Glossary of Terms¶

ABO Blood Typing¶

The forensic serological test that determines whether blood or another body fluid belongs to type A, B, AB, or O by detecting the presence or absence of specific antigens on red blood cell surfaces using antibody reactions.

ABO typing can include or exclude suspects and victims, and although it identifies class rather than individual characteristics, it can significantly narrow investigative focus when combined with other evidence.

Example: A bloodstain at a scene is typed as group B; the victim is group O and the suspect is group B, suggesting the stain may have come from the suspect rather than the victim.

Accelerant Pour Patterns¶

Characteristic irregular burn patterns left on floors or surfaces where liquid accelerants were poured, showing low, irregular burn lines that reflect the pooling and spreading behavior of flammable liquids before ignition.

Pour patterns at the origin of a fire indicate deliberate introduction of flammable liquids, providing physical evidence of arson even before chemical testing confirms the presence of accelerants.

Example: An irregular, low-burn pattern on a wood floor that burned along flow lines consistent with poured liquid, combined with a positive GC-MS for gasoline, indicates the use of an accelerant.

Accumulated Degree Days¶

A measure of thermal energy for insect development calculated by summing daily average temperatures above the base (minimum) development temperature for a given insect species, used to predict developmental stage and estimate PMI.

Accumulated degree days allow forensic entomologists to estimate how many days of development have occurred by comparing the thermal energy required to reach the observed developmental stage with weather data.

Example: A species requires 180 degree days to complete larval development; temperature records show an average of 20°C above the 2°C base temperature, meaning approximately 9 days elapsed during development.

Accumulated Degree Hours¶

A measure of thermal energy available for insect development, calculated by summing hourly temperature values above the minimum development threshold (base temperature) for a specific insect species, providing more precise PMI estimates than day-based methods.

Accumulated degree hours offer finer resolution for PMI estimation than degree days, particularly useful in investigations where hourly temperature records are available from nearby weather stations.

Example: Using hourly temperature data and a base temperature of 2°C for the blow fly species present, the entomologist calculates 1,200 accumulated degree hours from egg to the collected larval stage, estimating approximately 5 days since colonization.

Acid Etching Technique¶

A serial number restoration method in which acid is applied to the metal surface where numbers were removed, exploiting the fact that the metal beneath obliterated numbers has different crystalline structure due to prior stamping, making the numbers reappear.

Acid etching works because the deep stress created during number stamping extends below the surface; filing or grinding removes only the stamped surface while leaving enough stressed metal for acid to reveal.

Example: Applying dilute nitric acid to the filed surface of a firearm frame reveals the original serial number within minutes as the stressed metal beneath dissolves at a different rate than surrounding unstressed metal.

Active Decay Stage¶

The decomposition stage in which most soft tissue is lost rapidly due to intense microbial activity and larval feeding, producing large quantities of decomposition fluids that dramatically change the surrounding soil chemistry.

Active decay produces the greatest mass loss in the shortest time; the decomposition fluids that leach into the soil create a cadaver decomposition island (CDI) that persists long after the body is removed.

Example: A body with extensive tissue loss from insect activity and pooled decomposition fluids beneath it is in active decay; soil samples from the cadaver decomposition island contain elevated volatile fatty acids indicative of recent decomposition.

Advanced Decay Stage¶

The stage following active decay in which most soft tissue has been consumed or degraded, leaving primarily dry skin, cartilage, and ligaments, with significantly reduced insect activity as food resources are depleted.

Advanced decay marks the transition from soft tissue to skeletal analysis; forensic anthropologists become more relevant at this stage as skeletal structures become accessible for examination.

Example: Remains in the advanced decay stage show desiccated skin over bones with some cartilage remaining; the reduction of insect activity and remaining soft tissue indicates decomposition began several weeks to months prior.

AFIS Database¶

The Automated Fingerprint Identification System, a computerized database that stores digitized fingerprints and uses algorithms to search for and rank potential matches between unknown latent prints and stored exemplars.

AFIS dramatically accelerates fingerprint comparison by automatically searching millions of records in minutes, allowing investigators to identify suspects from scenes where no known suspect was initially available.

Example: A latent print from a robbery scene is submitted to AFIS; the system returns a candidate list ranked by similarity score, with the actual suspect's record appearing as the top candidate.

Age-at-Death Estimation¶

The forensic anthropological assessment of skeletal indicators to estimate how old an individual was when they died, using different methods for juveniles (dental eruption, epiphyseal fusion) and adults (pubic symphysis, auricular surface).

Age-at-death estimation narrows the pool of potential identities for unknown remains and is a fundamental component of the biological profile used to guide missing persons investigations.

Example: Analysis of pubic symphysis morphology and auricular surface degeneration leads to an adult age estimate of 45–60 years, focusing the investigation on missing persons within that age range.

Agglutination Chemistry¶

The clumping reaction that occurs when specific antibodies bind to their corresponding antigens on red blood cells, forming visible clumps used in ABO and Rh blood typing tests.

Agglutination reactions are the observable results that forensic serologists interpret when performing blood typing, with clumping indicating a positive (antigen present) and no clumping indicating a negative result.

Example: When anti-A antibody is added to a blood sample and causes clumping, the agglutination indicates the presence of A antigens, classifying the sample as blood type A or AB.

Angle of Impact Formula¶

The mathematical calculation used to determine the angle at which a blood drop struck a surface, calculated as the arcsine of the stain's width divided by its length: angle = arcsin(width ÷ length).

The angle of impact is used to trace the three-dimensional origin of blood drops; multiple angle calculations from different stains allow reconstruction of where the source was in space.

Example: A bloodstain measuring 4 mm wide and 8 mm long has a ratio of 0.5; the arcsine of 0.5 is 30°, indicating the drop struck the surface at a 30-degree angle.

Antemortem Trauma¶

Injuries to bones or tissues that occurred before death, showing evidence of biological healing such as bone remodeling, callus formation, or periosteal reaction, indicating the individual survived the injury for some period.

Documenting antemortem trauma can identify characteristic injuries in missing persons records, link remains to a known individual, or reveal a history of repeated injury consistent with abuse.

Example: A healed fracture with a well-formed bone callus on a rib indicates an injury that occurred and began healing weeks to months before the individual died, consistent with a prior trauma record.

Area of Convergence¶

The two-dimensional point or zone on a surface where lines drawn through the long axes of multiple directional bloodstains intersect, indicating the location on that surface directly below or in line with the blood source.

The area of convergence narrows down where the bleeding source was positioned horizontally, serving as the starting point for three-dimensional origin reconstruction using the stringing technique.

Example: Drawing long-axis lines through six oval bloodstains on a floor, investigators find the lines converge at a central point, indicating the blood source was above that spot on the floor.

Area of Origin in 3D Space¶

The three-dimensional point in space from which blood was projected, determined by combining the area of convergence (two-dimensional position) with the calculated angle of impact from individual stains.

Determining the three-dimensional area of origin establishes where a victim was standing, sitting, or lying when blood was shed, which is crucial evidence for or against witness accounts of events.

Example: By combining convergence lines on the floor with the 45-degree impact angles calculated from nearby spatter, investigators determine the blood originated approximately 1.2 meters above the floor.

Arson Investigation¶

The systematic forensic examination of a fire scene to determine the fire's origin and cause, distinguish accidental from incendiary fires, identify accelerants, and gather evidence supporting prosecution of arson.

Arson is both a felony and often a precursor to insurance fraud or murder; forensic arson investigation combines physical scene examination with chemical laboratory analysis to reconstruct how and why a fire started.

Example: An arson investigator identifies the fire's origin in a closet with no electrical wiring or ignition sources, combined with GC-MS detection of gasoline residue, supporting the conclusion of deliberate fire-setting.

Arterial Spurting Pattern¶

Bloodstain patterns created when blood is pumped in rhythmic spurts from a severed or damaged artery, producing wavy or pulsing lines of stains that reflect the heartbeat rhythm of the victim.

Arterial spurting indicates a major vascular injury and, by the spacing and diminishing pattern of spurts, can suggest how much time elapsed between wounding and loss of consciousness.

Example: A wavy pattern of diminishing bloodstains on a wall, spaced approximately 0.8 seconds apart, is consistent with arterial spurting from a severed femoral artery as the victim's heart pumped.

BAC Retro-Extrapolation¶

The forensic calculation used to estimate a person's blood alcohol concentration at an earlier time (such as when driving) based on a known BAC measured later, using the average alcohol elimination rate of 0.015 g/dL per hour.

Retro-extrapolation allows prosecution of impaired drivers even when the blood draw was delayed, though uncertainty increases with time and individual variation in elimination rates must be acknowledged.

Example: A driver's BAC of 0.06 g/dL measured 2 hours after a crash can be retro-extrapolated to approximately 0.09 g/dL at the time of the crash, placing the driver above the legal limit.

Becke Line Test¶

An optical microscopy technique for comparing the refractive index of a glass fragment to that of a known immersion liquid by observing the direction a bright halo (the Becke line) moves when the microscope focus is raised or lowered.

The Becke line test allows forensic scientists to determine whether a glass fragment's refractive index is higher or lower than a reference liquid, guiding selection of matching oils for precise comparison.

Example: When the microscope focus is raised, the Becke line moves into the glass fragment, indicating the glass has a higher refractive index than the immersion liquid being used.

Bifurcations¶

A type of fingerprint minutiae where a single friction ridge splits into two separate ridges, forming a Y-shape; one of the most common and easily recognized individual characteristics used in comparison.

Bifurcations, like ridge endings, are plotted on comparison charts; when the same bifurcations appear at matching locations and angles in two prints, it supports a common source conclusion.

Example: An examiner circles a bifurcation near the core of a latent fingerprint and finds an identical bifurcation at the same position in the suspect's known exemplar print, adding to the points of comparison.

Biohazard Evidence Containers¶

Specially labeled containers meeting safety standards designed to hold blood, body fluids, and other potentially infectious biological evidence, protecting handlers from exposure to pathogens.

Biohazard containers are legally required for biological evidence to protect laboratory personnel and prevent the spread of bloodborne diseases during analysis and storage.

Example: Blood-stained swabs collected at a homicide scene are placed in labeled biohazard tubes and transported in a sealed biohazard bag to the forensic laboratory.

Biological Sex Estimation¶

The forensic anthropological determination of whether skeletal remains are male or female, based on analysis of sexually dimorphic skeletal features primarily in the pelvis and skull, reported with an estimated confidence level.

Sex estimation is a critical first step in creating a biological profile from unidentified remains, as it narrows the population of potential matches by approximately 50% and affects the interpretation of other profile elements.

Example: Based on pelvic and cranial morphology, a forensic anthropologist estimates the remains belong to a female with greater than 95% accuracy, directing investigators to search missing persons records for females.

Bit-Stream Copy¶

An exact, complete duplicate of every bit of data on a storage device, including file system structures, deleted data, unallocated space, and slack space, produced during forensic imaging as opposed to a simple file copy.

A bit-stream copy captures all forensically relevant data that a standard file copy would miss, ensuring no evidence is overlooked and the forensic image is a complete representation of the original device.

Example: Unlike a regular backup that copies only active files, a bit-stream forensic image captures deleted photographs in unallocated space and partial files in slack space, recovering evidence that would otherwise be missed.

A type of signature or writing forgery produced without sight of the genuine specimen, relying entirely on the forger's memory of what the genuine writing looks like, typically producing a crude or stylistically inconsistent result.

Blind forgeries tend to be the easiest to detect because the forger cannot replicate specific details of genuine writing they cannot see, resulting in inconsistencies in letter forms and proportions.

Example: A blind forgery of a check signature lacks the distinctive connected "th" ligature in the genuine signature, an inconsistency that reveals the forgery to a document examiner comparing it to authenticated checks.

Bloat Stage of Decomposition¶

The decomposition stage in which anaerobic bacteria produce gases (hydrogen sulfide, methane, carbon dioxide) that accumulate within body cavities, causing visible inflation of the abdomen and skin marbling or blistering.

The bloat stage is characterized by strong odors from hydrogen sulfide and other gases, attracting additional insects and scavengers; the timing of bloat depends heavily on environmental temperature.

Example: A body found in a warm outdoor setting with a distended abdomen, gas-filled blisters, and greenish skin discoloration is in the bloat stage, suggesting death occurred approximately 3–5 days earlier under summer conditions.

Blood Alcohol Concentration¶

The amount of alcohol present in a person's bloodstream, expressed as grams of alcohol per 100 mL of blood (g/dL) or grams per 210 liters of breath, used as the legal measure of alcohol impairment.

BAC is the forensic standard for determining alcohol impairment in driving cases, with legal per se limits of 0.08 g/dL in most U.S. states defining the criminal threshold for driving while intoxicated.

Example: A blood draw collected 1 hour after a traffic stop shows a BAC of 0.14 g/dL, nearly twice the legal limit of 0.08 g/dL, supporting charges of driving while intoxicated.

Blood Cohesion¶

The tendency of blood molecules to stick to one another due to intermolecular forces, allowing blood to flow as a coherent mass and influencing how blood droplets behave during flight and upon impact.

Blood cohesion contributes to the formation of distinct, bounded bloodstains and affects how blood transfers from a source to a target surface, informing stain pattern interpretation.

Example: Blood cohesion causes droplets to remain intact during flight rather than dispersing as mist, producing discrete individual stains whose characteristics reveal information about their source.

Blood Composition¶

The complex fluid that circulates through the body, consisting of plasma (the liquid component), red blood cells (erythrocytes), white blood cells (leukocytes), and platelets, each serving specific physiological roles.

Understanding blood composition is essential for forensic serology because different components can be used for different tests, such as using red blood cells for ABO typing and DNA for genetic profiling.

Example: A blood sample at a crime scene is analyzed for ABO type using red blood cells, while white blood cells provide the nuclear DNA used for STR profiling.

Blood Drop Physics¶

The study of how blood behaves as it falls, travels through the air, and strikes a surface, governed by the physical properties of the blood itself (surface tension, viscosity, density) and the forces acting on it.

Understanding blood drop physics allows investigators to calculate the height, angle, and velocity of blood when it left the source, enabling reconstruction of events at crime scenes.

Example: A blood drop falling vertically from a stationary wound produces a circular stain; the diameter of the stain, combined with known physics, allows estimation of the height from which it fell.

Blood Viscosity¶

The resistance of blood to flow, influenced by its concentration of red blood cells (hematocrit) and plasma proteins, which affects the speed at which blood drips, flows, and creates patterns at crime scenes.

Changes in blood viscosity (such as from dehydration or anemia) can alter stain appearance, so understanding viscosity helps analysts accurately interpret bloodstain patterns and avoids misinterpretation.

Example: Highly viscous blood drips more slowly and may form rounder, less-splattered stains than diluted blood, a difference analysts consider when interpreting stain size and satellite patterns.

Blowfly Lifecycle¶

The complete metamorphosis of blowflies (Order Diptera, Family Calliphoridae) through four stages — egg, larva (three instars), pupa, and adult — with the duration of each stage dependent on temperature and used in PMI estimation.

The blowfly lifecycle provides the primary biological clock for estimating time since death; forensic entomologists use known development rates to back-calculate when eggs were first laid on a body.

Example: Larvae collected from a body are identified as second-instar blowfly larvae; knowing the development time from egg to second instar at the recorded ambient temperature, an entomologist estimates minimum PMI.

Blowfly Pupa Stage¶

The non-feeding developmental stage during which the blowfly larva contracts within its hardened puparium and undergoes metamorphosis into an adult fly; pupal cases may persist at a scene long after the adult emerges.

Empty pupal cases (puparia) found at a scene indicate that at least one full fly generation has completed, allowing entomologists to set a minimum time since colonization even in the absence of larvae or adults.

Example: Empty puparia found beneath skeletal remains indicate the first blowfly generation has fully developed; using the total development time from egg to adult emergence at recorded temperatures, the entomologist estimates minimum PMI in weeks.

Bone Trauma Differentiation¶

The forensic process of distinguishing among antemortem, perimortem, and postmortem injuries in skeletal remains by examining fracture pattern characteristics, bone color, evidence of healing, and contextual information.

Accurate trauma differentiation prevents false conclusions about cause of death and helps investigators focus on perimortem injuries as most relevant to determining manner of death.

Example: A forensic anthropologist examines multiple rib fractures and distinguishes healed antemortem injuries with bone callus from fresh perimortem blunt force fractures and postmortem dry-bone breaks from burial.

Breech Face Markings¶

The microscopic surface texture of the breech face of a firearm (the metal surface behind the chamber) that is impressed onto the cartridge case head during firing, providing individual marks unique to that specific firearm.

Breech face markings are transferred to fired cartridge cases, allowing firearms examiners to compare cases recovered from a scene to test fires from a suspect's weapon to determine if they were fired by the same gun.

Example: The striated breech face marks impressed on a cartridge case from the crime scene are compared under a comparison microscope to marks on a test-fire case; matching striations link both cases to the suspect's pistol.

Bullet Trajectory Calculation¶

The mathematical determination of the path a bullet traveled from the firearm to the target, using the positions of entry holes, exit holes, rod or laser alignment, and external ballistics to establish the shooter's position.

Bullet trajectory reconstruction can corroborate or contradict witness accounts, confirm suicide versus homicide in gunshot cases, and identify the firing location to focus the investigation.

Example: Inserting a trajectory rod through aligned bullet holes in a car door and windshield and extending the line backward places the shooter at a position consistent with the suspect's described location.

Burn Testing of Fibers¶

A simple screening test in which a small fiber sample is exposed to a flame to observe its burn behavior, odor, and ash characteristics, helping identify its chemical composition as natural, protein, or synthetic.

Burn testing is a rapid, low-cost preliminary test that can guide further chemical analysis, though it only identifies broad fiber categories and is not sufficient for courtroom identification alone.

Example: A fiber that melts into a hard bead, shrinks from flame, and smells like burning plastic is identified as synthetic (likely polyester or nylon) rather than natural cotton or wool.

Calliphoridae Family¶

The taxonomic family of blow flies, including species such as Lucilia sericata (green bottle fly) and Calliphora vicina (blue bottle fly), which are among the first insects to colonize a body after death and are primary indicators for PMI estimation.

Calliphoridae species are the most forensically important insects because they arrive within minutes to hours of death, are well-studied in terms of development rates, and provide the most accurate PMI estimates.

Example: Adult Lucilia sericata are observed flying around a body and eggs are found in natural orifices; the species identification combined with developmental data provides a minimum PMI estimate.

Capillary Electrophoresis¶

An analytical technique used in forensic DNA profiling in which fluorescently labeled PCR products are injected into a narrow capillary filled with polymer gel and separated by size as an electric field pulls them through the matrix.

Capillary electrophoresis separates STR alleles by the number of repeat units (size) with high resolution, generating peaks on an electropherogram that identify which alleles are present at each locus.

Example: After PCR amplification of a crime scene sample, the labeled STR products are injected into a capillary electrophoresis instrument; smaller alleles migrate faster and appear as earlier peaks on the electropherogram.

Carbon Monoxide Poisoning¶

Toxicity caused by carbon monoxide gas binding to hemoglobin with 250 times greater affinity than oxygen, forming carboxyhemoglobin that cannot carry oxygen, causing hypoxia and death at high concentrations.

Carbon monoxide poisoning must be distinguished from natural disease in fire deaths; carboxyhemoglobin saturation levels are measured at autopsy to determine whether a fire victim was alive when the fire began.

Example: A fire victim with carboxyhemoglobin saturation above 50% was breathing during the fire; a victim with near-zero carboxyhemoglobin was likely dead before the fire started, suggesting homicide concealed as arson.

Cast-Off Bloodstains¶

Linear or arc-shaped patterns of bloodstains created when blood is flung from a moving, bloody object — such as a weapon or bloody limb — during a backswing or forward swing.

Cast-off patterns indicate the number of blows struck (often one arc per swing after the first blood-saturating blow), the arc of the weapon's swing, and the general height and position of the assailant.

Example: An arc of medium-sized blood spatter on the ceiling above a victim is a cast-off pattern from a bloody weapon being swung overhead, suggesting at least two forceful blows were delivered.

Chain of Custody¶

The documented, chronological record showing who collected, handled, transferred, analyzed, and stored a piece of evidence from the crime scene to the courtroom, ensuring its integrity and authenticity.

A broken chain of custody can make evidence inadmissible or allow defense attorneys to argue that evidence was tampered with or contaminated, potentially destroying a prosecution.

Example: Every person who handles a blood sample must sign and date a custody log; if a sample cannot be accounted for over a 48-hour period, its integrity is compromised.

Chemical Solubility Testing¶

A method of fiber identification in which samples are treated with specific solvents or chemical reagents to determine whether they dissolve, swell, or remain unaffected, indicating their polymer composition.

Chemical solubility tests provide class-level identification of fiber type that can guide more specific instrumental analysis and help differentiate synthetics that look similar under a microscope.

Example: An unknown fiber dissolves in acetone, which is consistent with acetate fiber and inconsistent with nylon, helping narrow the fiber's identity before infrared spectroscopy is performed.

Class Evidence Concept¶

The principle that some evidence can identify the general group or category from which it came but cannot be uniquely linked to a single source, providing investigative value without establishing individual identity.

Class evidence, such as fiber type or paint color, is valuable for corroboration and narrowing suspects but must be combined with other evidence because it cannot alone prove a specific individual's involvement.

Example: Blue denim fibers at a crime scene are class evidence — they indicate the offender likely wore denim jeans, narrowing the field, but cannot identify which specific pair of jeans.

CODIS Loci¶

The Combined DNA Index System's set of standardized STR loci (currently 20 core loci in the United States) used by all accredited forensic laboratories, enabling direct comparison of DNA profiles between state and national databases.

Standardized CODIS loci allow DNA profiles generated in any participating laboratory to be compared with profiles in national databases, enabling identification of suspects whose DNA is already on file.

Example: A rape kit swab is processed and the resulting 20-locus CODIS profile is uploaded to the national database, where it matches a convicted offender whose profile was entered after a previous assault.

Combustion Chemistry¶

The chemical reactions that occur during burning, involving rapid oxidation of fuel molecules that releases heat, light, carbon dioxide, water vapor, and partially oxidized combustion products at various temperatures.

Understanding combustion chemistry helps forensic investigators interpret burn patterns, identify accelerants by their combustion residues, and reconstruct fire behavior at an arson scene.

Example: Gasoline combustion leaves behind partially burned hydrocarbons that are detectable by GC-MS in fire debris, providing chemical evidence that a liquid accelerant was used to start the fire.

Comparison Microscope¶

A specialized microscope consisting of two separate microscope stages connected by an optical bridge, allowing a forensic examiner to view two samples simultaneously side by side for direct visual comparison.

The comparison microscope is the primary instrument used in firearms and toolmark examination, allowing examiners to directly compare striation patterns on bullets, cases, and toolmarks from evidence and test fires.

Example: A firearms examiner places an evidence bullet from the crime scene on one stage and a test-fire bullet from the suspect's gun on the other, simultaneously viewing both under the comparison microscope to assess striation correspondence.

Compression Marks¶

Toolmarks produced when a tool surface is pressed against a material under sufficient force to leave an impression, such as when a screwdriver tip is pressed into soft metal or a hammer strikes a surface.

Compression marks preserve the three-dimensional surface features of the tool face, allowing examiners to compare the mark's shape and texture to a suspect's tool to determine class or individual correspondence.

Example: A compression mark on a door frame made by a pry bar preserves a surface defect on the bar's tip; comparison to a confiscated pry bar reveals a matching defect, linking that tool to the forced entry.

Concentric Fracture Lines¶

Curved or circular cracks in glass that form after radial fractures and connect them in arc-shaped patterns around the point of impact, like rings on a target.

Concentric fractures form after radial fractures, establishing a fracture sequence that investigators can use to determine the order in which multiple impacts occurred.

Example: When a window was struck twice, the first set of concentric fractures stops at the radial fractures from the first impact, and the second set stops at the first impact's pattern, revealing which impact occurred first.

Confirmatory Blood Tests¶

Laboratory tests that definitively identify a substance as blood by specifically detecting hemoglobin or its derivatives, used to confirm positive presumptive test results before drawing conclusions.

Confirmatory tests eliminate false positives and provide legally defensible evidence that a substance is human blood, a necessary step before that evidence is presented in court.

Example: After a positive luminol result, a forensic serologist performs a Takayama crystal test, observing characteristic hemochromogen crystals under a microscope to confirm the presence of blood.

Controlled Substances Act¶

The U.S. federal law that classifies regulated drugs into five schedules based on their accepted medical use, potential for abuse, and likelihood of dependence, establishing the legal framework for drug prosecution.

The Controlled Substances Act determines what constitutes a drug crime and which substances forensic toxicologists must identify and quantify to support drug possession, distribution, and impairment prosecutions.

Example: When a forensic chemist confirms that a seized white powder is methamphetamine, that identification triggers prosecution under the Controlled Substances Act because meth is a Schedule II substance.

Counterfeit Detection¶

The forensic examination of currency, documents, or goods to determine whether they are genuine or fraudulently reproduced, using visual, optical, chemical, and instrumental analysis to identify the absence of security features.

Counterfeit detection protects the integrity of financial systems and legal documents; forensic document examiners use a battery of tests to identify reproduction methods and specific missing security features in suspected fakes.

Example: Examination of a suspected counterfeit banknote under ultraviolet light reveals the absence of genuine security fibers that fluoresce in authentic currency, confirming the note is counterfeit.

Cranial Feature Analysis¶

The assessment of specific skull traits — including brow ridge (supraorbital torus) size, mastoid process development, nuchal crest prominence, and overall robusticity — to estimate biological sex and contribute to ancestry assessment.

Cranial features provide a secondary source of sex and ancestry information when the pelvis is absent or damaged; multiple traits are scored together for an overall assessment rather than relying on any single feature.

Example: A skull with a prominent brow ridge, large mastoid processes, and a well-developed nuchal crest is scored as masculine, contributing to a male sex estimate for an unidentified individual.

Cranial Suture Closure¶

The gradual obliteration of the fibrous joints (sutures) between skull bones that begins in early adulthood and progresses with age, used as an indicator of skeletal age in adult remains where growth has ceased.

Cranial suture closure provides an age estimate in adults when epiphyseal fusion is complete and other juvenile age indicators are unavailable, though it has greater variability than growth-based aging methods.

Example: Partial to moderate closure of the coronal and sagittal sutures leads a forensic anthropologist to estimate an adult age range of 35–55 years for unidentified remains.

Crime Scene Documentation¶

The comprehensive recording of a crime scene through photographs, sketches, measurements, and written notes before any evidence is moved or collected, creating a permanent record of the scene's original state.

Thorough documentation allows investigators, attorneys, and juries to reconstruct the scene's appearance long after it has been cleared, supporting accurate testimony and analysis.

Example: A crime scene technician photographs all evidence in place, creates a scaled sketch with measurements, and writes detailed notes before collecting a single item.

Crime Scene Perimeter Security¶

The establishment of controlled boundaries around a crime scene using barriers such as tape or cones to prevent unauthorized access, contamination, and destruction of evidence.

Proper perimeter security preserves the integrity of the scene and ensures that only authorized personnel who have been briefed on protocols enter the evidence-rich area.

Example: Officers use yellow crime scene tape to establish an inner perimeter around the body and an outer perimeter to keep media and bystanders at a distance.

Crime Scene Photography¶

The systematic use of photographs to record a crime scene from general overview to medium-range context to close-up detail, creating a visual record that supports all subsequent analysis and testimony.

Photographs provide a permanent, objective visual record that can be used to refresh witness memory, support expert testimony, and allow jurors to visualize the scene.

Example: A photographer takes wide shots of an entire room, mid-range shots showing a bloody knife near the door, and close-up shots with a scale ruler next to the knife.

Crime Scene Sketching¶

The creation of a measured, two-dimensional drawing of the crime scene that records the location and spatial relationships of evidence, structures, and other relevant features using consistent scale and notation.

Sketches complement photographs by showing exact measurements and spatial relationships that photographs can distort, providing a precise reference for court testimony.

Example: A sketch of a bedroom shows the exact distance (in meters) between the door, the victim's body, and a spent cartridge casing, establishing a precise spatial record.

Criminal Justice Structure¶

The interconnected system of law enforcement agencies, courts, and correctional institutions that investigate crimes, determine guilt or innocence, and administer punishment or rehabilitation.

Forensic scientists interact with every level of the criminal justice structure, from providing evidence to investigators, to testifying in court, to informing policy on evidence standards.

Example: A forensic toxicologist works with police detectives, reports findings to prosecutors, testifies before a judge and jury, and their results ultimately affect sentencing decisions.

Criminal Law vs Civil Law¶

The distinction between criminal law, in which the government prosecutes offenses against society and may impose imprisonment, and civil law, in which private parties seek remedies such as monetary damages for disputes.

Forensic science is used in both contexts: criminal cases may use DNA to prove guilt, while civil cases might use handwriting analysis to verify a signature on a contested contract.

Example: The same incident of assault may result in criminal charges prosecuted by the state and a separate civil lawsuit filed by the victim seeking compensation for injuries.

Criminal vs Civil Standards¶

The different burdens of proof required in criminal cases (beyond a reasonable doubt) versus civil cases (preponderance of the evidence, meaning more likely than not), affecting how forensic evidence is evaluated.

Forensic evidence that is insufficient to convict in a criminal case might still be persuasive enough to win a civil judgment, as the evidentiary threshold is lower.

Example: O.J. Simpson was acquitted in his criminal murder trial but was found liable in a civil wrongful death suit based on the same forensic and circumstantial evidence.

Currency Security Features¶

The anti-counterfeiting measures incorporated into genuine banknotes, including security threads, watermarks, color-shifting inks, microprinting, intaglio printing, and serial numbers, each designed to be difficult to reproduce.

Forensic document examiners test for the presence and authenticity of security features because counterfeiters often fail to replicate all of them accurately, revealing the forgery through systematic examination.

Example: A suspected counterfeit $100 bill lacks the genuine security thread visible as a vertical stripe in authentic notes when held to light, confirming it is counterfeit.

Cyanide Poisoning¶

Toxicity resulting from exposure to cyanide compounds that block cellular respiration by inhibiting cytochrome c oxidase in mitochondria, preventing cells from using oxygen and causing rapid cellular asphyxiation.

Forensic detection of cyanide poisoning requires specific chemical tests and GC-MS analysis of blood, as cyanide can degrade rapidly post-mortem, requiring prompt sample collection and proper storage.

Example: At autopsy, a bright cherry-red blood color, the smell of bitter almonds, and elevated blood cyanide levels measured by GC-MS confirm cyanide poisoning as the cause of death.

Cyanoacrylate Fuming¶

A latent fingerprint development technique in which super glue (cyanoacrylate) vapors are released in a sealed chamber, reacting with the amino acids, fatty acids, and water in the fingerprint residue to form a white polymer deposit visible on the ridges.

Cyanoacrylate fuming is especially effective on non-porous surfaces such as plastic bags, glass, and metals, and produces durable, three-dimensional ridge detail that can be further enhanced with dyes.

Example: Investigators place a plastic evidence bag in a fuming chamber with super glue; after 30 minutes, white ridge detail appears on the bag's surface, revealing a latent fingerprint.

Dactyloscopy¶

The scientific study and classification of fingerprints, including their patterns, ridge characteristics, and use as a means of individual identification in criminal investigations and law enforcement databases.

Dactyloscopy is one of the oldest and most widely used forensic identification methods, with a proven record of accurately linking individuals to crime scenes through their unique friction ridge patterns.

Example: A dactyloscopy expert examines a latent fingerprint lifted from a murder weapon and compares it to prints in the AFIS database to identify a suspect.

Dark Web Evidence¶

Digital evidence obtained from the portion of the internet accessible only through anonymizing software such as Tor, which hosts criminal markets, forums, and communications that require specialized forensic techniques to investigate.

Dark web evidence collection requires both technical expertise and careful legal procedure; investigators must document the investigative steps taken to access evidence and ensure constitutional standards are met during collection.

Example: An undercover investigator with proper legal authority purchases a controlled substance on a dark web market and documents the transaction; the digital evidence — wallet addresses, communications, and shipping records — supports prosecution.

Daubert Standard¶

A legal standard established by the U.S. Supreme Court in 1993 requiring federal judges to evaluate whether scientific testimony is based on sufficient facts, reliable methodology, and properly applied principles before admitting it as evidence.

The Daubert standard acts as a gatekeeper, ensuring that only scientifically sound forensic methods are presented to juries, preventing unreliable or pseudoscientific evidence from influencing verdicts.

Example: A judge applies the Daubert standard to determine whether bite-mark analysis testimony meets the threshold of scientific reliability before allowing it in a murder trial.

Dermal Papillae¶

Microscopic projections of the dermis that push upward into the overlying epidermis of friction ridge skin, forming the rows of ridges visible as fingerprints and determining the ridge pattern.

Dermal papillae are established before birth and remain stable throughout life (except through injury), explaining why fingerprints are permanent and consistent identifiers.

Example: During fetal development, dermal papillae arrange themselves into the unique ridge patterns that become an individual's lifelong fingerprint, formed by genetic and environmental factors in the womb.

Digital Forensics Overview¶

The branch of forensic science concerned with the identification, preservation, extraction, analysis, and reporting of digital evidence from computers, mobile devices, networks, and other electronic media for use in legal proceedings.

Digital forensics has become essential to modern investigations because electronic devices store vast amounts of information about individuals' activities, communications, locations, and intentions.

Example: Digital forensic investigators examine a suspect's laptop, recovering deleted files, web browsing history, email communications, and document metadata that together establish the suspect's involvement in financial fraud.

Digital Timestamp Analysis¶

The forensic examination of date and time information embedded in file metadata, logs, and system records to establish when digital activities occurred, supporting or refuting timeline claims.

Digital timestamp analysis creates a chronological reconstruction of events based on objective electronic records, which can corroborate witness accounts or reveal inconsistencies in a suspect's claimed alibi.

Example: System log timestamps show a suspect's computer accessed a specific online account at 11:47 PM on the night of the crime, contradicting the suspect's claim of being asleep by 10:00 PM.

DNA Alleles¶

The specific variant forms of an STR locus, defined by the number of tandem repeat units present; each person inherits one allele from each parent, so a diploid individual has two alleles at each autosomal STR locus.

Allele combinations at multiple STR loci create the unique numeric DNA profile used for forensic comparison, with the probability of a random match decreasing with each additional locus compared.

Example: At the vWA locus, one person has alleles 17 and 20 (one from each parent); a crime scene stain showing alleles 17 and 20 at this locus is consistent with that individual's profile.

DNA Annealing¶

The second step of each PCR cycle in which the reaction is cooled to 50–65°C, allowing the short primer sequences to bind (anneal) to their complementary sequences on the single-stranded DNA templates.

Annealing temperature must be optimized for each primer pair; too high and primers won't bind, too low and non-specific binding occurs, both of which reduce the accuracy of forensic DNA profiling.

Example: After denaturation, the thermocycler cools to 58°C, allowing the forensic STR primers to bind specifically to their target sequences on the single-stranded DNA template.

DNA Database Searching¶

The process of submitting a DNA profile generated from crime scene evidence to a local, state, or national database (such as CODIS) to search for a matching profile from a known individual or previous crime scene.

Database searching allows investigators to identify suspects without any prior leads and to link unsolved crimes committed by the same unknown individual, significantly expanding the investigative power of DNA evidence.

Example: A DNA profile from an unsolved burglary is searched against CODIS; the system returns a match to a convicted offender who was incarcerated at the time of the burglary, which refocuses the investigation.

DNA Denaturation¶

The first step of each PCR cycle in which the reaction is heated to approximately 94–96°C, breaking the hydrogen bonds between the two complementary DNA strands and separating them into single strands available for copying.

Denaturation is essential because DNA polymerase can only add nucleotides to single-stranded templates; without denaturation, the double helix remains intact and cannot be copied.

Example: During each PCR cycle, the thermocycler heats to 95°C for 30 seconds, denaturing the DNA double helix into two separate single strands ready to serve as templates.

DNA Extension¶

The third step of each PCR cycle in which DNA polymerase (typically Taq polymerase) extends from the bound primers at 72°C, synthesizing new complementary DNA strands by adding nucleotides to create a copy of the target region.

Extension is where the actual DNA copying occurs; the efficiency of extension determines how many copies are produced per cycle, with 30 cycles theoretically producing over a billion copies from a single starting molecule.

Example: After annealing, the thermocycler raises temperature to 72°C and Taq polymerase extends from the primers, synthesizing a new DNA strand complementary to the STR-containing template region.

DNA Structure Review¶

The double-helix structure of deoxyribonucleic acid, composed of two complementary strands of nucleotide bases (adenine, thymine, guanine, cytosine) bonded together and wound around each other, encoding genetic information.

Understanding DNA structure is foundational to forensic DNA analysis because the specific sequence of bases is unique to each individual (except identical twins), making DNA the most powerful identification tool available.

Example: A forensic scientist understands that the two strands of DNA are complementary — every A pairs with T and every G pairs with C — when designing PCR primers to amplify specific STR loci.

Drug Absorption¶

The process by which a drug enters the bloodstream from its site of administration, with the rate and completeness depending on the route (oral, intravenous, inhalation, transdermal) and the drug's chemical properties.

Absorption rate affects how quickly a drug reaches peak blood concentration and begins producing effects, information that is forensically relevant for determining when a drug was taken relative to an event.

Example: Intravenous heroin is absorbed immediately into the bloodstream, reaching peak effect within minutes; oral codeine takes 30–60 minutes to absorb, a difference that affects toxicological interpretation of timing.

Drug Distribution¶

The process by which an absorbed drug moves from the blood into tissues and organs throughout the body, governed by the drug's solubility, protein binding, and affinity for specific tissues such as fat or brain.

Distribution affects which tissues a drug concentrates in, informing forensic toxicologists about appropriate sample collection and which matrix (blood, liver, brain, fat) will give the most meaningful concentration data.

Example: THC from cannabis is highly fat-soluble and distributes extensively into fatty tissues; residual THC can be detected in fat and blood for days to weeks after last use, complicating impairment assessment.

Drug Elimination¶

The process by which the body removes drugs and their metabolites, primarily through kidney excretion in urine, with the rate described by the elimination half-life (the time for blood concentration to decrease by half).

Knowing elimination half-lives helps forensic toxicologists determine whether a drug would still have been at impairing concentrations at the time of an incident, even if the sample was collected hours later.

Example: Alcohol has an average elimination half-life of about 1 hour at 0.015 g/dL per hour; a toxicologist uses this rate to estimate BAC at the time of a crash from a blood sample drawn 3 hours later.

Drug Metabolism¶

The biochemical transformation of a drug, primarily in the liver, into metabolites that may be more or less pharmacologically active and more water-soluble for elimination, generating characteristic compounds detectable in toxicological analysis.

Identifying drug metabolites allows forensic toxicologists to confirm that a substance was ingested (not just present as a contaminant) and to estimate timing of use relative to sample collection.

Example: Cocaine is rapidly metabolized to benzoylecgonine; detecting benzoylecgonine in urine confirms cocaine was used even after the parent drug has disappeared, indicating use within the past 2–4 days.

Drug Schedule Classifications¶

The five categories (Schedule I–V) under the Controlled Substances Act that classify substances by decreasing abuse potential and increasing accepted medical use, from Schedule I (highest abuse, no accepted use) to Schedule V (lowest abuse).

Schedule classification determines the severity of criminal penalties when a controlled substance is identified, so accurate forensic identification is essential for the appropriate application of drug laws.

Example: Heroin is Schedule I (high abuse potential, no accepted medical use); the forensic confirmation that a seized substance is heroin carries more severe legal consequences than identification of a Schedule IV drug.

Druggist Fold Technique¶

A paper-folding method used to securely contain loose trace evidence such as hair, fibers, or soil within a piece of paper, creating a sealed packet that prevents loss of material during storage and transport.

The druggist fold creates a simple, effective, low-contamination container for trace evidence when a pre-made envelope might allow tiny particles to escape through its seams.

Example: A technician collects loose hairs from a victim's clothing by brushing them onto white paper, then creates a druggist fold to contain the hairs securely before placing the paper packet in an envelope.

Dry Remains Stage¶

The final decomposition stage in which only bone, dried skin, hair, and other resistant tissues remain, with no significant ongoing biological breakdown; bones may bleach and begin to weather if exposed to the elements.

The dry remains stage can persist for years or centuries; forensic anthropologists analyze skeletal material at this stage to extract biological profile information and evidence of trauma.

Example: Scattered, bleached bones with weathered surfaces at a scene indicate the individual has been dead for many months to years, with decomposition complete; analysis shifts entirely to forensic anthropology methods.

Duquenois-Levine Test¶

A presumptive colorimetric test for cannabis (marijuana) in which a series of reagents produces a purple-violet color in the presence of THC and related cannabinoids, and a color that transfers to chloroform in the final step.

The Duquenois-Levine test is widely accepted as a presumptive screening test for cannabis in forensic laboratories and field settings, though it requires GC-MS or other instrumental confirmation.

Example: A forensic chemist applies the Duquenois-Levine test to green plant material; the purple color transfer to the chloroform layer gives a presumptive positive for cannabis, supporting subsequent GC-MS analysis.

Ejector Marks¶

Toolmarks left on cartridge cases by the ejector mechanism of a semi-automatic firearm as the spent case is extracted from the chamber and expelled; these marks are unique to the specific ejector and can link cases to a firearm.

Ejector marks, combined with extractor marks and breech face impressions, create a package of individual toolmarks on fired cartridge cases that collectively allow confident linkage to a specific firearm.

Example: A striated scratch pattern from the ejector is visible on the rim of a cartridge case; comparison to test fires from a seized pistol shows the same ejector pattern, corroborating that the gun fired the recovered case.

Electropherogram Interpretation¶

The analysis of the graphical output produced by capillary electrophoresis, in which peaks at specific size positions represent alleles at STR loci, and peak heights reflect the amount of DNA amplified.

Interpreting electropherograms requires trained analysts who can identify true allele peaks, distinguish artifacts (pull-up, stutter, off-ladder alleles), and call a profile accurately for database comparison.

Example: An analyst reads an electropherogram and identifies two peaks at the D3S1358 locus at positions corresponding to alleles 15 and 18, recording that locus as 15,18 in the DNA profile.

Encryption in Digital Forensics¶

The use of algorithms to transform data into an unreadable format requiring a key for decryption; from a forensic perspective, encryption poses challenges to evidence access and requires legal tools such as court orders to compel key disclosure.

Encryption can obstruct forensic investigations by making seized data unreadable; forensic examiners use technical methods (key recovery from RAM, dictionary attacks on weak passwords) and legal compulsion to access encrypted evidence.

Example: A seized laptop's hard drive is fully encrypted; forensic examiners successfully capture the encryption key from the computer's RAM before shutdown, allowing decryption and examination of the encrypted files.

Entrance vs Exit Wounds¶

The distinction between the wound where a bullet enters the body (typically smaller, with inverted edges and an abrasion collar) and where it exits (typically larger, irregular, and lacking an abrasion collar).

Correctly identifying entrance and exit wounds establishes the direction of fire, helping forensic pathologists and investigators determine the shooter's position relative to the victim.

Example: A pathologist identifies a small, round wound with an abrasion collar on the back as an entrance wound and a larger, irregular wound on the chest as an exit wound, indicating the victim was shot from behind.

Environmental Variables in PMI¶

The physical and biological factors — including temperature, humidity, sunlight exposure, presence of clothing, insect access, and whether the body was buried or submerged — that influence the rate of decomposition and insect colonization.

Environmental variables must be documented and incorporated into PMI calculations because the same body will decompose at dramatically different rates under different conditions, affecting the accuracy of time-of-death estimates.

Example: A body found indoors in an air-conditioned room decomposes much more slowly than one exposed outdoors in summer heat; the indoor temperature history is used to calibrate insect development rates for PMI estimation.

Epiphyseal Fusion¶

The developmental process by which the cartilaginous growth plates (epiphyses) at the ends of long bones gradually ossify and fuse to the bone shaft during adolescence and young adulthood, with fusion timing used for age estimation.

Epiphyseal fusion follows a predictable developmental sequence with known age ranges, allowing forensic anthropologists to estimate age in subadults and young adults from the fusion status of specific bones.

Example: Complete fusion of the medial clavicle epiphysis, which typically completes between ages 22–30, allows a forensic anthropologist to estimate the remains belong to someone older than 22.

Erythrocytes¶

Red blood cells that contain hemoglobin for oxygen transport and lack a nucleus in their mature form, making up the majority of blood cells and giving blood its red color; used in ABO blood group typing.

The absence of a nucleus in mature erythrocytes means they do not contain nuclear DNA for profiling, but they do carry ABO antigens on their surface that can be typed from bloodstains.

Example: A forensic serologist uses erythrocytes in a crime scene bloodstain to perform ABO typing using antibody agglutination, helping to compare the stain's blood group to the victim's known blood type.

Evidence Admissibility¶

The legal standard determining whether evidence may be presented in court, based on criteria including relevance, reliability, proper collection procedures, and compliance with constitutional protections.

If evidence is deemed inadmissible, it cannot be shown to the jury, which can significantly affect the outcome of a trial even when that evidence strongly implicates a suspect.

Example: A judge rules fingerprint evidence inadmissible because officers collected it without a warrant and no valid exception applied, excluding it from the trial.

Evidence Collection Protocols¶

Standardized procedures governing how different types of evidence are physically gathered at a crime scene, specifying the appropriate tools, containers, and handling methods for each evidence type.

Following proper protocols prevents contamination, degradation, and cross-contamination of evidence, ensuring samples are in the best possible condition for laboratory analysis.

Example: Biological evidence such as blood swabs is collected with sterile cotton swabs, placed in paper (not plastic) bags to prevent moisture buildup and bacterial degradation.

Evidence Identification¶

The process of recognizing, marking, and cataloging items at a crime scene that may be relevant to the investigation, using numbered placards or flags so each item can be photographed and logged before collection.

Proper identification ensures each piece of evidence is individually tracked and linked to its exact location in documentation, maintaining scene integrity and legal admissibility.

Example: A technician places numbered yellow evidence markers next to each item of interest — a shoe print, a glass fragment, a cigarette butt — before photographing the entire scene.

Evidence Packaging Materials¶

The containers and wrapping materials used to store and transport collected evidence, chosen to protect evidence from contamination, moisture, static electricity, or physical damage during transport to the laboratory.

Using appropriate packaging materials preserves evidence integrity; for example, paper bags allow biological evidence to breathe and prevent mold, while plastic bags trap moisture and degrade DNA.

Example: A bloody garment is packaged in a brown paper bag rather than a plastic bag because paper allows air circulation that prevents bacterial overgrowth and DNA degradation.

Evidence Search Patterns¶

Systematic methods for physically searching a crime scene area to ensure complete coverage and minimize the chance of missing evidence, with the pattern chosen based on scene size and shape.

Organized search patterns ensure that no area goes unsearched and provide documentation that a thorough search was conducted, strengthening the chain of evidence.

Example: Investigators choose a grid search pattern for a large outdoor field to ensure every square meter of ground is visually inspected for trace evidence.

EXIF Metadata Recovery¶

The extraction and analysis of Exchangeable Image File Format data embedded in digital photographs, which records information about the camera, settings, date and time, GPS coordinates, and software used when the image was created.

EXIF metadata can place a device and its owner at a specific location and time, corroborating or contradicting alibis, and can link a specific camera to images found on a suspect's device.

Example: EXIF metadata extracted from crime scene photographs found on a suspect's phone reveals GPS coordinates matching the crime scene location and a timestamp consistent with the estimated time of the offense.

Expert Witness Ethics¶

The professional obligations governing forensic expert witnesses, including honesty, objectivity, reporting findings accurately regardless of which side retained them, and avoiding overstating the significance of evidence.

Ethical violations by expert witnesses can lead to wrongful convictions or acquittals, making integrity and impartiality essential to the justice system.

Example: A forensic DNA analyst must report both inclusions and exclusions accurately, even if the results do not support the case theory of the attorney who hired them.

Expert Witness Role¶

A court-recognized specialist who possesses knowledge, skill, experience, or education beyond that of an average person, permitted to offer opinion testimony to help the judge or jury understand complex technical evidence.

Expert witnesses translate complex forensic findings into language that non-scientists on a jury can understand, directly influencing the outcome of criminal and civil cases.

Example: A forensic pathologist serves as an expert witness to explain cause of death findings from an autopsy, helping the jury understand whether a death was homicide or accident.

External Ballistics¶

The branch of ballistics studying the behavior of a projectile after it leaves the barrel and before it strikes a target, including the effects of gravity, air resistance, wind, and spin on the bullet's trajectory and velocity.

External ballistics calculations allow forensic investigators to reconstruct shooting trajectories, determine firing positions, and assess whether witness accounts of shot direction are consistent with the physical evidence.

Example: External ballistics calculations using bullet drop and velocity data help investigators determine that a bullet found in a wall was fired from a window approximately 40 meters away at a height consistent with an upstairs room.

Fiber Microscopy¶

The examination of textile fibers using polarized light microscopy, comparison microscopy, and scanning electron microscopy to characterize their physical features, cross-section shape, and optical properties for forensic comparison.

Microscopic fiber analysis can associate a questioned fiber with a source to the class level (manufacturer, product type), and when combined with dye analysis, can achieve highly discriminating comparisons.

Example: Using polarized light microscopy, an examiner measures the birefringence of an unknown fiber and compares its cross-sectional shape to known reference fibers from a suspect's sweater.

Fifth Amendment Rights¶

The constitutional protection giving individuals the right not to incriminate themselves, prohibiting the government from compelling a person to testify against themselves in a criminal case.

The Fifth Amendment affects forensic investigations by limiting what statements and confessions can be used as evidence, requiring that suspects be informed of their rights before interrogation.

Example: A suspect who invokes their Fifth Amendment right to remain silent cannot be compelled to describe how they handled a weapon or disposed of evidence.

Fingerprint Individualization¶

The conclusion reached by a fingerprint examiner that a latent print was deposited by a specific individual, based on the presence of sufficient matching ridge detail with no unexplained differences between the latent and a known exemplar.

Fingerprint individualization is one of the strongest forms of physical evidence identification, though it requires a qualified examiner to conduct a rigorous ACE-V (Analysis, Comparison, Evaluation, Verification) process.

Example: After the ACE-V process, an examiner concludes individualization — that the latent print from the murder weapon was deposited by the defendant — based on seventeen matching minutiae.

Fingerprint Pattern: Arches¶

The least common fingerprint pattern (found in approximately 5% of the population), characterized by ridges that enter from one side, rise in a wave or tent shape, and exit from the other side without recurving.

Arches are significant in identification because their rarity can help narrow a suspect pool, and their simple ridge flow still contains unique minutiae points for comparison.

Example: An examiner notes that all ridges on a fingerprint flow from left to right in a gentle hill shape with no delta or core, classifying it as a plain arch pattern.

Fingerprint Pattern: Loops¶

The most common fingerprint pattern (found in approximately 60–65% of the population), characterized by ridges that enter from one side, curve around, and exit from the same side, encircling a core.

Loops are classified as either ulnar or radial based on which direction the opening faces, and their high frequency makes them important baselines in fingerprint pattern analysis.

Example: When classifying a crime scene fingerprint, an examiner identifies it as a loop because the ridges flow in, recurve around a central delta, and flow back out on the same side.

Fingerprint Pattern: Whorls¶

A fingerprint pattern, found in approximately 30–35% of the population, in which ridges form circular, spiral, or other closed patterns around a central point, with two delta formations present.

Whorls have greater complexity than loops or arches, providing more ridge detail for comparison and including subtypes such as plain whorls, central pocket loops, double loops, and accidental whorls.

Example: An examiner identifies a fingerprint as a whorl because the ridges form concentric ovals around a center point with two deltas visible on either side.

Fingerprint Substrates¶

The surfaces on which fingerprints are deposited, broadly categorized as porous (paper, cardboard), non-porous (glass, plastic, metal), or textured, each requiring different development techniques for optimal results.

Matching the development technique to the substrate is critical; using the wrong method can destroy fragile latent prints, so understanding substrate characteristics guides chemical and physical processing choices.

Example: Because paper is a porous substrate, ninhydrin (which reacts with amino acids in sweat) is preferred over powder dusting for developing latent prints on a ransom note.

Fire Tetrahedron¶

The model representing the four essential elements required for fire: fuel (combustible material), oxygen (oxidizing agent), heat (sufficient ignition energy), and the chemical chain reaction sustaining combustion; removal of any element extinguishes the fire.

Understanding the fire tetrahedron helps arson investigators and fire scientists determine how a fire started, how it spread, and whether it was accidentally or deliberately ignited.

Example: An arson investigator determines the fire was started by removing the "fuel" barrier — someone poured an accelerant to introduce additional fuel where none naturally existed, explaining the unusual burn pattern.

Firewall Log Analysis¶

The examination of records maintained by network firewall systems that document allowed and blocked network connections, providing a historical record of what systems communicated with a network and when.

Firewall logs serve as a digital audit trail that can reveal unauthorized access attempts, connections to known criminal infrastructure, or data exfiltration events during corporate espionage or cybercrime investigations.

Example: Firewall logs from a corporate network show a specific workstation repeatedly connecting to a foreign IP address at 2:00 AM for three weeks before a major data breach was discovered.

Firing Pin Impressions¶

The indentation left on the primer of a cartridge case by the firing pin striking it during discharge; the shape, depth, and surface characteristics of the impression are unique to the specific firing pin that made it.

Firing pin impressions provide individual identification marks on cartridge cases, allowing firearms examiners to link specific fired cases to a particular firearm with a high degree of certainty.

Example: A circular firing pin impression with a distinctive eccentric blemish on a cartridge case from the scene matches a test fire from the suspect's revolver under comparison microscopy, linking the weapon to the scene.

Flash Point¶

The lowest temperature at which a flammable liquid produces enough vapor above its surface to briefly ignite when exposed to an ignition source, providing a measure of a liquid's fire hazard and volatility.

Flash point data helps arson investigators identify unknown liquids and assess whether conditions at a scene were consistent with accidental ignition or require an external heat source to explain the fire's origin.

Example: Gasoline has a flash point of approximately −43°C, meaning it can ignite from a spark even in cold weather; this low flash point makes it a commonly used and easily detected accelerant in arson cases.

Fluorescein Test¶

A presumptive blood test similar to luminol in which fluorescein reacts with the peroxidase activity of hemoglobin, producing green fluorescence under specific wavelength light, while being less destructive to DNA than luminol.

Fluorescein is preferred when DNA recovery from a stain is critical because it is less damaging to genetic material than luminol, preserving evidence for subsequent DNA profiling.

Example: Investigators use fluorescein instead of luminol on bloodstains they intend to swab for DNA, observing green fluorescence under blue-green light to confirm the presence of blood before sampling.

Forensic Imaging Process¶

The creation of an exact, sector-by-sector bit-stream copy of a digital storage device, capturing all data including deleted files, unallocated space, and slack space, which is then verified against the original using hash values.

Forensic imaging allows analysis of a complete copy of the original evidence without risking alteration of the original; all examination is performed on the image, preserving the original evidence intact.

Example: A forensic examiner creates a forensic image of a suspect's 500 GB hard drive using specialized software; the image captures every sector including unallocated space and is verified with a matching MD5 hash.

Forensic Science Overview¶

The application of scientific principles and laboratory techniques to matters of law, including the investigation of crimes, identification of individuals, and analysis of physical evidence for use in legal proceedings.

Understanding forensic science helps investigators connect physical evidence to suspects and victims, providing objective data that can support or refute claims made in court.

Example: A forensic scientist analyzes blood, hair, and fiber samples collected at a murder scene to help prosecutors establish what happened and who was responsible.

Fourth Amendment Rights¶

The constitutional protection against unreasonable searches and seizures by the government, requiring that law enforcement obtain a warrant based on probable cause before searching a person, home, or property.

Fourth Amendment violations can result in evidence being suppressed under the exclusionary rule, meaning illegally obtained forensic evidence cannot be used in court.

Example: If police search a suspect's home without a warrant and find a murder weapon, that weapon may be excluded from trial under Fourth Amendment protections.

Fresh Stage of Decomposition¶

The initial decomposition stage immediately after death in which external changes are minimal but internal microbial activity begins, autolytic enzymes start breaking down cells, and the first insects may arrive to oviposit.

The fresh stage is the window when traditional pathological examinations yield the most accurate findings, and when the first colonizing insects establish the baseline for entomological post-mortem interval estimation.

Example: A body in the fresh stage, with no visible external decomposition but early skin discoloration, allows a pathologist to collect the best quality evidence for toxicology, serology, and standard autopsy findings.

Friction Ridge Skin¶

The specialized skin found on the fingertips, palms, and soles of the feet, characterized by raised ridges and furrows that produce unique patterns and leave impressions on surfaces the hand contacts.

Friction ridge skin creates the fingerprints used for identification and has enough individual variation that no two people — including identical twins — share the same ridge pattern.

Example: The friction ridge skin on a person's fingertip deposits sweat and oils onto a smooth glass surface, leaving a latent fingerprint that can be developed and compared to a known exemplar.

Frye Standard¶

An older legal admissibility standard, originating from the 1923 case Frye v. United States, requiring that scientific evidence be based on methods that are generally accepted within the relevant scientific community.

Some states still use the Frye standard rather than Daubert, meaning forensic techniques must have broad professional consensus before being admitted in those jurisdictions.

Example: Under the Frye standard, DNA profiling was not immediately admissible; it first had to gain widespread acceptance among geneticists and forensic scientists.

Gas Chromatography (GC)¶

An analytical technique that separates the individual chemical components of a mixture by passing vaporized sample through a heated column where components travel at different speeds based on their chemical properties, producing a chromatogram of separated peaks.

Gas chromatography separates complex drug or chemical mixtures into individual compounds that can be identified and quantified, making it a foundational tool in forensic toxicology and arson investigation.

Example: GC analysis of a blood sample separates alcohol, caffeine, and any drugs present into distinct peaks on the chromatogram, allowing each compound to be identified and measured.

GC-MS Analysis¶

The combination of gas chromatography (for separation) and mass spectrometry (for identification) into a single instrument, providing both separation of mixture components and definitive molecular identification of each separated compound.

GC-MS is the gold standard for forensic drug identification, providing both quantitative data (concentration) and qualitative confirmation (identity), meeting the highest standards for admissible evidence.

Example: A GC-MS analysis of urine identifies and quantifies methamphetamine and its metabolite amphetamine, providing both confirmation of the drug's identity and a measured concentration for toxicological interpretation.

Geolocation from Metadata¶

The extraction of geographic location information from digital evidence sources such as photo EXIF data, cell tower records, Wi-Fi network logs, or GPS device history to determine where a device or person was at a specific time.

Geolocation evidence can physically place a suspect at or near a crime scene even without eyewitness testimony, providing objective location evidence that supports or refutes alibis.

Example: GPS coordinates embedded in photographs on a suspect's phone place the device at the location of a victim's home at the time of a burglary, contradicting the suspect's claimed alibi of being elsewhere.

Glass Composition¶

The chemical makeup of glass, primarily silicon dioxide (SiO₂) combined with metal oxides such as sodium, calcium, and potassium, which can be analyzed to characterize and compare glass samples from crime scenes.

The elemental composition of glass varies among manufacturers and product types, allowing forensic scientists to determine whether glass fragments from a scene are consistent with a specific source.

Example: Using elemental analysis, a forensic scientist determines that glass fragments from a suspect's shoe have the same chemical profile as the broken window at the burglary scene.

Glass Fracture Mechanics¶

The physical principles governing how glass breaks under stress, including the behavior of tensile and compressive forces, the formation of Wallner lines (curved stress marks on fracture surfaces), and the directionality of crack propagation.

Understanding glass fracture mechanics allows forensic scientists to determine the direction of force, the angle of impact, and the velocity of objects that caused breakage.

Example: The curved Wallner lines on a glass fracture surface indicate the direction the crack was traveling, allowing reconstruction of force direction in a vehicle collision investigation.

Glass Fracture Sequence¶

The determination of the chronological order in which multiple impacts were made in the same pane of glass, based on the principle that existing fracture lines act as barriers that stop later fracture lines from crossing them.

Establishing fracture sequence tells investigators which breakage event occurred first, which can be critical in cases involving multiple bullets, multiple blows, or a staged crime scene.

Example: In a window with two bullet holes, the fractures from the second shot stop at the radial lines created by the first shot, establishing that the first hole was made earlier.

Gradient Tube Density¶

A forensic soil comparison technique in which soil samples are dropped into a tube containing liquids of gradually varying density; each soil settles at its matching density level, creating a visible banding pattern for comparison.

Gradient tube analysis creates a visual density profile unique to a soil's composition, allowing side-by-side comparison of questioned and known samples in the same tube.

Example: A questioned soil sample and a reference sample from the crime scene produce identical banding patterns when run in the same gradient tube, supporting their common origin.

Greater Sciatic Notch¶

The concave notch on the posterior surface of the ilium of the pelvis, narrower and more angular in males and wider and more open in females, used as one of several pelvic traits for biological sex estimation.

The sciatic notch's width relative to its depth provides a discriminating sex characteristic; together with subpubic angle and other traits, it contributes to a reliable sex assessment from skeletal remains.

Example: A wide, shallow greater sciatic notch that forms an obtuse angle on an unidentified pelvis contributes to an estimate of female sex, consistent with other pelvic morphological features.

Grid Search Pattern¶

A search method in which an area is searched in parallel lines in one direction and then again in perpendicular lines, creating a grid that provides overlapping coverage of the entire search area.

The grid pattern is the most thorough search method because each part of the area is searched twice from different angles, reducing the chance of missing small evidence items.

Example: After a shooting in a parking lot, investigators walk the entire lot in east-west lines, then repeat north-south, ensuring no shell casings or blood drops are missed.

Gunshot Residue (GSR)¶

Microscopic particles ejected from a firearm during discharge, consisting of lead, barium, and antimony compounds from primer combustion, that deposit on hands, face, and clothing of the shooter and nearby individuals.

GSR analysis can place a suspect in proximity to a discharged firearm, though results must be interpreted carefully because GSR can transfer secondarily and dissipates over time through washing or contact.

Example: SEM-EDX analysis of stubs from a suspect's hands detects particles containing lead, barium, and antimony in a morphology consistent with gunshot residue, supporting that the suspect recently fired or handled a firearm.

Hair Anatomy¶

The structural organization of a hair shaft, consisting of three concentric layers — the cuticle (outer scale layer), cortex (middle pigmented layer), and medulla (inner core) — plus the root and follicle structures.

Understanding hair anatomy allows forensic examiners to compare samples under microscopy and determine species, body region of origin, whether hair was naturally shed or forcibly removed, and sometimes racial characteristics.

Example: By examining the three layers of a hair shaft under a comparison microscope, an examiner can assess whether an unknown hair shares characteristics consistent with a known reference sample.

Hair Cortex Structure¶

The middle layer of the hair shaft, containing pigment granules, cortical fusi (air spaces), and ovoid bodies that give hair its color and contribute to the microscopic characteristics used in forensic comparison.

The distribution, density, and color of pigment granules in the cortex are key features that forensic examiners use to compare hair samples from a crime scene with known reference samples.

Example: An examiner notes that pigment granules in the cortex of a crime scene hair are densely clumped near the medulla, a feature consistent with the reference hairs from a named suspect.

Hair Cuticle Structure¶

The outermost layer of a hair shaft, composed of overlapping, transparent scales whose shape (coronal, spinous, or imbricate) varies by species and provides a surface for microscopic comparison.

Cuticle scale pattern is one of the primary features used to distinguish human hair from animal hair under a comparison microscope, as different species have distinctively shaped scales.

Example: An examiner uses a scanning electron microscope to examine scale patterns, identifying imbricate (flat, overlapping) scales consistent with human hair rather than the coronal scales seen in rodent hair.

Hair Medulla Structure¶

The innermost channel or cells running along the central axis of a hair shaft, classified by its continuity and structure as absent, fragmented, discontinuous, or continuous, providing a distinguishing feature for comparison.

The medullary pattern and medullary index are important comparative features; continuous medullas are common in animal hairs but rare in human hairs, helping distinguish species.

Example: An examiner observes a continuous, broad medulla filling most of the hair's diameter in a questioned hair, indicating it is likely animal in origin rather than human.

Hair Scale Patterns¶

The arrangement and shape of cuticle scales on the outer surface of a hair shaft, classified as imbricate (flat, overlapping — typical of humans), coronal (crown-like — typical of small rodents), or spinous (petal-like — typical of cats and some other animals).

Scale patterns are species-specific characteristics used to identify the animal origin of questioned hairs, guiding investigators toward or away from particular animal sources.

Example: An examiner creates a scale cast of an unknown hair and observes spinous (petal-shaped) scales under a microscope, consistent with feline (cat) hair rather than human hair.

Handwriting Analysis¶

The forensic examination of questioned documents to evaluate the characteristics of handwriting for authenticity, authorship comparison, and detection of forgery, based on the principle that each person develops a unique writing style.

Handwriting analysis allows document examiners to determine whether a questioned signature or document was written by a specific person, supporting fraud, forgery, and threatening letter investigations.

Example: A questioned examiner compares a disputed signature on a will to known writing samples from the deceased, concluding the signature is inconsistent with the deceased's established writing habits and likely forged.

Handwriting Characteristics¶

The specific features examined in forensic handwriting comparison, including letter form, proportions, spacing, slant, line quality, pen pressure, connecting strokes, and beginning and ending strokes unique to an individual writer.

Handwriting characteristics collectively create a writer's individual style; no two individuals develop identical combinations of all these features, providing the basis for forensic authorship comparison.

Example: A document examiner notes that the author of a threatening note consistently uses an unusual figure-8 construction for the letter "g," a distinctive habit also present in the suspect's known writing samples.

Hard Drive Architecture¶

The physical and logical structure of a magnetic hard drive, including platters, read/write heads, tracks, sectors, clusters, and the file system layer (such as NTFS or FAT) that organizes how data is stored and accessed.

Understanding hard drive architecture is fundamental to digital forensics because it explains where deleted files and file fragments reside, how data can be recovered, and how forensic imaging must be performed.

Example: A forensic examiner understands that deleted files on an NTFS-formatted drive have their directory entries marked as available but data remains in clusters until overwritten, allowing recovery through forensic tools.

Hash Verification¶

The process of calculating hash values of digital evidence at multiple points in the investigation — at collection, after imaging, and after analysis — to confirm that the data has not been altered at any stage.

Hash verification is the cryptographic proof of evidence integrity; matching hashes at each stage of the chain of custody demonstrate that digital evidence was not modified from collection through court presentation.

Example: A forensic report documents identical SHA-256 hashes calculated at the time of seizure, after imaging, and before testimony, proving the analyzed image is an unaltered representation of the original evidence.

Headspace Analysis¶

A technique for collecting volatile chemical vapors from the space above fire debris samples sealed in containers, concentrating those vapors for injection into a GC-MS to identify accelerant residues.

Headspace analysis is the standard method for detecting accelerants in fire debris because it captures volatile hydrocarbon compounds without directly extracting the solid debris, reducing matrix interference.

Example: Fire debris sealed in a clean paint can is heated gently; the vapor above the debris is sampled with a syringe and injected into a GC-MS, revealing a chromatographic pattern consistent with diesel fuel.

Heavy Metal Toxicology¶

The forensic analysis of toxic metals such as arsenic, lead, mercury, and thallium in biological samples, using atomic absorption spectroscopy or ICP-MS to detect and quantify concentrations above normal background levels.

Heavy metal analysis can detect chronic poisoning over time by examining hair segments (each centimeter represents approximately one month of growth), providing a timeline of exposure.

Example: Segmental hair analysis reveals elevated arsenic concentrations in a specific zone of a victim's hair, consistent with chronic arsenic poisoning beginning approximately three months before death.

High Explosives¶

Explosive materials that detonate with a supersonic shock wave, rapidly converting solid or liquid explosive compounds into large volumes of gas, causing violent structural damage; examples include TNT, RDX, and PETN.

High explosive residues are identified at post-blast scenes using GC-MS, LC-MS/MS, or ion mobility spectrometry, helping investigators determine the explosive type and reconstruct the device construction.

Example: Swabs from a post-blast scene test positive for RDX by LC-MS/MS, identifying a military-grade plastic explosive consistent with a sophisticated improvised explosive device.

High-Velocity Impact Spatter¶

Bloodstain patterns produced by high-velocity forces such as gunshot wounds or high-speed machinery, creating very small, mist-like droplets (typically under 1 mm) that travel significant distances from the source.

High-velocity spatter is a key indicator of gunshot wounds, and its fine mist pattern can deposit on the shooter's hands, face, and clothing, linking them to the discharge of a firearm.

Example: Fine, mist-like blood droplets on the back of a shooter's hand are consistent with high-velocity back spatter from a contact gunshot wound, placing the shooter in proximity to the victim.

Homozygous vs Heterozygous¶

At a given STR locus, homozygous means both alleles inherited from each parent are the same (only one peak appears on the electropherogram), while heterozygous means the two alleles differ (two peaks appear).

Homozygous loci appear as single peaks, which can be confused with low-level mixture signals, so analysts must be careful when interpreting apparent single-allele results in forensic casework.

Example: At the D5S818 locus, a sample showing only one peak at allele position 12 may be homozygous (12,12) or may reflect allele drop-out from a degraded sample, requiring careful analytical consideration.

Human Osteology¶

The scientific study of human bones, including their structure, development, variation, and pathology, forming the foundation for forensic anthropologists to analyze skeletal remains for identification and trauma analysis.

Human osteology allows forensic anthropologists to construct a biological profile (sex, age, stature, ancestry) from unidentified skeletal remains, providing essential information for identification and investigation.

Example: A forensic anthropologist applies osteological knowledge to a set of disarticulated bones, determining they are human and estimating the sex and age range of the individual from bone morphology.

Human vs Non-Human Hair¶

The forensic comparison of hair to determine whether it originated from a human or an animal, based on microscopic features including medullary index, cuticle scale type, pigment distribution, and cortex structure.

Correctly identifying hair species prevents false leads and focuses investigative resources; animal hair found on clothing may indicate a suspect owns certain pets or frequents areas where those animals are found.

Example: Hair found on a crime scene victim's sweater is identified as cat hair based on its high medullary index and coronal scale pattern, suggesting the suspect owns a cat.

Ignition Temperature¶

The minimum temperature at which a material will self-sustain combustion without an external ignition source (also called autoignition temperature), a critical factor in assessing whether a fire could have started spontaneously.

Comparing the ignition temperature of materials present in a fire scene with temperatures that could realistically have been reached helps investigators determine whether spontaneous ignition was possible or whether deliberate ignition is more likely.

Example: Paper has an ignition temperature of about 233°C (451°F); an investigator determines that the ambient conditions near the fire's origin could not have reached that temperature spontaneously, suggesting deliberate ignition.

Immersion Oil Technique¶

A glass comparison method in which a fragment is immersed in oils of known refractive indices and observed under a microscope; when the glass and oil have matching refractive indices, the glass fragment becomes nearly invisible (matches point).

The immersion oil technique allows precise measurement of a glass fragment's refractive index to four decimal places, providing a highly discriminating comparison value.

Example: A technician immerses glass fragments in a series of oils with decreasing refractive index; the fragment disappears when submerged in oil with refractive index 1.5172, establishing the fragment's RI.

Ink Chemistry Analysis¶

The forensic examination of pen ink using analytical techniques such as thin-layer chromatography or liquid chromatography-mass spectrometry to identify the ink's chemical composition, compare inks, and potentially date documents.

Ink analysis can determine whether different parts of a document were written with the same pen, detect document alterations, and sometimes establish that an ink was not commercially available at the claimed date.

Example: Thin-layer chromatography reveals that the signature on a disputed contract was made with a different ballpoint ink formulation than the rest of the document, suggesting the signature was added later.

Insect Egg Stage¶

The first stage of blowfly development in which female flies deposit clutches of eggs on a body shortly after death, typically in wounds, natural orifices, or areas protected from desiccation; eggs hatch into first-instar larvae within hours under warm conditions.

The time from egg deposition to hatching is temperature-dependent and well-documented, making discovery of eggs on a body an important data point for establishing the minimum post-mortem interval.

Example: Hatched and unhatched blowfly eggs collected from nasal passages allow an entomologist to determine when colonization began, establishing the earliest possible time of death.

Insect Succession Ecology¶

The predictable sequence of insect species that colonize a decomposing body over time, with different species arriving and departing at characteristic stages of decomposition, creating a biological timeline.

Because succession follows a predictable pattern, the assemblage of species present on a body at discovery provides additional evidence for estimating PMI, particularly in cases where the body has decomposed beyond the initial blowfly colonization stage.

Example: The presence of hide beetles (Dermestidae) along with absence of blowfly larvae indicates the body has been dead long enough for the late-succession beetles to arrive, suggesting a PMI of weeks to months.

Internal Ballistics¶

The branch of ballistics studying the behavior of a projectile and propellant gases inside the firearm barrel from the moment of ignition until the bullet exits the muzzle, including pressure, velocity, and energy transfer.

Internal ballistics determines the velocity at which a bullet leaves the barrel, affecting wound morphology and trajectory; evidence of internal ballistic events (such as barrel obstruction) can explain unusual wound patterns.

Example: Internal ballistics calculations explain why a bullet from a .45 ACP pistol exits at lower velocity but greater diameter than a .223 rifle bullet, influencing their different wound characteristics.

Iodine Fuming¶

One of the oldest fingerprint development techniques, in which iodine crystals are heated to produce vapors that temporarily combine with fatty components in fingerprint residue to create a visible yellow-brown color.

Because iodine development is temporary and reversible (the color fades as iodine evaporates), treated prints must be photographed immediately; fixatives can make the image more permanent.

Example: A technician uses an iodine fuming pipe to breathe iodine vapors onto aged paper; yellow-brown ridges appear within seconds and are immediately photographed before they fade.

IP Address Analysis¶

The forensic identification of the unique numerical address assigned to a device on a network, used to trace internet activity back to a specific internet service account or physical location through subpoenas to service providers.

IP address analysis bridges the gap between online activity and physical identity, allowing investigators to connect anonymous-seeming online behavior to a specific subscriber and location.

Example: Log records from a threatening email service show it was sent from IP address 73.45.123.44; a subpoena to the Internet service provider links that IP to a specific customer's account at the relevant time.

Kastle-Meyer Color Test¶

A presumptive blood test in which phenolphthalein reagent and hydrogen peroxide are applied to a sample; a positive result for blood produces an immediate bright pink or magenta color change.

The Kastle-Meyer test is widely used at crime scenes because it is highly sensitive, easy to apply, and can detect blood even after significant dilution or attempts to clean the scene.

Example: A crime scene investigator applies the Kastle-Meyer reagent to a suspected blood smear on a wall; an immediate pink color change indicates a positive presumptive result, warranting swabbing for DNA analysis.

Lands and Grooves¶

The raised ridges (lands) and cut recesses (grooves) of rifling inside a firearm barrel; the number, width, depth, and direction of twist of lands and grooves characterize a barrel's class and are impressed onto fired bullets.

Lands and groove characteristics are the class-level data used to determine which manufacturers' firearms could have fired a recovered bullet, narrowing the search before individual mark comparison.

Example: A recovered bullet shows six lands and grooves with a right-hand twist; comparison to manufacturer specifications identifies this as consistent with several firearm models, narrowing the list of possible weapons.

Larval Instar Stages¶

The three larval stages of blowfly development (first, second, and third instar), each separated by a molting event, with characteristic sizes and behaviors that indicate how far development has progressed since egg hatching.

Identifying the instar stage of collected larvae allows entomologists to calculate development time elapsed since hatching, and combined with egg-hatching time and temperature data, refines the PMI estimate.

Example: Third-instar larvae collected from a body are measured at 15 mm; using accumulated degree data for that species at the recorded temperatures, the entomologist estimates larvae have been developing for approximately 4–5 days.

Latent Fingerprints¶

Invisible fingerprint impressions deposited on a surface through sweat and skin oils that require physical, chemical, or optical development techniques to be visualized and collected.

Latent prints are the most common type encountered at crime scenes, and their development requires understanding the surface type and environment to choose the most effective visualization method.

Example: An examiner applies aluminum powder to a smooth glass surface using a brush to visualize an invisible latent fingerprint left by a suspect's hand.

LC-MS/MS Analysis¶

Liquid chromatography coupled with tandem mass spectrometry, used to analyze compounds that are too large, polar, or thermally labile to be analyzed by GC-MS, including many drugs and their metabolites in biological fluids.

LC-MS/MS provides high sensitivity and specificity for quantifying drugs in complex biological matrices such as blood and urine, making it the preferred method for modern forensic toxicology.

Example: LC-MS/MS is used to quantify fentanyl and its metabolite norfentanyl in post-mortem blood, providing concentrations that assist in determining whether fentanyl was a contributing cause of death.

Leukocytes¶

White blood cells that are part of the immune system and contain nuclei with the individual's complete nuclear DNA, making them valuable sources for forensic DNA profiling from biological evidence.

Because leukocytes contain nuclear DNA, they provide the genetic profile that allows forensic scientists to identify specific individuals from blood evidence, going beyond simple blood group typing.

Example: Although a blood sample may be too degraded for reliable ABO typing, nuclear DNA extracted from leukocytes in the same sample can still produce a usable STR profile for database comparison.

Line Quality in Writing¶

A handwriting characteristic describing the smoothness, pressure, and control visible in the ink lines of a writing sample, reflecting the writer's physical health, familiarity with the signature, and whether the writing was produced naturally or traced/drawn.

Poor line quality — tremor, hesitation, lifts, or retouching — in a questioned signature suggests it was carefully drawn rather than produced with natural, habitual speed, indicating possible forgery.

Example: A questioned signature shows wavering, slow-drawn lines with visible pen lifts and hesitation marks, in contrast to the smooth, flowing line quality of authentic signatures, suggesting simulation.

Locard Exchange Principle¶

The forensic principle, proposed by Edmond Locard, stating that whenever two objects come into contact, each leaves trace material on the other, meaning every criminal leaves evidence behind and also takes evidence away.

This principle forms the foundation of trace evidence analysis, justifying the careful collection of hair, fiber, soil, and other microscopic materials at crime scenes.

Example: A burglar who walks across a carpet leaves shoe impression evidence and takes carpet fibers on their shoes, linking them to the scene even without fingerprints.

Long Bone Measurements¶

The precise measurement of long bone lengths (femur, tibia, humerus, radius, ulna) from skeletal remains, used in regression formulas to calculate stature and as comparative data for identification.

Long bone measurements provide quantitative data for stature estimation and can be compared to medical records, clothing sizes, or driver's license information to narrow or confirm identification.

Example: The maximum femur length of an unidentified skeleton is 46.5 cm; entered into a sex-appropriate regression formula, this predicts a living stature of approximately 175 cm (5'9").

Low Explosives¶

Explosive materials that deflagrate (burn rapidly) rather than detonate, including gunpowder and pyrotechnics, releasing energy relatively slowly compared to high explosives, typically used as propellants in firearms or in fireworks.

Forensic analysis of low explosive residues at a scene helps identify the type of explosive device used, which informs the investigation of bombings, pipe bomb incidents, and firearms discharges.

Example: Post-blast swabs from a pipe bomb scene contain residue characteristic of black powder (a low explosive), identified by ion chromatography detection of nitrate, sulfate, and potassium ions.

Low-Velocity Impact Spatter¶

Bloodstain patterns produced when blood is subjected to low-force impact (typically under 5 feet per second), such as dripping or gravity-driven flow, creating large, round to oval stains with smooth, regular edges.

Low-velocity spatter often results from passive bloodshed such as dripping wounds, providing information about the victim's position and movement during and after injury.

Example: Large, round blood drops with relatively smooth edges on a floor beneath a stabbing victim are consistent with low-velocity impact spatter from blood dripping from the wound.

Luminol Test¶

A chemiluminescent presumptive blood test in which luminol reagent reacts with iron in hemoglobin to produce a blue-white glow visible in darkness, able to detect trace blood even after cleaning or dilution.

Luminol is powerful because it can reveal blood that has been wiped away or cleaned, helping investigators find evidence of attempts to destroy crime scene evidence.

Example: After a suspect cleaned a bathroom with bleach, investigators spray luminol in darkness and observe glowing patterns consistent with blood pooling and wipe marks, suggesting a violent incident occurred there.

Marquis Reagent Test¶

A presumptive colorimetric drug screening test in which concentrated sulfuric acid and formaldehyde react with an unknown substance, producing characteristic colors for different drug classes (purple-black for opiates, orange-brown for amphetamines).

The Marquis test provides rapid, on-scene screening for controlled substances, allowing investigators to prioritize evidence and make arrest decisions before laboratory confirmation is available.

Example: A detective applies Marquis reagent to a white powder seized at an arrest; the immediate purple-black color change suggests the presence of an opiate, prompting secure packaging for laboratory confirmation.

Mass Spectrometry (MS)¶

An analytical technique that identifies chemical compounds by ionizing molecules and measuring the mass-to-charge ratios of resulting fragments, producing a unique mass spectrum that serves as a molecular fingerprint.

Mass spectrometry provides definitive chemical identification at the molecular level, making it the gold standard for confirmatory identification of drugs, toxins, and other forensic chemical evidence.

Example: When the mass spectrometer analyzes an unknown compound from a seized pill, its fragmentation pattern matches the reference spectrum for MDMA, confirming the compound's identity.

MD5 Hash Function¶

A cryptographic algorithm that processes any amount of data and produces a 128-bit (32-character hexadecimal) fixed-length value; any change to the data produces a completely different hash, allowing forensic verification of evidence integrity.

MD5 hashes are used to verify that forensic images exactly match the original evidence devices — if the hashes match, the copy is proven to be bit-for-bit identical, demonstrating that evidence was not altered.

Example: An examiner calculates the MD5 hash of a seized hard drive as a baseline, then hashes the forensic image; identical hash values (e.g., "5f4dcc3b5aa765d61d8327deb882cf99") confirm the image is an exact copy.

Medium-Velocity Impact Spatter¶

Bloodstain patterns produced by moderate forces, typically associated with blunt force or stab wounds, creating medium-sized spatter stains (1–3 mm) that indicate the mechanism and direction of blood dispersal.

Medium-velocity spatter is commonly associated with beatings and stabbings, and the pattern's distribution can indicate where the blood source was located and the general direction of force.

Example: Spatter of medium-sized bloodstains found on a nearby wall at a blunt-force assault scene is consistent with medium-velocity impact, suggesting the victim was struck in that location.

Medullary Index Calculation¶

The ratio of the medulla's diameter to the hair shaft's total diameter (medulla width ÷ hair shaft width), used as a comparative measure; values above 0.33 suggest animal hair, while human hair typically falls below 0.33.

The medullary index is a quick, quantitative screening tool that helps distinguish human from animal hair before more detailed microscopic comparison is performed.

Example: Measuring a questioned hair, an examiner finds the medulla is 0.05 mm wide and the shaft is 0.08 mm wide, giving an index of 0.63 — indicating the hair is likely from an animal, not a human.

Minimum Post-Mortem Interval¶

The shortest time since death that can be scientifically established from biological or physical evidence, typically determined by the developmental stage of the oldest insects present or the most advanced stage of decomposition observed.

The minimum PMI tells investigators "the person could not have died more recently than X time ago," providing a conservative time-of-death boundary that is legally defensible even when a precise time cannot be established.

Example: Larval development data indicates blowflies have been developing for at least 6 days; the minimum PMI is therefore 6 days, meaning the person died no later than 6 days before the body was discovered.

Minutiae Points¶

The specific, individual ridge characteristics within a fingerprint pattern — such as ridge endings, bifurcations, dots, and enclosures — that make each fingerprint unique and serve as the basis for comparison.

Minutiae points are the core data used in both manual comparison and AFIS database searching; a sufficient number of matching minutiae establishes an identification.

Example: An examiner marks twelve matching minutiae points — six ridge endings and six bifurcations — in the same positions and orientations between a latent print and a known exemplar to declare an identification.

Mitochondrial DNA¶

DNA located in mitochondria rather than the cell nucleus, inherited exclusively from the mother, present in many more copies per cell than nuclear DNA, and used for forensic analysis of degraded samples or materials lacking nuclei.

Mitochondrial DNA is valuable for analyzing hair shafts (which lack nuclei), very old bones, and highly degraded samples where nuclear DNA has been destroyed, extending identification capabilities.

Example: A hair shaft found at a crime scene lacks a root and therefore has no nuclear DNA, but mitochondrial DNA is extracted from the shaft and compared to the maternal lineage reference of a potential victim.

Modified Griess Test¶

A colorimetric test applied to a shooting victim's clothing or skin to detect nitrite compounds from gunpowder residue, used to determine the distance from the firearm's muzzle to the target when the weapon was fired.

The distribution of nitrite deposits around a wound changes predictably with firing distance; the Modified Griess test maps this distribution, allowing estimation of muzzle-to-target distance (contact, close range, intermediate, distant).

Example: Orange staining around an entrance wound on clothing using the Modified Griess test indicates a contact or close-range shot, corroborating witness testimony about the shooting distance.

Multiple Points of Origin¶

The presence of two or more separate, unconnected fire start locations within a single structure, which strongly indicates deliberate fire-setting because accidental fires almost always have a single point of origin.

Identifying multiple origins is one of the strongest indicators of arson because it cannot be explained by accident or spontaneous combustion; it requires deliberate human action to simultaneously start fires in separate locations.

Example: An investigator identifies charred areas in three separate rooms with no connecting burn path between them, concluding that multiple, independently set fires indicate intentional arson.

Natural Fibers¶

Textile fibers derived from plant sources (such as cotton and linen) or animal sources (such as wool and silk), which have characteristic microscopic structures and chemical compositions used for forensic identification.

Natural fibers can link suspects to crime scenes; their microscopic features (fiber shape, scale patterns in wool, lumen in cotton) and dye analysis allow class and sometimes source identification.

Example: Cotton fibers from a blue shirt left at a crime scene are compared microscopically and chemically to fibers from the suspect's torn shirt, supporting the conclusion that the shirt came from the same source.

Necrophagous Insects¶

Insects that feed directly on decomposing tissues and carrion, including blowflies, flesh flies, and carrion beetles, representing the primary entomological evidence used in forensic investigations of death.

Necrophagous insects provide the most direct biological evidence for PMI estimation; their developmental stage and species identity are the core data used by forensic entomologists in death investigations.

Example: Necrophagous blow fly larvae collected from a decomposing body are preserved in hot water (to halt development at their current stage) and then stored in ethanol for laboratory identification and measurement.

Network Forensics Basics¶

The capture, recording, and analysis of network traffic and logs to reconstruct digital communications, identify devices and users, detect intrusions, and gather evidence of online criminal activity.

Network forensics enables investigators to reconstruct online criminal communications, trace the route of cyberattacks, and gather evidence of illegal file sharing, fraud, or criminal conspiracy.

Example: Network forensic analysis of router logs shows that a specific IP address downloaded illegal content at a precise time; tracing that IP to the suspect's internet service account provides evidence of criminal activity.

Ninhydrin Development¶

A chemical technique for developing latent fingerprints on porous surfaces by reacting with the amino acids present in sweat residue to produce a purple compound called Ruhemann's purple.

Ninhydrin is particularly effective on aged prints on paper, sometimes developing impressions weeks or months after deposition, making it valuable for cold cases or delayed investigations.

Example: A detective treats a threatening letter with ninhydrin spray; after drying and gentle heating, purple fingerprint ridges appear on the paper, providing evidence from a document handled weeks earlier.

Nuclear DNA¶

DNA located within the nucleus of every nucleated cell, organized into 23 pairs of chromosomes, containing the complete genetic blueprint of an individual and used for forensic STR profiling.

Nuclear DNA provides the most discriminating forensic profiles because its STR loci vary enormously between unrelated individuals, allowing statistical probabilities of a match that can exceed 1 in a quintillion.

Example: Nuclear DNA extracted from white blood cells in a bloodstain produces a 20-locus STR profile that can be compared to a reference sample from a suspect to establish or exclude a match.

Oxidation Reactions¶

Chemical reactions in which a substance loses electrons or gains oxygen atoms, including the combustion reactions central to fire behavior and the corrosion processes that affect physical evidence over time.

In arson investigation, understanding oxidation reactions helps explain burn patterns and accelerant behavior; in other forensic contexts, oxidation of metals or biological materials can affect evidence interpretation.

Example: When an accelerant burns, its hydrocarbon molecules undergo oxidation reactions, breaking down into carbon dioxide and water while leaving behind partially oxidized residues detectable in fire debris analysis.

Packet Sniffing¶

The forensic capture and analysis of data packets traveling across a network in real time or from recorded traffic, allowing investigators to reconstruct communications, identify transferred files, and monitor user activity.

Packet sniffing with proper legal authority provides real-time or recorded evidence of digital communications and file transfers, supporting investigations into cyber crimes, drug trafficking, and organized criminal networks.

Example: Lawfully authorized packet sniffing of a suspect's network traffic captures unencrypted chat messages and transferred files that document coordination of a criminal scheme.

Paper Chromatography¶

An analytical technique in which a mixture (such as ink, dye, or drug) is spotted on absorbent paper and drawn upward by a solvent, separating components by their differential affinities for the paper and solvent to produce a characteristic pattern.

Paper chromatography provides a simple, low-cost method for comparing ink or dye compositions; the resulting patterns (Rf values) help determine whether two samples share the same chemical formulation.

Example: Ink from a questioned document and a reference ink sample are run side by side on paper chromatography; identical spot positions and colors indicate the same dye components, consistent with the same ink source.

Particle Size Distribution¶

The range and proportions of particle sizes (clay, silt, sand, gravel) within a soil sample, determined by sieving or sedimentation analysis, serving as a characteristic profile for forensic comparison.

Because particle size distribution is influenced by local geology and land use, it provides a distinctive fingerprint for soil samples that can differentiate geographically separate locations.

Example: Sieve analysis of questioned soil shows 60% fine sand and 30% clay, a profile consistent with riverside soil samples but inconsistent with soil from the suspect's stated location.

Passive Bloodstains¶

Bloodstains created by gravity alone acting on blood, including drops, pools, flows, and drips, without additional force; characterized by smooth edges and predictable shapes based on surface type and drop height.

Passive stains provide information about the stationary or slowly moving position of a bleeding victim, helping establish where a person was when they were injured or after injury.

Example: A pool of blood beneath a body and satellite drops around it are passive stains, formed as blood dripped from the wounds under gravity alone without any additional force.

Patent Fingerprints¶

Visible fingerprints left in or on a substance — such as blood, grease, paint, or ink — that can be seen with the naked eye without the need for chemical or optical enhancement techniques.

Patent prints are immediately visible and can be photographed in place without development, though care must be taken not to disturb the matrix (blood, grease, etc.) that makes them visible.

Example: A burglar who had paint on their hands left patent fingerprints on a white windowsill that were visible and photographed without any development treatment.

PCR Primer Design¶

The selection of short, single-stranded DNA sequences (primers) that are complementary to the flanking regions of a target STR locus and guide DNA polymerase to copy only that specific region during PCR amplification.

Well-designed primers ensure that PCR amplifies only the intended STR loci with high specificity, preventing amplification of non-target regions that would produce inaccurate forensic profiles.

Example: Primers designed to flank the D7S820 STR locus bind specifically to the unique sequences on either side of that repeat region, ensuring the PCR product contains only that locus's repeat sequence.

Pelvic Morphology Analysis¶

The examination of the shape, dimensions, and specific features of the hip bones (os coxae) and sacrum to estimate biological sex, as the female pelvis is adapted for childbirth with wider, rounder dimensions than the male pelvis.

Pelvic morphology is the most reliable skeletal indicator of biological sex, with accuracy rates above 90% for trained analysts, making it the first element examined in sex estimation.

Example: The broad sciatic notch, wide subpubic angle, and ventral arc of a pelvic bone lead a forensic anthropologist to estimate the remains are female with high confidence.

Perimortem Trauma¶

Injuries to bone that occurred around the time of death, when the bone was still fresh and had the physical properties of living bone (greenstick fractures, plastic deformation, hinge fractures), without evidence of healing.

Perimortem trauma is particularly significant because it may represent the cause or mechanism of death, helping forensic anthropologists and pathologists determine whether blunt, sharp, or projectile force contributed to the fatal event.

Example: A skull shows beveled internal fracturing consistent with a perimortem gunshot wound — the bone was fresh and moist at the time of injury, producing fracture patterns distinct from dry bone damage.

Pharmacokinetics (ADME)¶

The study of how the body processes drugs through the four processes of Absorption (entry into bloodstream), Distribution (spread through tissues), Metabolism (chemical breakdown), and Elimination (removal from the body).

Understanding ADME allows forensic toxicologists to back-calculate drug concentrations at the time of an incident from concentrations measured in biological samples collected hours later.

Example: A forensic toxicologist uses pharmacokinetic principles to estimate what a driver's blood alcohol concentration was at the time of a crash, based on a blood sample drawn 2 hours afterward.

Physical Evidence Types¶

The broad categories of tangible items collected at crime scenes, including biological, trace, impression, documentary, digital, and chemical evidence, each requiring different collection and analysis techniques.

Understanding evidence types helps investigators apply the correct collection protocols and directs laboratory analysts to use the most appropriate testing methods for each category.

Example: A burglary scene may yield physical evidence including fingerprints (impression), broken glass (trace), a crowbar (tool mark), and a stolen credit card receipt (documentary).

Pigment Granules in Hair¶

Melanin-containing particles within the hair cortex that give hair its color, varying in size, shape, density, and distribution in ways that are characteristic of different individuals and used for forensic comparison.

The specific distribution and aggregation of pigment granules are among the most variable and informative microscopic features for comparing hair samples from crime scenes to reference samples.

Example: The questioned hair shows fine, evenly distributed pigment granules throughout the cortex, a pattern that matches the reference hairs from the suspect more closely than those from the victim.

Plastic Fingerprints¶

Three-dimensional impressions left in soft, pliable materials such as wax, putty, soap, tar, or fresh paint, preserving the ridge detail as a physical mold of the friction ridge surface.

Plastic prints are among the most detailed and durable fingerprint evidence because the material retains the three-dimensional ridge structure, which can be cast for analysis.

Example: A thief who grabbed a candle left plastic fingerprints in the soft wax; investigators poured dental stone to cast the impressions and preserve the ridge detail for comparison.

Platelets and Plasma¶

Platelets are small, anucleate cell fragments that initiate blood clotting; plasma is the liquid matrix of blood containing water, proteins (including clotting factors and antibodies), hormones, and electrolytes.

Plasma proteins and secreted antigens in body fluids can be detected and compared in forensic testing, while understanding clotting behavior is important for interpreting bloodstain patterns.

Example: The presence of plasma proteins in a body fluid stain can help confirm it is blood even when red blood cells have been disrupted, aiding in presumptive testing of old stains.

Polymerase Chain Reaction¶

A laboratory technique that copies specific target regions of DNA millions of times using cycles of heating and cooling with DNA polymerase enzyme and short primer sequences, producing enough DNA to analyze from minute starting samples.

PCR makes forensic DNA analysis possible from extremely small samples — a single hair root, a few skin cells on a surface — by amplifying the DNA to detectable levels without requiring large quantities.

Example: A forensic scientist uses PCR to amplify STR loci from a tiny blood smear too small to analyze directly, generating millions of copies of the target regions for electrophoresis.

Post-Blast Analysis¶

The forensic examination of a scene following an explosion, including collection of device remnants, residue swabs, and physical evidence, to determine the type of explosive used, the device's construction, and possible origin.

Post-blast analysis can identify the explosive's chemical signature, link device components to a manufacturer or suspect, and establish whether the bomb was homemade or commercially produced.

Example: Post-blast investigators recover a fragment of a timer circuit and wire consistent with components purchased online; residue analysis identifies PETN, and the combination guides investigators toward a specific suspect.

Postmortem Trauma¶

Damage to bones that occurred after death and decomposition, when the bone had become dry and brittle, producing clean, sharp-edged fractures without evidence of bleeding, bruising, or healing.

Distinguishing postmortem from perimortem trauma prevents misinterpretation of taphonomic damage (from animals, burial, or excavation) as evidence of ante- or perimortem injury, avoiding false conclusions about cause of death.

Example: Straight, clean fractures with light-colored internal surfaces on a long bone are consistent with postmortem damage from roots, animal gnawing, or excavation rather than injuries sustained in life.

Presumptive Blood Tests¶

Preliminary screening tests that indicate whether a substance might be blood by detecting the peroxidase-like activity of hemoglobin, producing a color change or luminescence as a positive result.

Presumptive tests are sensitive and fast, allowing investigators to screen large areas for blood rapidly, but positive results require confirmation with more specific tests because other substances can cause false positives.

Example: A technician sprays luminol on a cleaned floor; the blue glow in a specific area is a presumptive positive for blood, directing investigators to swab that area for confirmatory testing.

Primary vs Secondary Scenes¶

The distinction between the primary scene where the main criminal act occurred and secondary scenes where related activity took place, such as where a body was disposed of or where evidence was discarded.

Recognizing multiple scenes allows investigators to expand their search and collect evidence from multiple locations that together tell a more complete story of the crime.

Example: In a homicide, the primary scene is the victim's apartment where the assault occurred, while the secondary scene is a nearby dumpster where the weapon was discarded.

Product Rule in Statistics¶

The statistical principle used in forensic DNA calculations stating that the frequencies of independent genetic events can be multiplied together to calculate the overall probability of all of them occurring simultaneously in one person.

The product rule is the mathematical foundation for calculating how rare a multi-locus DNA profile is; multiplying allele frequencies across independent loci yields the combined probability of that complete profile.

Example: If the probability of a person having a specific genotype at each of five independent loci is 1 in 10, the product rule gives a combined probability of 1 in 100,000 (0.1 × 0.1 × 0.1 × 0.1 × 0.1).

3R Rule for Glass¶

The forensic mnemonic for analyzing glass fractures: Radial fractures form first (creating the initial radiating cracks), the Reverse side of the glass shows the compression marks on the exit side, and the fracture sequence can be Read by examining which cracks terminate against others.

The 3R rule allows investigators to determine impact direction and sequence of multiple impacts, providing critical information for reconstructing events at a crime scene.

Example: Applying the 3R rule, an investigator determines the glass was struck from the outside by noting that the concentric fractures' compression marks (stress marks in a right-angle pattern) are on the inside surface.

Radial Fracture Lines¶

Cracks in glass that propagate outward from the point of impact like spokes on a wheel, forming first during the initial stress of impact and extending away from the origin point.

Identifying radial fractures helps forensic investigators locate the point of impact and determine impact direction, supporting reconstruction of events such as shootings or forced entries.

Example: Radial fractures extending outward from a bullet hole in a windshield indicate the point where the projectile first struck the glass and help establish firing direction.

RAM Evidence Collection¶

The forensic acquisition of data stored in a computer's random access memory, capturing running processes, open files, logged-in credentials, and network connections that exist only while the system is powered on.

RAM acquisition is a time-critical step in live forensics because volatile evidence — encryption keys, chat sessions, and evidence of active malware — disappears permanently when the system is shut down.

Example: A forensic examiner uses a hardware write blocker and specialized software to dump the entire 16 GB RAM of a running suspect computer, preserving live session data including a running encrypted messaging application.

Random Match Probability¶

The statistical estimate of how likely it is that a randomly selected, unrelated individual from the population would by chance have the same DNA profile as the evidence sample, expressed as a very small fraction or probability.

Random match probability communicates the rarity of a DNA profile, providing the jury with context for interpreting a match; values of 1 in billions or quadrillions indicate the evidence is highly individuating.

Example: A forensic analyst reports a random match probability of 1 in 10 quadrillion, meaning only 1 in 10,000,000,000,000,000 unrelated people would be expected to share this 20-locus STR profile.

Refractive Index¶

A physical property of glass measuring how much light bends as it passes from air into the glass, expressed as a numerical value unique enough to compare glass fragments and determine if they share a common source.

Refractive index is one of the most discriminating physical properties for glass comparison and can be measured precisely using the Becke line or oil immersion method.

Example: Glass fragments from a hit-and-run victim's clothing have a refractive index of 1.518, exactly matching the refractive index of the headlight glass from the suspect's vehicle.

Requested Writing Exemplars¶

Handwriting samples collected under controlled conditions from a known individual at the request of investigators, used as comparison standards for forensic examination of questioned documents.

Requested exemplars must be collected carefully to ensure they are natural writing samples; examiners typically dictate content similar to the questioned document to capture relevant letter forms.

Example: Investigators ask a suspect to handwrite the same phrases found in a threatening letter; the resulting requested exemplars are submitted to a document examiner for comparison to the questioned document.

Rh Factor¶

A blood group antigen (the D antigen) present on red blood cells in Rh-positive individuals and absent in Rh-negative individuals, used alongside ABO typing to further characterize blood samples in forensic testing.

The Rh factor reduces the population of possible sources when combined with ABO typing; for example, AB-negative blood is found in only about 1% of the population, narrowing identification significantly.

Example: A forensic serologist determines that a crime scene blood sample is B-positive, consistent with the suspect's known blood type and inconsistent with the victim's A-negative type.

Ricochet Analysis¶

The forensic examination of bullet deflection evidence — including impact marks, bullet deformation, and trajectory changes — to reconstruct events where bullets deflected off surfaces before striking their final target.

Ricochet analysis is important when wound characteristics are atypical because a deflected bullet may tumble, fragment, or change direction, producing wounds that do not conform to typical entrance-wound morphology.

Example: An unusually keyholed wound on a victim and corresponding scrape marks on a concrete wall indicate the bullet ricocheted before striking, explaining the wound's atypical shape and helping reconstruct the original firing position.

Ridge Endings¶

A type of fingerprint minutiae where a single friction ridge abruptly terminates rather than continuing, forming one of the most common individual characteristics used in fingerprint comparison.

Ridge endings are counted and mapped during fingerprint comparison; their location, direction, and relationship to other minutiae are critical for determining whether two prints came from the same source.

Example: When comparing a latent print to a suspect's rolled ink print, an examiner marks corresponding ridge endings at the same relative positions in both prints as evidence of a match.

Rifling in Firearms¶

The spiral grooves cut into the interior of a firearm barrel that impart a gyroscopic spin to the bullet as it travels through the bore, stabilizing the projectile in flight and improving accuracy.

Rifling imprints unique microscopic striations onto the bullet as it passes through the barrel; these striations are used in firearms comparison to link a specific bullet to the specific barrel that fired it.

Example: Microscopic land-and-groove impressions on a recovered bullet are compared to test bullets fired from a suspect's firearm; matching rifling characteristics link the evidence bullet to that specific weapon.

Salivary Amylase Test¶

A presumptive test for the presence of saliva in biological evidence, detecting amylase, an enzyme that begins starch digestion and is found in high concentrations in saliva, though also present at lower levels in other fluids.

Salivary amylase testing helps identify bite marks, envelope seals, and other evidence where saliva may have been deposited, directing further testing for DNA profiling of the saliva donor.

Example: A starch-iodine test applied to swabs from a bite mark on a victim produces a positive result for salivary amylase, confirming saliva is present and prompting DNA extraction for identification.

Sand Mineral Analysis¶

The microscopic identification of individual mineral grains within soil or sand samples — such as quartz, feldspar, mica, or amphibole — to create a mineralogical profile used for forensic comparison.

The specific mix of minerals in sand is geologically determined and varies by location, making mineral analysis a powerful tool for connecting suspects to specific beaches, riverbeds, or other sandy locations.

Example: Sand from inside a suspect's vehicle contains a rare garnet mineral in proportions that match sand collected from the crime scene beach but differ from local beaches near the suspect's home.

Scaled Sketch Techniques¶

Methods for creating crime scene drawings at a consistent, mathematically proportional scale so that actual distances can be accurately calculated from measurements taken on the drawing.

Scaled sketches allow attorneys, experts, and jurors to determine exact distances between evidence items, supporting or challenging testimony about movement and positioning.

Example: A sketch drawn at 1:50 scale means every centimeter on paper represents 50 centimeters in the actual scene, allowing true distances to be read from the drawing.

Scientific Method in Forensics¶

A systematic, evidence-based approach to investigation that involves observation, hypothesis formation, controlled testing, data analysis, and conclusion-drawing to ensure reliable and reproducible results.

Applying the scientific method ensures forensic conclusions are based on objective evidence rather than assumptions, making findings credible and defensible in court.

Example: A forensic chemist hypothesizes that a white powder is cocaine, then tests it with multiple reagents and instruments to confirm or refute that hypothesis before reporting results.

Scott Reagent Test¶

A presumptive colorimetric test for cocaine that produces a blue color in the first step (positive for cocaine), followed by decolorization and pink in subsequent steps, distinguishing cocaine from other substances.

The Scott test is used at crime scenes and in the field to provide presumptive identification of cocaine powder or crack cocaine, directing further laboratory analysis.

Example: A field agent applies the Scott reagent to a white powder; the sequential blue-then-pink color changes indicate a presumptive positive for cocaine, which is then submitted for GC-MS confirmation.

Search and Seizure Law¶

The body of law governing when and how law enforcement may search persons, places, or property and seize evidence, balancing government interests in crime investigation with individuals' privacy rights.

Understanding search and seizure law is critical for forensic investigators because improperly obtained evidence may be excluded from court, undermining an entire prosecution.

Example: Police may search a car without a warrant if they have probable cause to believe it contains contraband, making any forensic evidence found therein admissible.

Secretor Status¶

The genetic trait, present in approximately 80% of the population, in which ABO blood group antigens are secreted into body fluids such as saliva, semen, and sweat, allowing blood typing from non-blood biological evidence.

Secretor status expands the range of evidence that can be typed; a secretor's saliva on a cigarette butt, bite mark, or stamp can be ABO-typed, providing investigative information beyond blood alone.

Example: A forensic serologist detects A antigens in saliva recovered from a postage stamp, indicating the person who licked it is a secretor with type A or AB blood, narrowing the suspect pool.

Semen Detection (PSA Test)¶

The identification of semen in sexual assault evidence using the prostate-specific antigen (PSA) test, which detects a protein produced by the prostate gland and present in high concentrations in seminal fluid.

The PSA test is a sensitive and specific confirmatory test for semen that remains positive even in azoospermic (sperm-free) donors, ensuring identification of semen regardless of sperm count.

Example: A forensic biologist performs the PSA test on swabs collected from a sexual assault victim; a positive result confirms the presence of semen and justifies extraction and profiling of male DNA.

Serial Number Restoration¶

The forensic technique of recovering obliterated or filed-off serial numbers from metal objects (firearms, vehicles, equipment) by revealing the residual stress or crystalline differences in the underlying metal using chemical etching or other methods.

Restoring serial numbers provides identifying information that can link a firearm or vehicle to its owner or original purchaser, a critical step in tracing the criminal history of recovered weapons.

Example: Acid etching of the obliterated serial number area on a recovered pistol reveals the original digits through differential metal crystallization, allowing the firearm to be traced to its original sale.

Seven S's of Crime Scene¶

A mnemonic framework for approaching a crime scene that includes: Securing, Separating witnesses, Scanning, Seeing, Sketching, Searching, and Securing evidence, ensuring a systematic and thorough investigation.

Using a structured approach prevents evidence from being overlooked, contaminated, or destroyed before it can be properly documented and collected.

Example: Upon arrival, an officer first secures the perimeter (Securing), then separates bystanders (Separating), then visually surveys the area (Scanning) before moving to documentation.

SHA-256 Hash Function¶

A stronger cryptographic hash algorithm than MD5 that produces a 256-bit (64-character hexadecimal) value, offering greater collision resistance and currently preferred for forensic evidence verification.

SHA-256 is increasingly replacing MD5 in forensic contexts because its collision resistance is stronger, reducing the theoretical risk that two different pieces of evidence could produce the same hash value.

Example: Modern forensic software automatically calculates both MD5 and SHA-256 hashes of evidence drives; SHA-256 provides the higher-security verification now recommended by NIST and forensic standards bodies.

Short Tandem Repeats (STRs)¶

Specific locations (loci) in the genome where short DNA sequences of 2–7 base pairs are repeated in tandem a variable number of times; the number of repeats at each locus varies between individuals and is used for forensic DNA profiling.

STRs are highly variable between individuals, and analyzing multiple loci simultaneously produces extremely discriminating profiles, making STR typing the international standard for forensic DNA identification.

Example: At one STR locus, a suspect has 14 and 17 repeats; the crime scene sample also shows 14 and 17 repeats at the same locus, which is one consistent locus among many compared in a full profile.

Silver Nitrate Development¶

A chemical method for developing latent fingerprints on porous surfaces by reacting with the chloride ions in sweat to form silver chloride, which darkens to visible silver when exposed to light.

Silver nitrate can develop older prints on porous surfaces and is often used sequentially after other techniques like ninhydrin to maximize the number of prints recovered.

Example: After ninhydrin processing fails to reveal prints on aged paper, a technician applies silver nitrate solution; exposure to light causes brown-black ridges to appear where sweat chlorides were deposited.

Simulated Forgery¶

A type of signature or writing forgery produced by carefully drawing or copying the appearance of genuine writing after studying an authentic specimen, often showing evidence of slow, deliberate pen movement.

Simulated forgeries are more deceptive than blind forgeries but typically show signs of unnatural line quality, pen lifts, and retouching that betray the careful drawing process rather than natural writing.

Example: A forged power-of-attorney signature shows slight hesitation marks and retouching around complex letter joins — signs of slow simulation — that are absent in authentic signatures executed at natural writing speed.

Skeletal Anatomy (206 Bones)¶

The complete framework of 206 bones in the adult human skeleton, organized into the axial skeleton (skull, vertebral column, ribs, sternum) and appendicular skeleton (limbs and girdles), each with distinctive morphological features.

Knowledge of complete skeletal anatomy enables forensic anthropologists to identify which bones are present in a commingled burial, assess completeness, and detect trauma or pathological changes.

Example: A forensic anthropologist inventories skeletal remains at an excavation, identifying elements from the 206 adult bones to determine whether remains represent one or multiple individuals.

Slant and Spacing Analysis¶

The forensic measurement of the angle at which letters lean (slant) and the distance between letters, words, and lines in a handwriting sample, which are habitual characteristics that are consistent within a writer's work.

Slant and spacing are among the most consistent handwriting characteristics over time; significant inconsistencies between a questioned sample and known writings suggest different authorship or forgery.

Example: Statistical measurement shows the questioned letter has a mean slant of 15 degrees right, while the suspect's known writings consistently show 25 degrees right slant, suggesting different authors.

Sliding Marks¶

Toolmarks produced when a tool slides across a surface under pressure, leaving parallel striations whose pattern reflects the microscopic irregularities along the tool's cutting or working edge.

Sliding marks (striations) are the most individualizing toolmarks because the tiny irregularities on a tool's edge that produce them are unique to that specific tool, allowing individual source identification.

Example: Striations on wires cut at a crime scene are compared to test cuts from wire cutters recovered from a suspect; the parallel striation pattern from the blades matches, identifying those wire cutters as the source.

Soil Composition Analysis¶

The forensic examination of soil samples to characterize their mineral content, organic matter, particle size, color, and biological components, allowing comparison of samples from different locations.

Soil is highly location-specific in composition, making it a valuable forensic link between suspects, victims, and locations; matching soil profiles can place an individual at a specific geographic spot.

Example: Soil on a suspect's boots contains a rare combination of mineral particles and pollen types that matches the unique soil composition at the burial site, linking the suspect to that location.

Soil pH Measurement¶

The determination of the acidity or alkalinity of a soil sample using a pH meter or indicator, which varies by location based on bedrock, organic content, and land use, serving as a comparative characteristic.

Soil pH is an additional discriminating property that, combined with other compositional data, strengthens the forensic comparison of questioned and known soil samples.

Example: Soil from a suspect's tire treads has a pH of 4.2, matching the highly acidic pH of soil samples taken from the forest burial site and differing from the neutral soil near the suspect's home.

Spalling in Arson¶

The chipping, flaking, or pitting of concrete, stone, or masonry surfaces caused by rapid, intense heating that turns moisture trapped in the material to steam and causes explosive surface fracturing.

Spalling patterns help arson investigators locate areas of most intense heat, which may indicate where accelerants were used or where the fire burned longest, contributing to origin and cause determination.

Example: Deep, extensive spalling of a concrete garage floor near a door is consistent with intense, localized heat from a flammable liquid accelerant pool, guiding sample collection for chemical analysis.

Spiral Search Pattern¶

A search method in which an investigator begins at the outermost boundary and moves inward in a decreasing spiral, or starts at the center and spirals outward, covering circular or irregular areas.

The spiral pattern works well for open areas and bodies of water, providing systematic coverage when grid lines are impractical to establish.

Example: In a field where a body was found, investigators spiral outward from the body to search for footprints, drag marks, or discarded evidence.

SPME Technique¶

Solid-Phase Microextraction, a solvent-free sample preparation technique in which a coated fiber is exposed to headspace vapors above fire debris, adsorbing volatile accelerant compounds onto the coating for subsequent thermal desorption into a GC-MS.

SPME is preferred for accelerant analysis because it is solvent-free, highly sensitive, and concentrates trace-level volatiles from fire debris that may contain very little remaining accelerant after burning.

Example: A SPME fiber is exposed to the headspace of a fire debris sample for 30 minutes; the adsorbed hydrocarbons are then thermally desorbed into a GC-MS, revealing a gasoline pattern at concentrations too low for direct headspace injection.

SSD Forensics¶

The forensic analysis of solid-state drives, which differ from magnetic hard drives in using NAND flash memory, wear leveling, and TRIM commands that can automatically erase deleted data, presenting unique challenges for evidence recovery.

SSD forensics requires specialized knowledge because the TRIM function may immediately overwrite deleted data, preventing recovery; forensic examiners must act quickly and understand SSD-specific architecture for evidence preservation.

Example: A forensic examiner notes that TRIM was enabled on a suspect's SSD, meaning some deleted evidence may be unrecoverable; the examiner documents this limitation and focuses analysis on remaining accessible data.

Stages of Decomposition¶

The progressive breakdown of soft tissues after death, commonly described in five stages: fresh, bloat, active decay, advanced decay, and dry remains, each characterized by specific biological and chemical changes.

Understanding decomposition stages allows forensic investigators to estimate how long a body has been dead (post-mortem interval) and to collect the most appropriate evidence types at each stage.

Example: A body found in the bloat stage with gas-distended tissues and discoloration is estimated to have been dead for several days under summer temperature conditions, guiding the investigative timeline.

Stature Regression Equations¶

Mathematical formulas that calculate predicted living height from the measurements of specific long bones, developed from population studies correlating bone length and stature, and applied with known standard errors.

Stature regression equations translate skeletal measurements into an estimated height range that can be compared to records of missing persons, supporting or excluding potential identifications.

Example: Applying Trotter and Gleser's male regression equation for the femur, a forensic anthropologist calculates a stature estimate of 170 ± 3.27 cm (95% confidence interval) for unidentified male remains.

Steganography¶

The practice of hiding secret information within ordinary, non-secret digital files — such as embedding a text message within the pixel data of an image — to conceal the existence of communication from investigators.

Steganography poses a forensic challenge because hidden data is invisible to casual inspection; specialized tools analyze statistical anomalies in digital files to detect and extract concealed information.

Example: A forensic analyst detects slight statistical irregularities in the pixel values of image files on a suspect's computer; steganography detection software extracts a hidden text file containing criminal communications.

Stringing Technique¶

A bloodstain pattern analysis method in which strings or laser beams are attached to individual stains at their calculated angles and extended back toward a common point, physically demonstrating the three-dimensional area of origin.

The stringing technique makes the area of origin visually tangible for court presentation, providing a physical reconstruction that juries can understand intuitively.

Example: Investigators attach red strings to each spatter stain on a wall at the correct impact angle; the strings converge in a cluster above the floor, marking the three-dimensional area of origin.

Subpubic Angle Measurement¶

The angle formed at the inferior junction of the two pubic bones in the pelvis, measured as less than 90 degrees in males (narrow, V-shaped) and greater than 90 degrees in females (wide, U-shaped).

The subpubic angle is a reliable and easily measured sex indicator in skeletal remains; its consistent dimorphism between male and female pelves makes it one of the primary traits assessed for sex estimation.

Example: Measuring the subpubic angle of an unknown skeleton reveals an angle of 115 degrees, consistent with female morphology and contributing to a female sex estimation.

Surface Tension of Blood¶

The cohesive property of blood caused by intermolecular attractive forces at the liquid surface that resist deformation, influencing the shape of blood drops, the formation of satellite spatter, and the minimum stain size.

Surface tension determines how blood drops form, travel, and behave on impact, directly affecting the size and shape of bloodstains that forensic analysts interpret.

Example: Blood's surface tension keeps a falling drop spherical in flight; when surface tension is overcome on impact, the drop spreads outward and may produce secondary satellite droplets around the main stain.

Synthetic Fibers¶

Man-made textile fibers produced from chemical polymers such as nylon, polyester, acrylic, or rayon, which can be characterized by their cross-sectional shape, refractive index, birefringence, and dye composition.

Synthetic fibers often retain manufacturing characteristics that can narrow their source to a specific producer or product line, and their dye profiles can be highly discriminating.

Example: Blue nylon fibers found on a victim's body are matched to carpet fibers from the suspect's vehicle through microscopic comparison and infrared spectroscopy, placing the victim in the car.

Tented Arch Pattern¶

A fingerprint arch variant in which ridges near the center form a sharp, upright spike or tent-like thrust rather than the gentle wave of a plain arch, and may have a delta or angle at the peak.

Tented arches are classified separately from plain arches because their more complex central structure provides additional points of comparison for fingerprint identification.

Example: An examiner classifies a print as a tented arch because one central ridge thrusts upward abruptly at a sharp angle, forming a tent-like peak unlike the smooth flow of a plain arch.

Terminal Ballistics¶

The branch of ballistics studying what happens when a bullet or projectile impacts and interacts with its target, including wound formation, energy transfer, bullet deformation, and fragmentation.

Terminal ballistics helps forensic pathologists and firearms examiners interpret wound characteristics and predict bullet behavior upon impact, informing reconstruction of shooting events.

Example: Terminal ballistics explains why a hollow-point bullet expands upon impact with soft tissue, creating a larger wound cavity than a full-metal-jacket bullet of the same caliber, informing wound morphology interpretation.

Thin-Layer Chromatography¶

An analytical technique similar to paper chromatography in which the stationary phase is a thin layer of silica or alumina on a glass or plastic plate, providing better resolution and repeatability for forensic comparison of inks, dyes, drugs, and pigments.

TLC offers better separation than paper chromatography and is widely used in forensic document examination and drug analysis; it can separate multiple chemical components with good resolution for visual or instrumental comparison.

Example: TLC comparison of inks from a suspect ransom note and from pens found in a suspect's home shows identical Rf values and colors, suggesting the same pen was used for both.

Toolmark Analysis¶

The forensic examination and comparison of marks left on materials by tools, including impressions (from compression or pressure) and striations (from sliding contact), to identify the class and potentially the individual source tool.

Toolmark analysis links specific tools to crime scenes, connecting crowbars to forced entry marks, wire cutters to cut cables, and scissors to cut fabric, providing physical evidence linking a suspect's tools to the crime.

Example: Striations on a cut padlock shackle are compared under a comparison microscope to test cuts made with a bolt cutter found at a suspect's home; matching striations indicate the same bolt cutter made both marks.

Trace Evidence¶

Extremely small physical materials transferred between a suspect, victim, and environment during a crime, such as hair, fibers, glass fragments, soil, or paint chips, that may link persons or locations.

Because trace evidence is microscopic and often invisible to the naked eye, it is difficult for criminals to be aware of or remove, making it a powerful and reliable investigative tool.

Example: Carpet fibers found on a homicide victim's clothing matched fibers from the suspect's car, placing the victim in the vehicle even though no witnesses saw them together.

Traced Forgery¶

A type of signature forgery produced by tracing over an authentic specimen using transmitted light (light box), carbon paper, or a sharp-pointed instrument to transfer the outline, then inking over the traced lines.

Traced forgeries closely replicate the spatial outline of genuine signatures but reveal themselves through transmitted light examination showing indented lines or pencil underdrawings, and through unnaturally perfect dimensions.

Example: Examination under oblique lighting reveals pencil tracing lines beneath an inked signature on a deed; the tracing is confirmed when the questioned signature's dimensions match the genuine signature to 0.1 mm.

Transfer Bloodstains¶

Stains created when a bloody surface contacts another surface, leaving a mirror image or contact impression of the bloody object, including contact stains, wipes, swipes, and pattern transfers.

Transfer stains can reveal the shape of the object that made contact (a hand, shoe, weapon, or fabric), providing direct evidence of specific items or body parts present at the scene.

Example: A bloody hand print on a wall is a transfer bloodstain that reveals the approximate size of a hand, its orientation, and finger spacing, which can be compared to a suspect's hand.

Triangulation Measurement¶

A crime scene measurement method that locates a point of evidence by measuring its distance from two fixed, known reference points, allowing the evidence's exact position to be accurately plotted on a sketch.

Triangulation provides precise, reproducible location data that can be used to reconstruct evidence positions even after the scene has been cleared.

Example: A shell casing is located by measuring that it is 2.3 m from the north wall corner and 4.1 m from the east wall corner, fixing its position on the sketch.

Ulnar vs Radial Loops¶

The classification of loop fingerprint patterns based on the direction the loop opening faces: ulnar loops open toward the little-finger side (ulna bone), while radial loops open toward the thumb side (radius bone).

Distinguishing ulnar from radial loops is part of the Henry classification system and helps systematically organize fingerprint records to speed up database comparisons.

Example: On the right hand, a loop opening toward the right (pinky side) is an ulnar loop; a loop opening toward the left (thumb side) is a radial loop.

Unrequested Writing Exemplars¶

Handwriting samples that were created by an individual before any investigation began and without awareness of forensic use, such as letters, notes, or forms, which are considered the most natural and unguarded writing samples.

Unrequested exemplars are more reliable than requested ones because the writer was not trying to disguise their natural writing style, providing the truest comparison standard for handwriting analysis.

Example: Personal letters written years before the crime are collected as unrequested exemplars; because the suspect was not trying to control their writing, these samples best represent their natural handwriting habits.

Urine Detection¶

The identification of urine in forensic samples using tests for urea and creatinine — compounds present in high concentrations in urine — helping establish the nature of a biological stain at a scene.

Detecting urine can be forensically significant in cases of sexual assault, arson (where urine may have been left at the scene), or to challenge the claimed source of a biological stain.

Example: A technician tests a stain on a mattress using a creatinine colorimetric assay; the high creatinine concentration confirms the stain is urine, which is then profiled for DNA from epithelial cells.

V-Pattern Burn Indicators¶

Characteristic V-shaped scorch or burn marks on walls that narrow toward the fire's origin point, formed because fires burn upward and outward from their start, producing an upward-tapering triangular pattern.

V-patterns help investigators pinpoint the approximate location of fire origin on vertical surfaces; a narrow V at the base widens as the fire spread upward, with the narrowest point nearest the ignition site.

Example: A V-pattern on a living room wall narrows to a point at baseboard level near an electrical outlet, directing investigators to examine that outlet as the possible fire origin.

Volatile vs Non-Volatile Data¶

The distinction between volatile data (such as RAM contents, running processes, network connections) that is lost when power is removed, and non-volatile data (files on hard drives, SSDs) that persists after power-down.

Investigators must prioritize collecting volatile data before shutting down a running system because it cannot be recovered afterward, while non-volatile data can be captured through forensic imaging of powered-down storage.

Example: A forensic examiner arrives at a scene with a running computer and first captures RAM contents using a memory acquisition tool before powering down the system to preserve the volatile data.

Warrant Requirements¶

The legal standards that must be met before a court will issue a search warrant, including a sworn statement of probable cause, specific description of the place to be searched, and items to be seized.

Proper warrant procedures protect the integrity of forensic evidence by ensuring it was collected lawfully and will not be subject to suppression motions at trial.

Example: A detective writes a warrant affidavit explaining that a witness saw the suspect enter a house with a bloody bag, providing probable cause to search for a weapon or bloody clothing.

Watermarks and Threads¶

Two currency security features: watermarks are images or patterns embedded in genuine paper during manufacture, visible when held to light; security threads are embedded plastic or metallic strips woven into the paper with microprinting.

Both watermarks and security threads are extremely difficult to replicate with consumer printing equipment, making their absence or incorrect appearance strong indicators of counterfeit documents.

Example: A bank teller suspects a $50 bill and holds it to light; genuine notes show a watermark portrait and a security thread with "USA 50" microprinting, both of which are absent in the suspected counterfeit.

Whorl Subtypes¶

The four recognized categories of whorl fingerprint patterns: plain whorls (concentric circles), central pocket loops (a loop enclosing a whorl), double loops (two interlocking loops), and accidental whorls (irregular patterns not fitting other categories).

Identifying the correct whorl subtype is essential for accurate classification in fingerprint databases, as different subtypes are indexed differently in systems like the Henry Classification.

Example: An examiner identifies a fingerprint as a double loop whorl because two separate loop formations are intertwined within the pattern, meeting the specific criteria for that subtype.

Wipe vs Swipe Stains¶

A wipe occurs when a clean object moves through an existing blood deposit, disturbing and smearing the pattern; a swipe occurs when a bloody object moves across a clean surface, depositing a tapered or directional transfer.

Distinguishing wipes from swipes reveals the sequence of events — whether blood was present before or deposited during contact — helping reconstruct what happened and the direction of movement.

Example: A smeared bloodstain on a door handle where the original edge pattern is disrupted is a wipe, suggesting someone moved their hand through blood already present on the handle.

Wound Morphology¶

The study of the size, shape, and characteristics of wounds in the skin and underlying tissues resulting from different injury mechanisms (sharp force, blunt force, gunshot), used to determine the type of weapon and manner of injury.

Wound morphology allows forensic pathologists to identify the type and nature of the weapon used, link a specific weapon to injuries, and distinguish between homicide, suicide, and accidental injury patterns.

Example: A wound with clean, parallel incised edges and no tissue bridging is consistent with sharp force trauma from a single-edged blade, while a wound with tissue bridging suggests a serrated or irregular implement.

Write-Blocker Hardware¶

A physical device inserted between a storage medium and the examination computer that allows data to be read for forensic imaging while blocking all write commands, preventing any modification to the original evidence.

Write blockers are essential tools that protect the integrity of digital evidence; without them, connecting a drive to a computer might alter metadata, timestamps, or file records, compromising the evidence.

Example: Before imaging a seized hard drive, a forensic examiner connects it through a hardware write blocker; the device allows forensic software to read all data while ensuring no write operations can alter the original drive.

Y-STR Analysis¶

Forensic DNA profiling of short tandem repeats located on the Y chromosome, inherited paternally and used to identify or profile the male contributor in mixed samples such as sexual assault evidence.

Y-STR analysis is especially valuable in sexual assault cases when the male contributor's DNA is a small fraction of a mixed sample dominated by the victim's DNA, allowing specific identification of the male lineage.

Example: In a sexual assault case where sperm fraction separation yields limited male DNA, Y-STR analysis successfully profiles the male contributor because the Y-chromosome markers are not confounded by the victim's DNA.

Zone Search Pattern¶

A search method in which a large area is divided into smaller sections (zones), each assigned to a different searcher or team, allowing large areas to be searched thoroughly and efficiently.

Zone searching allows multiple investigators to work simultaneously without duplicating effort or missing areas, speeding up coverage of large crime scenes.

Example: A warehouse is divided into four zones; each zone is assigned to a different forensic team to ensure systematic, thorough coverage of the entire space.