The Forensics and Attribution capability is described as conducting forensic analysis and attributing terrorist acts (including the means and methods of terrorism) to their source(s), to include forensic analysis as well as attribution for an attack and for the preparation for an attack in an effort to prevent initial or follow-on acts and/or swiftly to develop counter-options.

Forensics is the collection and examination of evidence associated with an act. Attribution involves the fusion of the science-based technical forensic examination results, intelligence information from all sources, and other law enforcement/investigative information. They are conducted together to inform government leadership of the responsible actor(s) and to assist in the prevention of initial or follow-on acts of terrorism.