Red Team: Adversary Simulation. A team of penetration testers (a red team) is hired to legally break into a facility to test its security.
Since the job of Red Teaming and Penetration Testing, especially physical, which is the focus of this question, involves a lot of traveling, it's hard to pin point a country to apply this question to. If it's absolutely necessary, let's assume US and European laws.
Hypothetical Situation:
The company Blue hires the company Red to do a Red Team engagement on Blue. Here, I'll be discussing only the physical part of the engagement, not social and cyber.
Red successfully infiltrates Blue and gives detailed reports of what was done in the engagement. Example part of the report:
...
In building A:
At door A101, we picked the lock. Techniques used in picking: Raking, Bump Key.
At door A102, we picked the lock. Techniques used in picking: Raking.
...
The report includes details of techniques used to exploit and infiltrate.
A week after the engagement is done, Blue is attacked by real criminals and had their data exfiltrated from building A. They didn't have camera footage of every door exploited. Installation of the doors and locks in building A are confirmed to be proper and most likely picked. However, those doors/locks have also been reported to be picked by Red during their engagement the week before.
The problem:
The locks being tested have been picked and exploited by both Red and the criminals. Forensics evidence would likely show traces of both or just Red's engagement. Since red team engagements are to simulate real criminals as accurately as possible, it's hard to differentiate between evidence left by Red and those left by the criminals.
Blue is highly confident that those locks were picked by the criminals, and let's assume they're correct about that. Blue wishes to investigate how exactly the criminals got in and track down those criminals. Additionally, Blue also wants to claim insurance for those locks being picked. (I've heard we can get insurance from the lock manufacturer if the locks are picked and we take damage from that)
Question(s):
How can forensic evident on the locks be used in court (for insurance) and investigation? How should Blue use said forensic evidence to claim their insurance and track down the criminals when it's hard to distinguish between marks left by Red and the criminals?
