They examined the actual evidence on an unrelated system

Where did the incident team go wrong?