Forensic Science FAQ¶
Getting Started Questions¶
What is this course about?¶
This course is a rigorous, laboratory-intensive introduction to forensic science designed for high school students. It bridges chemistry, biology, physics, anatomy, and law through the lens of criminal investigation. Students learn how physical, biological, chemical, and digital evidence is collected, analyzed, and presented in a court of law.
The course covers 18 chapters organized into six thematic modules: forensic infrastructure and crime scene methodology; physical and microscopic trace evidence; biological evidence and biochemistry; chemical and biomolecular analysis; anatomical and ecological analysis; and materials science, digital evidence, facial recognition, cell phone analytics, and social media analysis.
By the end of the course, students will be able to apply scientific reasoning to solve simulated casework, communicate findings in the language of expert testimony, and evaluate evidence under the legal standards used in U.S. courts.
See Course Description for the full overview.
Who is this course for?¶
This course is designed for high school students in grades 9–12 who have already completed introductory biology and chemistry. It is appropriate for college-prep and AP-track students seeking a rigorous application of STEM skills in a real-world investigative context.
The course is also suitable for dual-enrollment programs at community colleges, and for any student who wants to understand how science is applied in the criminal justice system. No prior forensic science knowledge is assumed — the course builds from foundational principles to advanced topics across all modules.
See Course Description for the target audience section.
What prerequisites do I need to take this course?¶
Students should have completed:
- Introductory Biology — covering cell structure and genetics basics
- Introductory Chemistry — covering states of matter, chemical reactions, and basic lab safety
- Algebra I — ratio and proportion calculations; basic trigonometry is helpful for bloodstain pattern calculations but not strictly required
Students who are comfortable with these foundations will be well positioned to engage with the laboratory calculations, microscopy techniques, and instrumental analysis methods covered throughout the course.
How is this textbook organized?¶
The textbook is organized into 18 chapters grouped into six thematic modules. Each module builds on the previous, starting with legal foundations and crime scene methodology before progressing to physical evidence, biological evidence, chemical analysis, anatomical analysis, and finally digital and technology-based forensic disciplines.
Chapters include written content, diagrams, interactive MicroSims, and links to the course glossary. A Learning Graph shows how all 258 concepts in the course relate to one another and build on prerequisite knowledge.
What will I be able to do after completing this course?¶
After completing this course, you will be able to:
- Apply scientific reasoning to real crime scene scenarios
- Collect, document, and analyze physical, biological, chemical, and digital evidence
- Perform calculations used in bloodstain pattern analysis, entomological PMI estimation, BAC retro-extrapolation, and stature estimation
- Interpret laboratory outputs including DNA electropherograms, GC-MS chromatograms, and fingerprint AFIS comparisons
- Evaluate evidence under the Daubert Standard and explain your findings in the language of expert testimony
- Critically assess the limitations and error rates of forensic methods
Learning outcomes are organized across all six levels of Bloom's Taxonomy — from recall through analysis and creation. See the full list of outcomes in Course Description.
What topics are NOT covered in this course?¶
To meet school board adoption standards and protect student audiences, several topics are intentionally excluded:
- Graphic autopsy photographs or graphic crime-scene imagery
- Drug synthesis routes or instructions for making explosives
- Offensive hacking or intrusion techniques
- Methods for bypassing or spoofing facial recognition systems
- Cell interception using IMSI catchers or SS7 exploits
- Unauthorized access to private social media accounts
The course focuses on the analysis and interpretation of evidence — not on offensive or harmful techniques. Explosive chemistry, for example, is covered only at the post-blast diagnostic level, not synthesis.
How does forensic science differ from what I see on TV crime shows?¶
Television crime dramas dramatically compress timelines, overstate the certainty of results, and often show techniques that are not scientifically validated. Real forensic science is slower, more cautious, and far more nuanced.
In real casework, a DNA analysis takes days to weeks — not minutes. Results are reported with statistical probabilities rather than absolute certainty. Forensic scientists are bound by ethical rules and court standards (the Daubert Standard) that require peer-reviewed methods and known error rates. Many dramatic "identifications" shown on TV would be inadmissible in an actual courtroom.
This course teaches the real methods and their real limitations, preparing you to think critically about forensic evidence.
See Chapter 1: Foundations and Legal Principles.
What is the Locard Exchange Principle and why is it so important?¶
The Locard Exchange Principle, proposed by pioneering French forensic scientist Edmond Locard, states that whenever two objects come into contact, each leaves trace material on the other. In practical terms: every criminal leaves something at the scene and takes something away.
This principle is foundational to all of trace evidence analysis — it justifies why forensic scientists painstakingly collect hair, fiber, soil, glass fragments, and other microscopic materials at crime scenes. A burglar who walks across a carpet deposits shoe tread impressions and takes away carpet fibers. A shooter's hands and clothing receive gunshot residue. A victim's hair transfers to an attacker's clothing.
Understanding this principle shapes how crime scenes are processed and why evidence collection must be thorough and systematic.
See Chapter 1: Foundations and Legal Principles and the Glossary entry for Locard Exchange Principle.
What are the Daubert and Frye standards?¶
Both standards govern the admissibility of scientific expert testimony in court, but they differ in their approach:
The Frye Standard (1923) requires that a scientific technique be "generally accepted" in the relevant scientific community before its results can be admitted in court. It focuses on community consensus.
The Daubert Standard (1993, U.S. Supreme Court) requires federal judges to act as "gatekeepers" evaluating whether testimony is based on sufficient facts, reliable methodology, properly applied principles, and peer review with known error rates. It is a more rigorous, multi-factor test.
Most federal courts and many state courts use Daubert. Some states still apply Frye. The distinction matters because a newer forensic technique might not yet have broad community acceptance (failing Frye) while still meeting Daubert's reliability criteria — or vice versa.
See Chapter 1: Foundations and Legal Principles.
What is the difference between criminal law and civil law in a forensic context?¶
In criminal law, the government prosecutes offenses against society. The standard of proof is the highest in law: beyond a reasonable doubt. Penalties may include imprisonment. Forensic science in criminal cases must meet stringent admissibility standards.
In civil law, private parties seek remedies such as monetary damages. The standard of proof is lower: preponderance of the evidence (more likely than not). The same forensic evidence that cannot convict in a criminal case may still be persuasive in a civil suit.
The O.J. Simpson cases are a famous example: Simpson was acquitted in the criminal trial but found liable in the civil wrongful death case based on overlapping forensic and circumstantial evidence.
See Chapter 1: Foundations and Legal Principles.
How many concepts does this course cover?¶
This course covers 258 concepts organized into 18 chapters across six thematic modules. These concepts range from foundational ideas like the Locard Exchange Principle and Chain of Custody to advanced topics like convolutional neural networks in facial recognition, CDR tower triangulation, and social media evidence authentication.
The Learning Graph shows how all 258 concepts relate to one another, with prerequisites mapped so you can see which concepts must be mastered before others.
Does this course include interactive simulations?¶
Yes. The textbook includes several MicroSims — browser-based interactive simulations that let you explore forensic concepts hands-on without special software. Available MicroSims include a forensic science history timeline, a Locard Exchange Principle visualizer, a Daubert vs. Frye admissibility decision workflow, and a criminal justice process flow diagram.
See the MicroSims index for the current list of simulations.
Core Concept Questions¶
What is chain of custody and why does it matter?¶
Chain of custody is the documented, chronological record showing who collected, handled, transferred, analyzed, and stored a piece of evidence from the crime scene through to the courtroom. Every transfer — from the collecting officer to the lab technician, from the lab technician to the evidence vault, from the vault to the expert witness — must be signed, dated, and recorded.
A broken chain of custody can make evidence inadmissible in court or allow defense attorneys to argue that the evidence was tampered with or contaminated. Even strong forensic results lose their value if the chain of custody is incomplete. This is why every piece of evidence receives a unique identifier, a sealed container, and a log entry at every handoff.
See Chapter 2: Crime Scene Investigation.
What are the Seven S's of Crime Scene Investigation?¶
The Seven S's are a procedural framework used to guide crime scene investigators through a systematic process:
- Securing — Establish a perimeter and prevent unauthorized access
- Separating — Keep witnesses and suspects apart; keep first responders out of the evidence area
- Scanning — Conduct a visual survey of the entire scene before touching anything
- Seeing — Observe and mentally note the overall scene condition
- Sketching — Create a measured, scaled drawing of the scene
- Searching — Conduct a systematic evidence search using an appropriate pattern
- Securing evidence — Collect, package, label, and log all evidence found
Following this sequence protects evidence integrity and ensures the scene is thoroughly documented before any item is disturbed.
See Chapter 2: Crime Scene Investigation.
What is the difference between patent, plastic, and latent fingerprints?¶
These three types of fingerprints differ in how they are formed and whether they are immediately visible:
- Patent fingerprints are visible impressions left when a finger coated with a substance (blood, grease, paint) contacts a surface. They are immediately visible and can often be photographed without development.
- Plastic fingerprints are three-dimensional impressions left in soft materials such as wax, putty, or fresh paint. They are visible as relief impressions and require casting rather than chemical development.
- Latent fingerprints are invisible impressions left by the natural oils and sweat on friction ridge skin. They require physical, chemical, or optical development techniques (dusting, ninhydrin, cyanoacrylate fuming) to be visualized.
Latent prints are by far the most common type encountered at crime scenes and require the most analytical work.
See Chapter 3: Fingerprint Analysis.
What are the three major fingerprint pattern families?¶
All human fingerprints fall into one of three major pattern families:
- Loops — The most common pattern (60–65% of the population). Ridges enter from one side, curve around a core, and exit from the same side. Loops are subclassified as ulnar (opening toward the little finger) or radial (opening toward the thumb).
- Whorls — Found in about 30–35% of the population. Ridges form circular, spiral, or other closed patterns around a central point, with two delta formations present. Subtypes include plain whorls, central pocket loops, double loops, and accidental whorls.
- Arches — The least common pattern (about 5%). Ridges enter from one side, rise in a wave or tent shape, and exit from the other side without recurving. They are the simplest pattern with no delta or core.
Pattern classification is the first step in fingerprint comparison and AFIS database searching.
See Chapter 3: Fingerprint Analysis.
What is the medullary index and how is it used to classify hair?¶
The medullary index is the ratio of the medulla (inner channel) diameter to the overall hair shaft diameter, calculated as: medullary index = medulla diameter ÷ total hair diameter.
- A medullary index less than 0.33 is typical of human hair.
- A medullary index greater than 0.50 is typical of animal hair.
This calculation helps forensic scientists distinguish between human and non-human hair found at a crime scene — an important step before more expensive or time-consuming DNA analysis is performed. Hair from different regions of the body (scalp, pubic, facial) also shows characteristic medullary patterns.
See Chapter 4: Hair and Fiber Analysis.
What is the refractive index and how is it used in glass analysis?¶
The refractive index (RI) is a measure of how much a material slows and bends light as it passes through. Every type of glass has a characteristic refractive index based on its chemical composition. Glass from different manufacturers and product types has measurably different RI values.
Forensic scientists use the Becke line test and immersion oil technique to measure the RI of glass fragments to four decimal places. By comparing the RI of a glass fragment from a suspect's clothing to the RI of the broken window at a crime scene, analysts can determine whether the two samples are consistent with a common source — or definitively exclude them as different glass populations.
See Chapter 5: Glass, Soil and Trace Evidence.
What is the difference between a presumptive test and a confirmatory test?¶
These two categories of tests serve different roles in forensic analysis:
- Presumptive tests (also called screening tests) are rapid, sensitive tests that detect a broad class of substances. A positive result indicates the possible presence of a target substance, but false positives can occur. Examples include the Kastle-Meyer test for blood and the Duquenois-Levine test for cannabis. Presumptive tests guide where to direct further analysis.
- Confirmatory tests provide definitive identification of a specific substance by detecting unique chemical properties. They eliminate false positives. Examples include GC-MS for drug identification and the Takayama crystal test for blood. Confirmatory results meet the standard for courtroom evidence.
In practice, a positive presumptive test triggers a confirmatory test before conclusions are reported. Using only presumptive results in testimony would be scientifically irresponsible.
See Chapter 6: Forensic Serology.
How is the angle of impact of a bloodstain calculated?¶
The angle at which a blood droplet struck a surface is calculated using the angle of impact formula:
angle = arcsin(width ÷ length)
A circular stain indicates the drop fell straight down at a 90° angle. As the angle decreases, the stain becomes more elliptical — longer relative to its width. By measuring the width and length of an elliptical bloodstain and applying the arcsine function, investigators can determine the drop's angle of impact.
For example: a stain measuring 4 mm wide and 8 mm long has a ratio of 0.50; arcsin(0.50) = 30°, meaning the drop struck the surface at a 30-degree angle.
These angle calculations from multiple stains are then combined with area of convergence analysis to determine the three-dimensional area of origin — where in space the blood was shed.
See Chapter 7: Bloodstain Pattern Analysis.
What is PCR and why is it essential for forensic DNA profiling?¶
Polymerase Chain Reaction (PCR) is a laboratory technique that makes millions of copies of a specific short DNA segment, allowing analysis of tiny or degraded biological samples that would otherwise contain too little DNA to examine.
PCR works in three repeated temperature-cycling steps: 1. Denaturation (94–96°C) — the double-stranded DNA is heated to separate into two single strands 2. Annealing (50–65°C) — short primer sequences bind to their target locations on each strand 3. Extension (72°C) — DNA polymerase synthesizes new complementary strands from each primer
After 30 cycles, a single DNA molecule becomes over one billion copies of the target region. In forensic DNA profiling, PCR amplifies specific STR loci — the short tandem repeat regions used in CODIS — from trace biological samples found at crime scenes.
What is the CODIS database and how is it used?¶
CODIS — the Combined DNA Index System — is a national DNA database maintained by the FBI that stores standardized STR profiles from convicted offenders, arrestees, and crime scene evidence. All accredited U.S. forensic laboratories use the same set of 20 core STR loci, allowing direct comparison of profiles generated in any participating lab.
When a DNA profile is generated from crime scene evidence, it can be searched against CODIS at the state and national level. A "hit" links evidence to a known offender or to a previously unsolved crime scene. CODIS has produced hundreds of thousands of investigative leads since its establishment.
What does ADME stand for in forensic toxicology?¶
ADME describes the four pharmacokinetic stages that govern how the body processes any drug or toxin:
- Absorption — how the drug enters the bloodstream (rate depends on route: oral, intravenous, inhalation)
- Distribution — how the drug moves from blood into tissues and organs
- Metabolism — how the liver (primarily) converts the drug into metabolites
- Elimination — how the kidneys and other organs remove the drug and its metabolites from the body
Understanding ADME allows forensic toxicologists to estimate when a drug was taken, whether it would have been at impairing concentrations at the time of an incident, and what metabolites to look for when the parent drug has already been eliminated.
See Chapter 9: Forensic Toxicology.
What is the fire tetrahedron?¶
The fire tetrahedron is the model representing the four elements required for fire and its sustained combustion:
- Fuel — the combustible material
- Oxygen — the oxidizing agent
- Heat — sufficient ignition energy to start and sustain the reaction
- Chemical chain reaction — the self-sustaining reaction that perpetuates combustion
Remove any one element and the fire is extinguished. Arson investigators use this model to interpret burn patterns, evaluate whether a fire could have started accidentally, and determine whether accelerants were used to introduce additional fuel. When a fire starts in a location with no natural fuel or ignition source, investigators look for evidence of deliberate introduction.
See Chapter 10: Fire, Arson and Explosives.
What is a biological profile in forensic anthropology?¶
A biological profile is the set of key biological characteristics estimated from unidentified skeletal remains to help identify the individual or narrow the pool of possible matches. It typically includes:
- Biological sex — estimated from pelvic and cranial morphology
- Age at death — estimated from epiphyseal fusion (in young individuals), dental eruption, pubic symphysis changes, or cranial suture closure (in adults)
- Stature — estimated by applying regression equations to long bone measurements
- Ancestry — assessed through craniometric and morphological analysis
No single element provides a complete identification — the profile is used together with missing persons records to generate investigative leads. DNA analysis, dental records, and antemortem medical records ultimately confirm identity.
See Chapter 11: Forensic Anthropology.
What is the post-mortem interval (PMI) and how is it estimated?¶
The post-mortem interval (PMI) is the time elapsed since death. Estimating PMI accurately is one of the most important tasks in death investigation. Forensic entomologists use insect colonization data to calculate the minimum PMI using two main approaches:
- Accumulated Degree Hours (ADH) — summing hourly temperature values above the insect species' minimum development threshold to calculate how much thermal energy has been available for insect development
- Insect succession ecology — using the predictable sequence of insect species that colonize a body over time to determine the approximate stage of decomposition
Environmental variables — temperature, humidity, indoor vs. outdoor location, body access, clothing — all affect decomposition rates and must be factored into PMI calculations.
See Chapter 12: Forensic Entomology.
What is gunshot residue (GSR) and what does it prove?¶
Gunshot residue (GSR) consists of microscopic particles ejected from a firearm during discharge. These particles typically contain lead, barium, and antimony compounds from primer combustion. They deposit on the hands, face, and clothing of the shooter and nearby individuals.
GSR analysis using SEM-EDX (Scanning Electron Microscopy with Energy Dispersive X-ray spectroscopy) can detect particles consistent with firearm discharge on a person's hands or clothing, supporting that they recently fired or handled a discharged firearm.
However, GSR must be interpreted carefully because it can transfer secondarily (from a shooter to bystanders, or from a car seat to a passenger), and it dissipates over time through normal hand movement and washing. A positive GSR result is corroborative evidence, not a definitive identification.
See Chapter 13: Firearms and Ballistics.
What does a questioned document examiner analyze?¶
Questioned document examiners analyze documents suspected of forgery, alteration, or fraudulent origin. Their examinations include:
- Handwriting comparison — evaluating 12 or more discrete characteristics (letter form, slant, line quality, pen pressure, connecting strokes) between a questioned document and authenticated exemplar samples
- Ink analysis — using thin-layer chromatography or LC-MS/MS to determine ink composition and detect whether different inks were used in the same document
- Paper analysis — examining fiber composition, watermarks, and manufacturing characteristics
- Counterfeit detection — checking for the presence and authenticity of security features in currency and official documents
Document examination can determine whether a signature is genuine, whether a document was altered, and whether different sections of a document were written at different times.
See Chapter 14: Document Examination.
What is forensic imaging in digital forensics?¶
Forensic imaging is the process of creating an exact, sector-by-sector bit-stream copy of a digital storage device. Unlike a regular file backup (which copies only active files), a forensic image captures:
- All active files and their metadata
- Deleted files that have not yet been overwritten
- Unallocated disk space
- Slack space (unused portions of disk clusters)
- File system structures
A write-blocker device is used during imaging to prevent any data on the original device from being modified. The forensic image is verified by calculating hash values (MD5 or SHA-256) before and after imaging — if the hashes match, the image is a provably unaltered copy. All subsequent analysis is performed on the image, preserving the original device.
See Chapter 15: Digital Forensics.
How does facial recognition technology work in law enforcement?¶
Modern facial recognition systems use convolutional neural networks (CNNs) that extract a numerical feature vector (essentially a mathematical fingerprint) from a face image. This involves:
- Detection — locating the face in an image
- Alignment — normalizing the face position, scale, and orientation using landmark points (eyes, nose, mouth corners)
- Feature extraction — passing the aligned face through a CNN to produce a feature vector
- Matching — comparing the feature vector to a database of known faces using distance metrics
Law enforcement agencies use databases such as the FBI's NGI-Facial system. A facial recognition "hit" is not an identification — it is a ranked candidate list that a trained examiner must evaluate. Facial recognition results are subject to Daubert Standard scrutiny because error rates and demographic bias (higher false positive rates for darker-skinned individuals and women) must be disclosed.
See Chapter 16: Facial Recognition.
What is a Call Detail Record (CDR) and what does it contain?¶
A Call Detail Record (CDR) is a data record generated by a mobile phone carrier for every call, text, and data session processed through their network. Key fields include:
- Phone number (MSISDN) and device identifier (IMEI)
- Date and time of the communication event
- Duration of calls
- Originating and terminating towers — which cell towers handled the connection
- Tower sector — which directional antenna on the tower was used
By analyzing CDRs from an investigative timeline, digital forensic specialists can reconstruct where a mobile device was geographically located when communications occurred. This is forensically significant because it can place a suspect near a crime scene or corroborate — or contradict — their claimed alibi.
See Chapter 17: Cell Phone Analytics.
What is OSINT and how is it used in forensic investigations?¶
Open-Source Intelligence (OSINT) refers to the collection and analysis of information from publicly available sources — including social media platforms, public records, online databases, and news archives — for investigative purposes.
In forensic investigations, OSINT is used to: - Locate suspects, witnesses, or missing persons through publicly accessible profiles - Establish timelines from post timestamps and activity patterns - Geolocate individuals from images, check-ins, or background details in posts - Map social networks and communication patterns
OSINT collection must stay within legal and ethical limits: investigators may not access private accounts without proper legal authority, and all collection must comply with the platform's Terms of Service and applicable Fourth Amendment constraints.
See Chapter 18: Social Media and OSINT.
Technical Detail Questions¶
What is cyanoacrylate fuming and when is it used?¶
Cyanoacrylate fuming (also called super glue fuming) is a latent fingerprint development technique in which super glue vapors are released in a sealed chamber containing the evidence item. The cyanoacrylate vapors react chemically with amino acids, fatty acids, and water in fingerprint residue to deposit a white polymer on the friction ridges.
Cyanoacrylate fuming is most effective on non-porous surfaces such as plastic bags, glass, and metal. It produces durable, three-dimensional ridge detail that can be further enhanced with fluorescent dyes for photography. This technique is preferred when other development methods might damage or destroy fragile prints.
See Chapter 3: Fingerprint Analysis.
What is ninhydrin and what surfaces is it used on?¶
Ninhydrin is a chemical reagent used to develop latent fingerprints on porous surfaces such as paper, cardboard, and raw wood. It reacts with the amino acids (primarily glycine and alanine) present in sweat residue to produce a dark purple compound called Ruhemann's purple.
Ninhydrin is particularly useful for developing old or aged fingerprints on paper evidence because amino acids do not evaporate as readily as other sweat components. The reaction is typically enhanced by heating, and the developed prints are photographed once the color is fully developed.
See Chapter 3: Fingerprint Analysis.
What is the difference between class evidence and individual evidence?¶
- Class evidence can identify the general group or category from which a piece of evidence came, but cannot be uniquely linked to a single source. Examples include fiber type, blood group, paint color, and soil type. Class evidence narrows the suspect pool and corroborates other findings but cannot alone prove a specific individual's involvement.
- Individual evidence can be uniquely linked to a specific source to a high degree of scientific certainty. Examples include DNA STR profiles, fingerprints with sufficient minutiae points, and striation marks on fired bullets. Individual evidence is the most powerful form of forensic identification.
In practice, strong cases combine both: class evidence builds a corroborative picture while individual evidence provides positive identification.
See Chapter 4: Hair and Fiber Analysis and Chapter 6: Forensic Serology.
What is the 3R Rule in glass fracture analysis?¶
The 3R Rule is a mnemonic for reading fracture patterns in broken glass:
Radial fractures form a Right angle on the Reverse side from the force.
Radial fractures (cracks extending outward from the point of impact like spokes on a wheel) have a curved surface called a Wallner line on one side of the fracture. The right angle of that Wallner line points toward the surface from which the force came. Concentric fractures (curved cracks connecting the radial lines) follow the opposite rule — their right angle is on the same side as the force.
When a window has been struck multiple times, existing fracture lines act as barriers to new cracks, allowing investigators to determine the sequence in which impacts occurred.
See Chapter 5: Glass, Soil and Trace Evidence.
What does GC-MS stand for and why is it considered the gold standard for drug identification?¶
GC-MS stands for Gas Chromatography–Mass Spectrometry. It combines two techniques:
- Gas Chromatography (GC) separates the individual chemical components of a mixture by passing vaporized sample through a heated column, where components travel at different speeds based on their chemical properties
- Mass Spectrometry (MS) identifies each separated component by measuring the mass-to-charge ratio of its molecular fragments, producing a spectrum that is unique to each compound — essentially a molecular fingerprint
GC-MS is considered the gold standard because it provides both quantification (how much of a substance is present) and definitive identification (which substance it is), meeting the highest standards for admissible forensic evidence. It is used in drug analysis, arson investigation, toxicology, and many other forensic disciplines.
See Chapter 9: Forensic Toxicology.
What are the five stages of decomposition?¶
Human decomposition progresses through five broadly recognized stages:
- Fresh — Death has occurred; external changes are minimal, but internal autolysis and microbial activity begin. First insects may arrive.
- Bloat — Anaerobic bacteria produce gases (hydrogen sulfide, methane, carbon dioxide) that accumulate in body cavities, causing visible inflation and strong odor.
- Active decay — Most soft tissue is rapidly lost through microbial activity and larval feeding; large quantities of decomposition fluids change the surrounding soil chemistry.
- Advanced decay — Most soft tissue has been consumed; primarily dry skin, cartilage, and ligaments remain with reduced insect activity.
- Dry remains — Only bone, dried skin, hair, and other resistant tissues remain; bones may bleach and weather over time.
The rate of progression through these stages depends heavily on temperature, humidity, insect access, and burial status.
See Chapter 12: Forensic Entomology.
What are STRs and why are they used in forensic DNA profiling?¶
STRs — Short Tandem Repeats — are specific locations (loci) in the human genome where a short sequence of DNA bases (typically 2–6 base pairs) is repeated a variable number of times. Each person inherits one allele (one specific repeat count) from each parent at each STR locus.
STRs are used in forensic profiling because: - They are highly variable between individuals, making them excellent discriminators - They can be amplified by PCR even from trace or degraded samples - The 20 CODIS core loci allow direct comparison between labs and databases - The combined probability of a random match across all 20 loci is astronomically small (typically less than one in a quadrillion)
The result — a numeric STR profile — is the standard currency of forensic DNA comparison worldwide.
What is capillary electrophoresis and how is it used to read a DNA profile?¶
Capillary electrophoresis (CE) is the analytical technique that separates the PCR-amplified STR fragments by size to reveal a DNA profile. The steps are:
- Fluorescently labeled PCR products are injected into a narrow capillary filled with polymer gel
- An electric field is applied, pulling the negatively charged DNA fragments through the gel
- Smaller fragments travel faster; larger fragments travel slower
- As each fragment passes a laser detector, it emits fluorescent light recorded as a peak
- The position of each peak (its size in base pairs) identifies the allele; the color identifies which STR locus
The resulting graphical output — the electropherogram — shows peaks for each allele at each locus. Analysts read the peak positions to assign allele calls and assemble the complete numeric STR profile.
What is BAC retro-extrapolation and when is it used?¶
Blood Alcohol Concentration (BAC) retro-extrapolation is a forensic calculation used to estimate a person's BAC at an earlier point in time — typically the time of an accident or alleged offense — based on a blood draw taken later.
The calculation uses the average alcohol elimination rate of approximately 0.015 g/dL per hour (though individual rates vary). For example: if a blood draw taken 2 hours after a crash shows a BAC of 0.06 g/dL, adding back the estimated elimination gives an estimated BAC of 0.09 g/dL at the time of the crash — above the legal limit of 0.08 g/dL.
Forensic toxicologists report retro-extrapolated values with appropriate uncertainty ranges because individual elimination rates can vary from 0.010 to 0.025 g/dL/hour.
See Chapter 9: Forensic Toxicology.
What is headspace analysis and how does it detect arson accelerants?¶
Headspace analysis is the standard technique for detecting accelerant residues in fire debris. Evidence — burned flooring, wood, or upholstery — is sealed in an airtight container (typically a clean paint can). The container is gently heated, causing volatile hydrocarbon compounds from any accelerant residue to evaporate into the air space (headspace) above the debris.
The headspace vapor is sampled using a syringe or solid-phase microextraction (SPME) fiber, then injected into a GC-MS instrument. The chromatographic pattern of the separated hydrocarbons is compared to a library of known accelerant profiles. Gasoline, diesel, lighter fluid, and other accelerants produce distinctive and recognizable patterns.
See Chapter 10: Fire, Arson and Explosives.
What is epiphyseal fusion and how does it help estimate age?¶
Epiphyses are cartilaginous growth plates at the ends of long bones that gradually ossify (turn to bone) and fuse to the bone shaft during adolescence and young adulthood. Different bones fuse at predictable age ranges, providing a biological clock for age estimation:
- Elbow epiphyses fuse in the early to mid-teens
- Iliac crest fuses in the late teens
- Medial clavicle — the last to fuse — typically completes between ages 22 and 30
By assessing which epiphyses are fused, unfused, or in the process of fusing, forensic anthropologists can estimate age in subadults and young adults with reasonable precision. Once all epiphyses have fused, other aging methods (such as pubic symphysis changes and cranial suture closure) are used.
See Chapter 11: Forensic Anthropology.
What is lands and grooves rifling and how does it help identify firearms?¶
Rifling is the spiral pattern of raised ridges (lands) and recessed channels (grooves) cut into the inside of a firearm barrel. As a bullet travels through the rifled barrel, the lands bite into the bullet's surface and impart a spin that stabilizes the bullet in flight.
The lands and grooves leave striation marks on the bullet's surface that reflect the specific characteristics of that barrel — the number, width, direction of twist, and individual tool marks from the rifling process. These striations are unique to a specific firearm.
Firearms examiners use a comparison microscope to view striation marks on a crime scene bullet side-by-side with marks on test-fire bullets from a suspect weapon, determining whether they could have been fired from the same barrel.
See Chapter 13: Firearms and Ballistics.
What is EXIF metadata and what can it reveal?¶
EXIF (Exchangeable Image File Format) metadata is data automatically embedded in digital photograph files by the camera or smartphone when a photo is taken. EXIF fields may include:
- Date and time the photo was taken
- GPS coordinates of where the photo was taken (if location services were enabled)
- Camera make and model (or smartphone model)
- Lens settings (aperture, shutter speed, ISO)
- Software used to edit or process the image
In forensic investigations, EXIF data can place a device at a specific geographic location and time, link photographs to a specific camera, and contradict or corroborate a suspect's account of their location. Note that many social media platforms strip EXIF data before uploading — investigators may need to access the original file.
See Chapter 15: Digital Forensics.
What is cell tower triangulation?¶
Cell tower triangulation is a method for estimating the geographic location of a mobile device by analyzing signal data from three or more nearby cell towers. The core principle:
- When a mobile device communicates, it connects to the nearest tower (or towers) with the strongest signal
- The timing of signal arrival at multiple towers allows calculation of the device's approximate distance from each
- Intersecting the calculated distance circles from three or more towers produces a geographic area where the device was most likely located
Triangulation precision varies from hundreds of meters in urban areas (where towers are dense) to several kilometers in rural areas. CDR records document which towers a device connected to, providing a travel timeline that can be analyzed by cell-site analysts.
See Chapter 17: Cell Phone Analytics.
What are the three legal mechanisms for obtaining social media records?¶
Investigators can compel social media platforms to disclose user records through three escalating legal instruments:
- Preservation Letter — A request (not compelled disclosure) asking a platform to freeze and retain specific records for a set period (typically 90 days) while legal process is obtained. Platforms typically comply voluntarily. This is the fastest and most basic step.
- Subpoena — A legal demand compelling disclosure of basic subscriber information (name, email, IP address, account creation date) and potentially limited transactional records. Issued by a court or grand jury.
- Court Order or Search Warrant — Required for content data (message contents, posts, stored photos) and other more sensitive information. A warrant requires probable cause and judicial approval.
The level of legal authority required depends on what data category is sought: subscriber information is easiest to obtain, while stored content requires the highest standard.
See Chapter 18: Social Media and OSINT.
Common Challenge Questions¶
Why can a broken chain of custody destroy an otherwise strong case?¶
The chain of custody is the evidentiary foundation for all forensic results. If a defense attorney can demonstrate that evidence was unaccounted for at any point — even briefly — they can argue that it could have been tampered with, contaminated, or substituted during that gap.
Judges may suppress evidence with a broken chain, meaning it cannot be shown to the jury at all, regardless of what the forensic analysis revealed. In a jury trial, even if the judge allows the evidence, a documented gap gives defense counsel an opening to create reasonable doubt.
This is why documentation at every handoff — however minor — is treated as a non-negotiable professional obligation in forensic science.
See Chapter 2: Crime Scene Investigation.
Why can't luminol results alone confirm the presence of blood?¶
Luminol is a presumptive test: it reacts with the peroxidase-like activity of the iron in hemoglobin to produce a chemiluminescent glow. However, many other substances contain iron or have peroxidase activity and produce the same reaction, including bleach, copper, and certain plant extracts.
A positive luminol result means blood may be present — it cannot confirm that blood is present. A confirmatory test such as the Takayama crystal test or Kastle-Meyer test (followed by DNA analysis) is required before any courtroom claim about the presence of blood.
Additionally, luminol can partially degrade DNA, so investigators must balance the need to visualize blood locations against the risk of compromising downstream DNA analysis.
See Chapter 6: Forensic Serology.
What makes DNA evidence from mixed samples difficult to interpret?¶
A DNA mixture contains genetic material from two or more individuals. When profiles from multiple contributors overlap on an electropherogram, it becomes difficult or impossible to separate which alleles came from which person. Challenges include:
- Stochastic effects — with low-template DNA, some alleles may drop out (fail to amplify) or new artifacts may appear
- Minor contributor masking — a minor contributor's alleles may be nearly hidden under the major contributor's peaks
- Stutter artifacts — PCR-related artifacts that can mimic real alleles and complicate interpretation
- Three or more contributors — the number of possible profile combinations multiplies rapidly with each additional person
Mixture interpretation requires specialized software, validated statistical models, and highly trained analysts. Courts require laboratories to disclose the limitations of mixture interpretation in testimony.
Why do GSR results need to be interpreted cautiously?¶
Gunshot residue analysis can be misinterpreted if secondary transfer or environmental contamination is not considered:
- Secondary transfer — GSR particles can transfer from a shooter to a bystander through physical contact, or from surfaces (car seats, clothing, handcuffs) to a person who never fired a weapon
- Environmental sources — certain occupational exposures produce particles with similar elemental composition to GSR (lead-containing paints, airbag deployment)
- Decay over time — GSR particles are lost through normal hand movement, washing, and rubbing; a negative result hours after a shooting does not prove the person did not fire
GSR is most valuable when paired with other evidence and when interpreted by a specialist familiar with the specific particles found and the context of the case.
See Chapter 13: Firearms and Ballistics.
How can environmental conditions affect forensic entomology PMI estimates?¶
Insect development rates are highly temperature-dependent. The accumulated degree hours (ADH) model requires accurate temperature data for the location where the body was found — indoor vs. outdoor, shaded vs. sunny, buried vs. surface — throughout the entire post-mortem period.
Common sources of error include:
- Delayed colonization — if the body was moved indoors or wrapped in a barrier, insects may have been excluded for a period, causing the entomological clock to start later than death
- Temperature microclimate differences — the temperature at a body's surface can differ substantially from the nearest weather station, particularly in forested or shaded environments
- Geographic variation in species — development rate data for a given species varies by geographic population; using the wrong reference data introduces systematic error
Forensic entomologists report a minimum PMI rather than a precise time of death because they can only determine when insect colonization began — not necessarily when death occurred.
See Chapter 12: Forensic Entomology.
What is the difference between antemortem, perimortem, and postmortem bone trauma?¶
Forensic anthropologists distinguish among three categories of bone injury based on the timing relative to death:
- Antemortem trauma — occurred before death, with evidence of biological healing such as bone callus formation, periosteal reaction, or remodeling. The individual survived long enough for healing to begin.
- Perimortem trauma — occurred at or near the time of death, while bone still had its "green" (fresh, hydrated) properties. Fresh bone fractures with plastic deformation, irregular fracture edges, and bone flaking. This category is most relevant to manner of death determination.
- Postmortem trauma — occurred after death when bone had dried and lost its hydration. Dry bone fractures differently — with sharp, angular breaks and bleached or weathered edges consistent with environmental exposure.
Accurately distinguishing these categories prevents false inferences about cause of death.
See Chapter 11: Forensic Anthropology.
Why is facial recognition evidence controversial in court?¶
Facial recognition evidence faces several significant criticisms affecting its admissibility and reliability:
- Demographic bias — multiple peer-reviewed studies have documented higher false positive rates for darker-skinned individuals and women compared to lighter-skinned men in many commercial systems
- Pose and illumination sensitivity — performance degrades significantly with non-frontal poses, poor lighting, low camera resolution (common in CCTV footage), and aging
- Lack of standardized error rates — unlike DNA, there is no widely accepted national standard for reporting error rates for facial recognition identifications
- Examiner subjectivity — a human examiner makes the final call on a ranked candidate list, introducing subjective judgment that may not be scientifically auditable
Courts applying the Daubert Standard must evaluate these factors before admitting facial recognition testimony. Defendants have successfully challenged facial recognition evidence in several landmark cases.
See Chapter 16: Facial Recognition.
What makes digital evidence authentication challenging?¶
Digital evidence is easily replicated, altered, and — in some cases — fabricated. Authentication challenges include:
- Hash value verification — the chain of custody must document matching hash values (MD5 or SHA-256) at collection, imaging, and analysis to prove the evidence was not altered
- Timestamp manipulation — system clocks can be changed, and file metadata timestamps can be altered with freely available tools; investigators must corroborate timestamps with independent sources
- Metadata stripping — social media platforms often remove EXIF data on upload, eliminating geolocation evidence
- Screenshot authenticity — a screenshot of a social media post can be doctored; courts require the original URL, full-page capture, and hash documentation as authentication
Under Federal Rule of Evidence 901, the proponent of digital evidence must demonstrate it is what it purports to be through reliable methods before it can be admitted.
See Chapter 15: Digital Forensics and Chapter 18: Social Media and OSINT.
Why does ink chromatography matter in document examination?¶
When a document is altered — for example, a will with an added signature, or a contract with a changed date — the forger often uses a pen with a different ink formulation than the original author.
Thin-layer chromatography (TLC) separates ink into its component dye molecules by running a solvent through the ink spot on a TLC plate. Different ink formulations produce different characteristic separation patterns (Rf values). If two sections of a document claimed to be written at the same time show different TLC patterns, the document has likely been altered.
This analysis can also reveal that a specific ink formulation was not commercially available before a certain date, directly refuting the claimed date of execution.
See Chapter 14: Document Examination.
Best Practice Questions¶
What search pattern should be used and when?¶
The choice of search pattern depends on the size and shape of the crime scene:
- Grid pattern — two overlapping sets of parallel search lines, one perpendicular to the other. The most thorough pattern because every area is searched twice from different angles. Best for large outdoor scenes where small evidence may be missed.
- Spiral pattern — a circular search moving inward or outward. Good for smaller, defined areas with a clear center point (such as a body).
- Zone pattern — divides the scene into sectors, with each sector assigned to a different searcher. Efficient for large indoor scenes with rooms or subdivisions.
Regardless of pattern, searchers should document their path, mark found items with numbered placards, and photograph before collection.
See Chapter 2: Crime Scene Investigation.
How should biological evidence be packaged and why?¶
Biological evidence (blood swabs, hair, tissue) must be packaged in paper, not plastic:
- Paper allows air circulation, preventing moisture buildup
- Moisture trapped in plastic creates an environment for bacterial growth that degrades DNA
- Paper bags and druggist folds preserve DNA quality during transport and storage
Items should be air-dried before packaging whenever possible, collected with sterile tools, placed in biohazard-labeled containers, and sealed with tamper-evident seals. Each item receives a unique evidence number and is logged immediately.
See Chapter 2: Crime Scene Investigation.
When should a forensic scientist perform a write-blocker when examining digital evidence?¶
A write-blocker must be used every time a digital storage device is connected to an examination computer before forensic imaging. Write-blockers are hardware or software devices that intercept any write commands the examination computer attempts to send to the connected device, ensuring the original evidence is not modified during the imaging process.
Without a write-blocker, simply connecting a drive to a Windows computer can automatically modify timestamps and directory structures. Any such modification invalidates the hash verification and potentially renders the evidence inadmissible.
The write-blocker is non-negotiable — it is one of the first procedural checks in any digital evidence examination.
See Chapter 15: Digital Forensics.
How should a forensic scientist communicate limitations of evidence to a jury?¶
Expert witnesses have an ethical obligation to communicate findings accurately and completely — including their limitations. Best practices include:
- State the method used and its known error rate (where established by peer-reviewed research)
- Distinguish between a match (consistent with a common source) and an identification (positively linked to a unique source)
- Avoid absolute language ("this is definitely from the suspect") unless the science justifies it
- Disclose any factors that could affect the reliability of the result (sample degradation, mixture complexity, database limitations)
- Answer defense cross-examination honestly, including acknowledging the validity of alternative explanations
Forensic scientists who overstate certainty — knowingly or through negligence — have contributed to wrongful convictions. Ethical testimony is a professional and moral obligation.
See Chapter 1: Foundations and Legal Principles.
What factors should guide the choice of fingerprint development technique?¶
The substrate (surface) is the primary factor:
- Porous surfaces (paper, cardboard, unfinished wood) → ninhydrin, DFO, silver nitrate (each reacts with different sweat components)
- Non-porous surfaces (glass, plastic, metal) → aluminum powder, cyanoacrylate fuming, rhodamine dye
- Wet surfaces → small particle reagent (a suspension of molybdenum disulfide)
- Multi-colored or patterned surfaces → luminescent or fluorescent techniques that allow print visualization under specialized light sources
Sequence matters when multiple techniques might be used: luminescent dyes before powders; cyanoacrylate before luminescent dyes. Using techniques out of order can destroy the evidence the next technique would have revealed.
See Chapter 3: Fingerprint Analysis.
How should a forensic entomologist collect insect evidence from a scene?¶
Proper insect collection is critical for accurate PMI estimation:
- Collect larvae in two batches: one batch preserved immediately in 70–80% ethanol (to document current developmental stage at collection), and one batch transported alive to a laboratory for controlled rearing to adult stage (for definitive species identification)
- Record ambient and microhabitat temperature at the collection site using a calibrated thermometer — not just regional weather station data
- Note developmental stage of larvae in the field (egg, instar stage, pupa)
- Photograph insect activity on the body before collecting
- Collect empty pupal cases — they are evidence of completed development cycles even when no larvae remain
All samples are labeled with collection location on the body, date, time, and collector name.
See Chapter 12: Forensic Entomology.
How can an investigator corroborate a suspect's claimed location using digital evidence?¶
Multiple digital data sources should be cross-referenced:
- Cell tower records (CDR) — document which towers the suspect's phone connected to during the relevant timeframe
- GPS device history — smartphones and dedicated GPS devices log travel routes with timestamps
- Wi-Fi logs — connection to a specific Wi-Fi access point places a device at a precise location
- Social media posts — timestamps, geotagged photos, and check-in features may confirm or contradict claimed location
- EXIF metadata from photos — GPS coordinates embedded in unedited photos taken on a phone
- Financial transaction records — ATM withdrawals, credit card swipes, and mobile payment logs include timestamps and merchant locations
No single source is sufficient — cross-referencing multiple independent sources strengthens the location evidence significantly.
See Chapter 17: Cell Phone Analytics.
Advanced Topic Questions¶
How is the random match probability calculated for a DNA profile?¶
The product rule is used to calculate the probability that a randomly selected individual from the population would share the same DNA profile as the evidence sample. Because STR loci are on different chromosomes (or sufficiently far apart on the same chromosome), they are inherited independently, making their allele frequencies statistically independent.
The product rule works as follows: for each STR locus, calculate the frequency of the observed allele combination in the relevant population database. Then multiply the frequencies across all loci. With 20 CODIS loci, the resulting combined probability is typically far smaller than one in one trillion, making a coincidental match essentially impossible in practice.
These statistics must be calculated using appropriate population databases and reported with appropriate transparency about the population reference used.
How does the Fourth Amendment apply to digital searches?¶
The Fourth Amendment's protection against unreasonable searches and seizures applies to digital evidence, but courts have developed nuanced rules for the digital context:
- Devices require a warrant — the Supreme Court's decision in Riley v. California (2014) held that police may not search the contents of a cell phone incident to arrest without a warrant
- Third-party records — information voluntarily shared with a third party (like a carrier's CDR records) has traditionally received less Fourth Amendment protection under the third-party doctrine, though this is evolving
- Cloud data — accessing content stored in cloud services may require a warrant or court order depending on the data category
- Border searches — customs agents have broader authority to search digital devices at the border, though this varies by jurisdiction
Understanding these boundaries is essential for investigators to ensure that digital evidence is collected in a constitutionally admissible manner.
See Chapter 1: Foundations and Legal Principles and Chapter 17: Cell Phone Analytics.
What is the Daubert Standard analysis for facial recognition evidence?¶
When facial recognition evidence is offered in court under the Daubert Standard, a judge evaluates it against the standard's four primary factors:
- Testing and falsifiability — has the facial recognition method been empirically tested? Can its error rate be measured?
- Peer review and publication — has the methodology been subjected to peer-reviewed scientific scrutiny?
- Known or potential error rate — what is the documented false positive rate? Does it vary by demographic group?
- General acceptance — is the methodology generally accepted in the facial recognition science community?
Defense challenges often focus on the system's documented demographic bias (higher false positive rates for certain ethnic and gender groups), the lack of standardized performance benchmarks for law enforcement use cases, and the subjectivity introduced when a human examiner makes the final identification call.
See Chapter 16: Facial Recognition.
How does steganography challenge digital forensics?¶
Steganography is the practice of hiding information within ordinary-looking digital files — typically hiding secret data within the pixel values of images, audio files, or video in ways that are invisible to casual inspection.
In forensic investigations, steganography presents challenges because: - Hidden data does not appear in normal file browsing or keyword searches - Specialized detection tools (steganalysis software) must be used to identify the statistical anomalies that indicate hidden content - Even if steganography is detected, the hidden content may be encrypted, requiring a second layer of cryptanalysis - Without knowledge of the specific steganographic algorithm used, extraction may be impossible
Steganography awareness is important in cases involving child exploitation material, corporate espionage, and covert communications between criminal networks.
See Chapter 15: Digital Forensics.
What are the main methods for recovering deleted data from mobile devices?¶
Mobile forensic examiners use several acquisition methods that differ in how deeply they access device storage:
- Logical acquisition — extracts active files, contacts, messages, and app data that the device operating system makes available through standard interfaces. Fast and reliable, but misses deleted data.
- File system acquisition — accesses the raw file system, including files marked as deleted that have not yet been overwritten. Requires more advanced tools.
- Physical acquisition — creates a bit-by-bit image of the device's flash memory, capturing deleted data and unallocated space. The most comprehensive method but may require device bypass.
- Chip-off acquisition — physically removes the flash memory chip and reads it directly with specialized equipment. Used as a last resort for damaged or locked devices.
Tools like Cellebrite UFED support logical, file system, and physical acquisition. The appropriate method depends on the device model, operating system version, encryption status, and evidentiary goals.
See Chapter 17: Cell Phone Analytics.
How are stature regression equations used in forensic anthropology?¶
Stature regression equations are mathematical formulas that predict a person's living height from the length of specific long bones (typically the femur, tibia, fibula, humerus, radius, or ulna). The equations have the form:
Estimated stature = (bone length × coefficient) + constant ± standard error
The equations were developed from reference populations where both bone length and living stature were measured, using linear regression analysis. Different equations exist for different reference populations, sexes, and bones because the relationship between bone length and stature varies by these factors.
For example, the femur length multiplied by an appropriate population-specific coefficient and constant yields an estimated stature in centimeters with a documented standard error range (typically ±3–5 cm). The result is reported as a range, not a single value.
See Chapter 11: Forensic Anthropology.
What is social network analysis and how is it applied in criminal investigations?¶
Social network analysis (SNA) is a method for mapping and measuring the relationships and communication patterns between individuals in a network. In criminal investigations, SNA is applied to communication records, social media connections, and financial transaction networks to:
- Identify key actors (central nodes) in a criminal organization — those with the most connections or who broker connections between otherwise separate groups
- Detect communities or clusters of individuals who communicate frequently with each other but rarely outside the cluster
- Trace information flow to determine who directed criminal activity
- Identify intermediaries who link otherwise disconnected individuals
SNA software produces visual graphs showing nodes (individuals) and edges (connections). Metrics like betweenness centrality identify brokers; degree centrality identifies highly connected individuals. The analysis of call records, financial transfers, and social media connections together creates a multi-layer network picture of organized criminal activity.