text: Intelligence
  8-26. Forensics involves methodically gathering and analyzing evidence to establish facts that can be
  presented in a legal proceeding. It applies multidisciplinary scientific processes to establish facts. Forensics
  operations, to include site and document exploitation, further aid the positive identification efforts of a
  counterinsurgent and help to separate insurgents from the general population, thus contributing to overall
  situational understanding. Commanders and staffs should make every effort to operate within status of
  forces agreements and combatant command requirements. (See ATTP 2-91.6 for more information on
  forensics.)
  8-27. For example, latent fingerprints discovered on pieces of improvised explosive devices provide
  critical information that analysts need to link individuals, insurgent organizations, their capabilities, and
  their activities. Forensics that includes site exploitation and forensic documents is of great benefit to
  substantiating information if detainees are insurgents. The methods of forensics allow the counterinsurgent
  to work towards situational understanding.
  Site Exploitation
  8-28. Site exploitation is a series of activities to recognize, collect, process, preserve, and analyze
  information, personnel, and/or materiel found during the conduct of operations (JP 3-31). When countering
  an insurgency, site exploitation of an insurgent location is essential. Computers, cell phones, and other
  means of communication and storing information are vital to understanding the insurgent structure.
  8-29. Site exploitation uses the full range of resources at the commander’s disposal, starting with the
  Soldier’s basic cognitive skills to sophisticated analytical processes conducted by joint, interagency, and
  intergovernmental organizations. Exploitation operations provide answers to the commander’s information
  requirements regardless of whether the information was gained by a squad on patrol or through external
  sensor platform outputs.
  8-30. Site exploitation may require additional technical expertise not resident within the theater to process
  the collected information, material, and personnel to maintain their unique physical or forensic attributes.
  Detailed technical exploitation of collected items can divulge actionable information or intelligence that
  can be used to positively identify any unique threat characteristics or threat networks for follow-on actions.
  8-31. Knowledge management enables the effective dissemination of actionable information and
  intelligence to units for their integration into the intelligence, targeting, and operations processes. This
  facilitates follow-on operations and enhances commanders’ and staffs’understanding.