distinguish immediate remediation from systemic improvement. Immediate remediation may block a domain or patch a server. Systemic improvement may require centralised logging, improved asset inventory, stronger identity governance, better segmentation, revised supplier controls or changes to incident authority.

9. Legal, Ethical and Governance Considerations

Cyber investigations may involve personal data, employee communications, customer records, privileged legal material, health information or data stored in another jurisdiction. The investigative purpose must be defined, access must be authorised and collection should be proportionate. Applicable privacy, evidence, employment, interception, breach-notification and sector-specific laws vary by jurisdiction; legal counsel should be involved where required.

Important governance principles include:

• Lawful authority: confirm the organisation’s right to access systems and data.
• Purpose limitation: collect and use information for a defined investigative purpose.
• Minimisation: avoid unnecessary personal or unrelated data.
• Integrity and reproducibility: preserve originals and document analytical transformations.
• Confidentiality: restrict sensitive findings and intelligence according to classification.
• Disclosure discipline: distinguish confirmed facts from allegations and uncertain attribution.
• Fairness: avoid attributing misconduct to a person solely from an account or device association.

Artificial intelligence can assist with clustering, entity extraction, anomaly detection, malware classification and summarising large logs. It should not silently replace forensic judgement. Analysts must validate outputs, inspect representative data, assess bias and preserve the original evidence. Generative systems can invent plausible but unsupported explanations and may expose confidential evidence if used with an unauthorised service. AI-generated conclusions should therefore be treated as analytical suggestions requiring verification, not as evidence in themselves.

10. Illustrative Case: Compromise of a Finance Account

Background

This fictional case concerns Meridian Components, a manufacturing company. Its security team receives an alert for a successful login to a finance account from an unfamiliar location, followed by access to a payroll application and an unusual outbound transfer from a workstation.

Problem

Management must decide whether to disable the account and isolate the workstation immediately, while the investigation must determine whether the activity was legitimate travel, credential theft, insider misuse or an automated integration.

Analysis

The response lead defines four hypotheses:

• H₁: legitimate finance activity by an authorised employee;
• H₂: external use of stolen credentials;
• H₃: malicious insider activity;
• H₄: an automated system or time-synchronisation error produced a false interpretation.

The team preserves the cloud audit logs, identity-provider records, endpoint memory and proxy logs. The original timestamps are retained, and copies are hashed. The timeline shows:

The employee confirms being in the office and denies initiating the login. Badge records place the employee at the office, while the login source is geographically inconsistent. The workstation contains a malicious browser extension, and the destination domain has recently been associated with credential-theft infrastructure. However, the domain association is a lead rather than proof of ownership by a particular threat actor.

The team tests alternatives. The automated-integration hypothesis predicts a known service account, documented source address and recurring schedule; these are absent. The legitimate-activity hypothesis predicts a recognised device or approved travel record; neither is present. The insider hypothesis remains possible because the workstation was physically accessible, but endpoint and access records show no evidence that another employee used it during the relevant period.

Approach and solution

Before broad eradication, the team revokes active sessions, disables the finance account, isolates the workstation and blocks the destination at the proxy. It preserves the cloud audit trail and acquires relevant mailbox, browser and memory evidence. The identity team resets credentials, re-enrols multifactor authentication and reviews all privileged sessions. The payroll application owner checks whether records were changed and confirms that a set of records was queried but not altered.

The forensic report states with high confidence that the finance account was used from an unauthorised device, with moderate-to-high confidence that credentials or a session token were compromised, and low confidence regarding the external actor’s identity. It does not claim that a named threat group conducted the operation because the available infrastructure overlap is not sufficiently specific.

Outcome

No continuing access is found after revocation and isolation. The company notifies relevant internal stakeholders, completes a legal assessment and increases monitoring for related indicators. Lessons learned include enforcing phishing-resistant multifactor authentication for finance users, restricting browser extensions, improving cloud-log retention and creating a pre-approved procedure for emergency token revocation.

Learning points

The case demonstrates that containment and evidence preservation can occur together when actions are planned. It also shows why a timeline is not enough by itself: the meaning of each event depends on identity, source reliability, alternative hypotheses and corroboration. Finally, responsible reporting may reach a strong conclusion about account misuse while remaining cautious about attribution.

11. Challenges and Limitations

Modern investigations face encrypted traffic, ephemeral cloud infrastructure, short log-retention periods, container and serverless workloads, identity-based attacks, third-party dependencies and deliberate anti-forensic behaviour. Attackers may delete logs, manipulate timestamps, use legitimate tools and move through systems where the organisation has limited visibility.

Cloud investigations add questions about shared responsibility, provider access, tenant isolation, region and retention. Endpoint investigations may be complicated by full-disk encryption and rapid reimaging. Threat-intelligence feeds can contain duplicates, stale indicators and unverified attribution. Machine-learning detections may drift as user behaviour and infrastructure change.

No method eliminates uncertainty. The professional response is to document gaps, seek independent corroboration, preserve competing explanations and state what the evidence cannot establish. A technically sophisticated investigation can still fail if its collection was unauthorised, its conclusions are overstated or its records cannot be reproduced.

12. Best-Practice Checklist

1. Define the decision and investigative question before collecting indiscriminately.
2. Preserve volatile and high-value evidence before destructive containment where feasible.
3. Retain original timestamps and document normalisation assumptions.
4. Record provenance, hashes, access and transformations for evidence.
5. Separate facts, inferences and assumptions in working notes and reports.
6. Use threat intelligence as contextual evidence, not automatic attribution.
7. Develop competing hypotheses and actively seek disconfirming evidence.
8. Attach confidence to specific claims and explain important uncertainties.
9. Make containment recommendations explicit about scope, risk and authority.
10. Validate recovery against the original attack path.
11. Protect personal, privileged and classified information.
12. Convert lessons learned into owned, measurable and verified actions.

Chapter Summary

Integrated cyber investigation combines incident response, digital forensics, threat intelligence and forensic analytics. Incident response provides the operational decision framework; forensics supplies preserved and interpretable evidence; intelligence adds external and behavioural context; and analytics correlates observations into timelines and tested hypotheses.

Defensible timelines preserve original timestamps, explain time normalisation and distinguish exact points from intervals. Indicator correlation must consider time, identity, infrastructure, behaviour and context, while recognising that a match is not proof of compromise or attribution. Hypothesis-driven analysis reduces confirmation bias by defining competing explanations, identifying predictions and recording contradictions.

Quantitative measures such as precision and recall can evaluate analytic performance when their assumptions and ground truth are understood. Confidence should be claim-specific and should communicate both supporting evidence and limitations. Findings must directly support containment, eradication, recovery and lessons learned. Throughout the process, lawful authority, privacy, proportionality, chain of custody, confidentiality and transparent reporting are essential. AI can assist analysis but cannot replace validation and professional judgement.

Key Terms

Incident response: Organised process for detecting, managing, containing and recovering from a cyber incident.

Digital forensics: Systematic identification, preservation, acquisition, examination and interpretation of digital evidence.

Threat intelligence: Processed information about threats that supports security decisions.

Forensic analytics: Analytical examination of digital evidence to identify patterns, relationships and explanations.

Indicator of compromise: Observable artefact suggesting that a system may have been compromised.

Indicator of attack: Observable behaviour suggesting an attack is occurring or being attempted.

Timeline: Ordered representation of events from one or more evidence sources.

Timestamp normalisation: Conversion of timestamps into a common reference while retaining their original form.

Chain of custody: Record of evidence possession, handling, transfer and storage.

Provenance: Information describing the origin and processing history of data.

Hypothesis: Testable proposition explaining observed events.

Correlation: Assessment of relationships among observations based on shared attributes or context.

Containment: Actions intended to limit continuing harm or attacker access.

Eradication: Removal of malicious causes, persistence and unauthorised access.

Recovery: Restoration and validation of secure, functioning services.

Precision: Proportion of positive classifications that are true positives.

Recall: Proportion of all true positive cases identified by a classification process.

Confidence: Degree of support for a specific investigative claim.

Attribution: Assessment of the person, group or source responsible for activity.

Chain of evidence: The logical connection showing how evidence supports an investigative conclusion.

Review Questions

Short Answer Questions

1. Why should a threat-intelligence indicator be treated as a lead rather than automatic proof?
2. What is the difference between a fact, an inference and an assumption?
3. Why should original timestamps be retained when constructing a normalised timeline?
4. What information should be included in a chain-of-custody record?
5. Define precision and recall in the context of security analytics.

Long Answer Questions

1. Explain how incident response and digital forensics can be coordinated without allowing urgent containment to destroy important evidence.
2. Describe a complete method for constructing and validating an event timeline from endpoint, identity and network sources.
3. Explain the threat-intelligence lifecycle and discuss how intelligence quality affects investigative decisions.
4. Discuss hypothesis-driven forensic analysis, including the danger of confirmation bias and the value of competing explanations.
5. Evaluate the legal, ethical and governance issues that arise when investigating employee accounts and cloud-hosted data.

Analytical / Application Questions

1. An account logs in from an unfamiliar country, launches a common administration tool and accesses a sensitive database. Develop at least three competing hypotheses, identify evidence that would distinguish them and state what immediate containment you would recommend.
2. A timeline contains a local workstation event at 14:05, a cloud event at 13:58 UTC and a proxy event at 14:10. Explain the checks required before concluding that the events occurred in that order.
3. A detection system generates 80 alerts, of which 56 are confirmed malicious. Investigators estimate that 70 malicious events existed in the assessed population. Calculate precision and recall, state the assumptions behind the calculation, and explain why the figures alone do not measure investigative quality.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the relationship between an indicator of compromise and an investigative conclusion?

A. An indicator always proves that a named threat actor is responsible.

B. An indicator is a lead whose meaning depends on context and corroboration.

C. An indicator is useful only after a court has admitted it as evidence.

D. An indicator automatically establishes the scope of an incident.

Correct Answer: B. An indicator is a lead whose meaning depends on context and corroboration.

Question 2

If a local timestamp is ahead of UTC by two hours, which conversion is correct?

A. tUTC = tlocal + 2 hours

B. tUTC = tlocal × 2

C. tUTC = tlocal − 2 hours

D. tUTC = 2 hours − tlocal

Correct Answer: C. tUTC = tlocal − 2 hours

Question 3

Which activity most directly supports evidence integrity during acquisition?

A. Deleting the original after creating a working copy

B. Recording and comparing cryptographic hash values

C. Sorting all evidence by file size

D. Assigning the same evidence identifier to every device

Correct Answer: B. Recording and comparing cryptographic hash values

Question 4

What is the principal purpose of competing hypotheses in forensic analysis?

A. To ensure that every incident is attributed to an external actor

B. To reduce confirmation bias by testing alternative explanations

C. To avoid collecting evidence until certainty is achieved

D. To replace technical evidence with analyst opinion

Correct Answer: B. To reduce confirmation bias by testing alternative explanations

Question 5

An analytic generates 40 alerts and 30 are confirmed malicious. What is its precision?

A. 25%

B. 40%

C. 70%

D. 75%

Correct Answer: D. 75%

Question 6

Which statement about a matching cryptographic hash is most accurate?

A. It proves that the evidence was lawfully collected.

B. It proves that the evidence is complete and truthful.

C. It supports that the compared byte sequences are identical.

D. It identifies the person who created the evidence.

Correct Answer: C. It supports that the compared byte sequences are identical.

Question 7

Which action is an example of containment?

A. Revoking active sessions for a suspected compromised account

B. Writing the final lessons-learned report before analysis

C. Changing the file format of all acquired evidence

D. Attributing the incident to a threat group from one IP address

Correct Answer: A. Revoking active sessions for a suspected compromised account

Question 8

What does recall measure in a classification system?

A. The proportion of positive alerts that are true positives

B. The proportion of all true positive cases that were identified

C. The average time required to acquire evidence

D. The number of indicators received from an intelligence feed

Correct Answer: B. The proportion of all true positive cases that were identified

Question 9

Why should confidence normally be attached to individual investigative claims?

A. Different claims may have different levels of evidential support.

B. It guarantees that all conclusions are legally admissible.

C. It removes the need to document contradictory evidence.

D. It ensures that attribution is always possible.

Correct Answer: A. Different claims may have different levels of evidential support.

Question 10

Which is the most appropriate use of generative AI during a forensic investigation?

A. Allowing it to make final conclusions without analyst validation

B. Uploading confidential evidence to any public AI service

C. Using it to suggest patterns while validating outputs against original evidence

D. Treating its generated explanation as an independent evidence source

Correct Answer: C. Using it to suggest patterns while validating outputs against original evidence