Module 1: The Science and the Scene
The Wrenfield case opens: a forced back door at a small hardware store and, upstairs, the owner found dead. The module sets out what forensic science is and what crime labs actually do, how a scene is secured and recorded, and what it really means to say that two things match.
A Break-In, a Death and a Science of Questions
- Describe what forensic science is and what publicly funded crime laboratories spend most of their time on.
- State Locard's exchange principle and explain why it does not promise that evidence of contact will be found.
- Separate observations from inferences in scene notes, and list competing hypotheses before testing them.
Monday, 7:40 a.m., 14 Dock Street
At 7:40 on a Monday morning in late September, Dana Whitcomb walked down the alley behind Corran Hardware and Marine in the lakeside town of Wrenfield to open up, as she had done for six years. The back door stood a hand's width open. The lower pane of its glass was gone, and pieces of it glittered on the step and on the floor tiles inside. Dana did not go in. She backed out to the street, called 911 at 7:43, and waited by the front window until the first patrol officer arrived at 7:51.
That decision to stay out is the first piece of good forensic practice in this course, and Dana is not a scientist. Every step she did not take into the store is a step that did not crush a glass fragment, smear a drop or lay her own shoe print over someone else's.
The officer looked through the doorway without crossing it. Behind the counter a steel cash drawer hung open with its edge bent, and a line of dark drops ran across the floor. The owner, Walter Penhallow, 76, lived alone in the flat above the store, reached by a separate stair door that he kept locked. His daughter Ruth, who lives out of state, had not been able to reach him all weekend and had asked a neighbour to look in on him. Dana had a spare key. At 8:05 two officers went up for a welfare check and found Walter dead in his armchair. They confirmed it, touched nothing else, stepped back out and called the medical examiner's office.
So two things happened at one address, and nobody yet knows whether they are connected. Wrenfield and everyone in it are invented for this course: the town, the store, the people and the evidence. The methods used to investigate them are real, and so are their limits. You will work this case from the first phone call to the final report.
What makes a science forensic
Forensic science is the use of scientific methods to answer questions that arise in a legal setting: what this white powder is, whether this mark could have been made by that tool, roughly when this person died. The word describes the use, not a separate kind of science. A chemist who identifies a powder in a university lab and a chemist who identifies the same powder in a crime lab may run the same instrument. The second one knows her result may be read aloud in a courtroom and attacked by a lawyer whose job is to find its weaknesses.
The 2009 report of the National Academy of Sciences, which you will study closely in Module 7, stressed how mixed the field is. Some forensic disciplines are "laboratory based," the committee wrote, naming DNA analysis, toxicology and drug analysis. Others are "based on expert interpretation of observed patterns," naming fingerprints, writing samples, tool marks and bite marks. That split runs through this whole course. A laboratory measurement usually comes with a known uncertainty. A pattern judgement is only as trustworthy as the testing of the people who make it, and for several disciplines that testing came late or has still not been done.
Key idea: Forensic science is ordinary science applied to legal questions, and its disciplines differ widely in how thoroughly their methods have been tested. Every lesson asks two questions of a method: what does it measure, and how do we know it works?
What crime labs actually spend their time on
Television suggests forensic scientists spend their days at murder scenes. The federal Bureau of Justice Statistics counts what they actually do. Its census of publicly funded crime laboratories found 326 labs and multilab systems, 423 individual laboratories in all, which received about 3.3 million requests for analysis in 2020. A request is one submission of evidence to one section of a lab, so a single case can produce several.
| Type of request, 2020 | Requests received | Share of all requests |
|---|---|---|
| Controlled substances (identifying seized drugs) | 1,088,000 | 32.5% |
| DNA databasing (reference samples from arrested or convicted people) | 671,000 | 20.1% |
| Toxicology (drugs, alcohol and poisons in body samples, living or dead) | 629,000 | 18.8% |
| Forensic biology casework (body fluids and DNA from case evidence) | 339,000 | 10.1% |
| Firearms and tool marks | 225,000 | 6.7% |
| Latent prints | 180,000 | 5.4% |
| Crime scene analysis | 144,000 | 4.3% |
| Trace evidence (gunshot residue, explosives, hair, fibres, fire debris) | 34,000 | 1.0% |
| Digital evidence | 27,000 | 0.8% |
| Impressions (shoe and tyre prints) | 7,000 | under 0.5% |
| Questioned documents | 2,000 | under 0.5% |
Read the table from the top. A third of all requests were chemistry on seized drugs, and another fifth were routine reference DNA samples from people arrested or convicted, which are profiled and stored in databases. Toxicology was nearly a fifth. The hair, fibre and glass work that fills crime dramas sits inside a trace evidence category of about one request in a hundred. At the end of 2020 the labs also carried a backlog of about 710,900 requests that had not been completed within 30 days. A real crime lab is a busy chemistry and biology workplace with a queue, and most of its results concern drugs, not murders.
Every contact leaves a trace, but not every trace is found
The idea under most of this course is usually called Locard's exchange principle, after the French criminologist Edmond Locard. Forensic guidelines state it in one line: "whenever two objects come into contact, a transfer of material will occur." The intruder in Wrenfield touched a door, a drawer and a floor. If the principle holds, something of the store left on the intruder, and something of the intruder stayed behind: fibres from clothing, skin cells, soil from boots, perhaps blood from a cut on broken glass.
Now read the principle as carefully as a scientist would. It says a transfer occurs. It does not say the transfer is large enough to detect, that it survives the next hour, or that the person who arrives later will find it. The scientific working group that wrote the FBI's fibre guidelines put the limit plainly: finding no fibres "does not de facto mean that no contact occurred." Transferred material is shed, brushed off, washed off or buried under later contact. So the absence of trace evidence is weak evidence that no contact happened.
The presence of trace evidence also has to be explained, because material arrives by innocent routes too. A hair on the floor of the shop where Dana has worked for six years is not, by itself, a clue to anything. That is why investigators collect samples from the people who belong at a scene, so their traces can be recognised and set aside.
Key idea: Contact transfers material, but detection is never guaranteed, and innocent contact leaves traces too. Both halves of that sentence matter in almost every lesson that follows.
Observation is not inference
Crime scene investigator Sam Ostrowski arrived at 8:40 and began writing notes before he touched anything. The discipline of those notes is the discipline of the whole field: write down what you observe, and keep what you infer separate and labelled as inference. Here are five of Sam's observations beside the conclusions they tempt you toward.
| What Sam wrote | The tempting inference | Why it is not yet safe |
|---|---|---|
| Lower glass pane of back door broken; fragments on interior tiles and on exterior step | Someone broke in from the alley | Fragments fly both ways when glass breaks. Lesson 8 shows how marks on the broken edges reveal the side of impact. |
| Trail of dark red-brown drops, about 1 cm across, from door to counter and back | The burglar cut a hand on the glass | Nothing has been tested. The drops may not be blood, may not be human, and may not be the intruder's. Lessons 10 and 11. |
| Cash drawer open; aluminium lip bent with paired dents | Pried open with a screwdriver | The dents record the shape of a tool's working edge, not its name. Lesson 17. |
| Reddish clay smear with part of a tread pattern on tiles inside the door | The intruder came from the Millrace building site | The same clay may lie under half the town. Lesson 9. |
| Brown hair, about 6 cm, on the floor inside the door | The burglar's hair | Dana works here every day. Lesson 6. |
None of the inferences in the middle column is foolish, and some will turn out to be true. They stay out of the notes because a written inference stops being questioned. If Sam labels an evidence bag "burglar's blood," every analyst who later handles that item reads the conclusion before doing the test, and some will see what they expect. The FBI's own fingerprint error in 2004, which you will study in Lesson 5, began with examiners who knew what they were hoping to find.
The point: Notes record what anyone standing there could have seen. Interpretations are useful, but they belong in a separate, labelled place, and they get tested before anyone relies on them.
Two events, one address: start with more than one hypothesis
By 9:30 Detective Sergeant Alma Reyes had a theory, and it was a reasonable one: a burglar broke in on Sunday night, the old man upstairs heard it or was confronted, and the fright or the struggle killed him. If that is true, the break-in is a far more serious crime. But at 9:30 the evidence fits at least three accounts.
- Connected: the intrusion caused or hastened Walter's death.
- Separate, death first: Walter died of natural causes before the break-in, and the intruder may never have known anyone was upstairs.
- Separate, death later: the break-in came first and Walter died afterwards of something unrelated.
A good investigation writes the competing hypotheses down before results come back, then asks which observations would come out differently under each one. Some observations barely help. The stair door to the flat was found locked, which counts against an intruder having gone upstairs, but says nothing about whether Walter heard glass break. The observation that would separate the three accounts is time. If the medical examiner can show that Walter died well before Sunday night, the first and third accounts fail, whatever anyone suspects. Lessons 13 to 15 do exactly that work.
Testing rival hypotheses is also what protects people. The same reasoning that can tie a burglar to a scene can show that a person accused of causing a death did not cause it. When forensic work has gone badly wrong, as Module 7 documents, it has usually been because someone began with one answer and looked only for support.
Key idea: List rival explanations first, then look for the evidence that would separate them. A theory that has only been confirmed has not yet been tested.
Your lab notebook, and the rules for labs in this course
This is a laboratory course, and every lesson ends with something to do with your hands. Start a lab notebook today: a bound notebook rather than loose paper, written in pen. Each entry gets the date, the question you were testing, the materials, what you did in the order you did it, and what you saw, with units. When you make a mistake, draw a single line through it so it can still be read, and initial it. Never tear out a page. A notebook kept this way can be checked by someone you will never meet, which is the same reason a crime scene investigator's notes and a lab's bench records are kept the way they are.
The labs use safe household materials only. You will never use real blood or other body fluids, and you will not use luminol or any other forensic reagent at home. Where a technique needs a school laboratory and a teacher, the lesson says so plainly; do not improvise it. Crime and death appear because forensic science exists to deal with them, but they are handled the way a careful medical examiner writes about them: briefly, accurately and without graphic detail.
Where the course goes from here
Lesson 2 secures and records the Wrenfield scene, and Lesson 3 asks what it would really mean for a boot, a fibre or a fingerprint to match. Modules 2 to 6 take the evidence one kind at a time: fingerprints, then hair, fibres, glass and soil, then blood and DNA, then the body itself through toxicology, time-of-death estimates, insects and bones, then tool marks and digital evidence. Module 7 reads the national reviews that asked which of these methods had ever been properly tested. Module 8 closes the case with a written report and looks at the careers behind each method.
Common misconceptions
- "Forensic scientists mostly work murder scenes." In the 2020 census a third of all requests were drug identifications, and crime scene work was about 4 percent of requests. Most forensic scientists work in laboratories on drugs, toxicology and DNA.
- "Locard's principle means a careful search always finds evidence of contact." The principle says material transfers. It does not promise that the amount is detectable or that it survives. Finding nothing proves little.
- "The forensic scientist's job is to prove the suspect did it." The job is to report what the evidence supports. The same methods exclude people, and an exclusion is one of the most valuable results a laboratory can produce.
- "Everything found at a scene is evidence of the crime." A scene holds the traces of everyone who belongs there, including employees, residents and the first responders themselves. Lesson 2 explains how elimination samples sort those out.
What to carry forward
- Forensic science applies ordinary scientific methods to legal questions; its disciplines range from laboratory measurement to expert judgement of patterns, and they differ in how well they have been tested.
- Publicly funded US crime labs received about 3.3 million requests in 2020; a third were seized-drug analyses, a fifth reference DNA samples and nearly a fifth toxicology.
- Locard's principle says contact transfers material. It does not say the material will be found, and traces from innocent contact are expected at every scene.
- Scene notes record observations. Inferences are labelled, kept separate and tested.
- Write down rival hypotheses before results come back. In Wrenfield the time of Walter's death will decide between them.
Sources
- Brooks, C. (2023). Publicly funded forensic crime laboratories, 2020 (NCJ 306473). Bureau of Justice Statistics, U.S. Department of Justice. Highlights, definitions and Table 1. bjs.ojp.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Chapter 1, "What is forensic science?", pp. 38-39. Copy hosted by the National Criminal Justice Reference Service. ojp.gov
- Deedrick, D. W., & Koch, S. L. (2004). Microscopy of hair part 1: A practical guide and manual for human hairs. Forensic Science Communications, 6(1). Federal Bureau of Investigation. Section "Methods of hair recovery," which quotes the working group's statement of Locard's principle. archives.fbi.gov
- Scientific Working Group on Materials Analysis. (1999). Introduction to forensic fiber examination. In Forensic fiber examination guidelines, chapter 1, sections 3.0 and 5.3. Forensic Science Communications, 1(1). Federal Bureau of Investigation. archives.fbi.gov
- Key terms
- forensic science
- The use of scientific methods to answer questions that arise in legal proceedings.
- crime laboratory
- A laboratory that analyses evidence for the justice system; most US labs are publicly funded and much of their work is drug, toxicology and DNA analysis.
- Locard's exchange principle
- The principle that contact between two objects transfers material between them; it does not promise the material will be detected.
- trace evidence
- Small transferred materials such as hair, fibres, glass, soil, paint and gunshot residue.
- observation
- What anyone at the scene could see or measure, recorded without interpretation.
- inference
- A conclusion drawn from observations; in forensic work it is labelled and tested before anyone relies on it.
- hypothesis
- A proposed explanation that makes predictions the evidence can confirm or rule out.
- backlog
- In the BJS census, a lab request not completed within 30 days of submission.
Securing and Documenting the Scene
- Put the first officer's duties at a scene in priority order and explain why boundaries start wide.
- Document a scene with notes, overall, midrange and close-up photographs, and a sketch measured by triangulation or rectangular coordinates.
- Choose a search pattern, package evidence so it survives (paper for biological items), and keep an unbroken chain of custody with elimination and control samples.
Fifty-seven minutes on Dock Street
Between the 911 call at 7:43 and the moment crime scene investigator Sam Ostrowski lifted the first piece of glass at 10:40, almost three hours passed in which nobody collected anything. That is not slowness. It is the order of work that federal guidance sets out for every scene, and each hour had a job. This lesson walks the Wrenfield store through that order from the first officer to the sealed evidence bags, then changes one condition to show how the order bends.
The guidance comes mainly from two US Department of Justice documents written by working groups of investigators and lab scientists: Crime Scene Investigation: A Guide for Law Enforcement, published by the National Institute of Justice in 2000, and its 2013 revision from the Bureau of Justice Assistance. Both are federal works, so you can read them free in full.
Step 1: the first officer arrives
The 2000 guide opens with a principle that sounds obvious and is constantly broken: "One of the most important aspects of securing the crime scene is to preserve the scene with minimal contamination and disturbance of physical evidence." But it does not put evidence first. The first officer's priorities run in this order:
- Safety. Is anyone dangerous still there? Is there a hazard such as a gas smell? The guide tells officers to assume the crime is ongoing until they know otherwise.
- Emergency care. Anyone who might be alive gets medical help, even if that means paramedics walk through evidence. The officer guides them by the least damaging path and notes what they moved.
- Control of people. Witnesses are identified and kept apart so their accounts stay independent. Bystanders are moved out. Family members are, in the guide's words, controlled "while showing compassion."
- Boundaries. Then the officer sets the edges of the scene.
At 7:51 Officer Ruiz checked the store from the doorway, called out, and heard nothing. Dana stayed on the sidewalk and Ruiz wrote down what she told him before she had time to talk it over with anyone. After the welfare check upstairs at 8:05, the officers knew there were two scenes at one address, the store and the flat, and that neither held anyone who needed rescue.
The boundary rule is the one most worth remembering: set the boundary wider than you think you need. The guide explains why. Boundaries "can be reduced in size if necessary but cannot be as easily expanded." If you tape off only the store and later learn the intruder dumped something in the alley bins, those bins have spent two hours unprotected. Ruiz taped the alley from Dock Street to the corner, closed the store's front entrance, and put the stair door to the flat under its own guard.
Inside the boundary the guide's list of forbidden acts is long and specific: no smoking, eating or drinking, no using the toilet or the telephone, no adjusting the thermostat, no opening windows, no touching anything that does not need touching. Each forbidden act either adds material to the scene or changes it. A thermostat matters more than you might think here: in Lesson 15 the temperature in the upstairs flat becomes evidence.
Step 2: a log and a walk-through
From the moment the tape went up, an officer at the alley entrance kept a scene log: the name, agency, purpose and time in and out of every person who crossed the line. The log is dull and indispensable. When a defence lawyer later asks whether anyone could have carried something into the store, the answer is in the log, and so is the list of people whose shoes, fingerprints and hair might legitimately be inside.
When Detective Sergeant Reyes and Sam arrived, Ruiz briefed them, then Sam made a walk-through along a single path chosen to avoid the drop trail: in through the front door, along the wall, to a point where he could see the counter and the back door. He did not pick anything up. The walk-through is for planning: what is there, what is fragile, where the paths of entry and exit probably ran, and what needs protecting first.
Step 3: document before you touch
Documentation has three parts, and each catches what the others miss.
Notes record times, conditions and things a camera cannot capture: the smell of the room, the temperature, whether lights were on, which doors were locked. Sam noted that the back-door deadbolt was in the open position, the alley light was off, and the room felt cool, with a wall thermostat reading 64 degrees Fahrenheit.
Photographs go from general to specific. The 2013 guide calls for overall, midrange and close-up coverage: overall shots of the alley and the room to show the layout, midrange shots that place each item relative to something fixed, and close-ups of each item, taken first without a scale and then with one. The second close-up needs a ruler in the frame, because a photo with no scale cannot be measured later. For impressions such as the clay boot print, the camera sits on a tripod looking straight down, 90 degrees to the surface, because any tilt stretches the image. And the guide is blunt about one rule: when using a digital camera, "never delete a photograph." A deleted frame leaves a gap in the numbering that someone will ask about.
Sketches record measured positions. A photograph shows what a room looked like; a sketch, done properly, lets someone who was never there put every item back in its place. The 2013 guide describes four ways to fix positions:
| Method | How it works | Best for |
|---|---|---|
| Rectangular coordinates | Measure from the item to two walls or edges that meet at a right angle. | Rooms with square corners |
| Triangulation | Measure from each of two fixed points to the item, forming a triangle. | Indoors or outdoors where straight edges are lacking |
| Polar coordinates | Measure distance and compass angle from one fixed reference point. | Open outdoor scenes with a single landmark |
| Transecting baseline | Lay one tape across the area; measure out from it at right angles. | Crowded scenes with many items |
Sam used triangulation from two fixed points: the hinge corner of the back door frame (point A) and the left end of the counter (point B). The glass shard with a red-brown drop on its edge lay 62 cm from A and 3.10 m from B. Those two numbers and the known distance between A and B fix one position on the floor. A tape measure from each point, swung as an arc, crosses in only one place on the shop side of the line.
Remember: Notes, photographs and a measured sketch together let someone who was never at the scene reconstruct it, and nothing is moved until all three are done.
Step 4: search in a pattern
People searching without a plan look where they expect to find things, which is exactly how unexpected evidence gets missed. The 2013 guide names four patterns.
- Lane or strip: searchers walk side by side along parallel lanes, each about an arm's length wide.
- Grid: a lane search done twice, the second time at right angles to the first. It takes about twice as long and misses less.
- Zone: the area is divided into smaller zones, each searched methodically, which suits rooms and small spaces.
- Spiral: inward or outward. The guide warns that an outward spiral starts by walking to the centre, which can destroy evidence on the way in.
Sam treated the store as zones: the back door and the 2 m inside it, the aisle, the counter and the office. The alley got a lane search by two officers. The order inside each zone followed the guide's two rules for priority: collect the most transient evidence first, and move from the least intrusive method to the most intrusive, so that an early technique does not spoil a later one. Fingerprint powder on the thumb-turn, for example, comes after any swab for DNA from the same surface.
Step 5: collect, package, label and seal
Every item gets its own container, a label and a seal. What the container is made of depends on what the item is, and the most important rule concerns biological material. The National Institute of Standards and Technology's handbook on preserving biological evidence says to use "paper bags, manila envelopes, cardboard boxes, and similar porous materials for all biological evidence," and warns that plastic is not preferred because of "the possibility of bacterial growth or mold." Moisture trapped in plastic lets bacteria grow, and bacteria degrade DNA. Wet items are air-dried first.
| Wrenfield item | How it was collected | Container |
|---|---|---|
| 1. Glass from the door, inside and outside fragments kept apart | Gloved fingers or plastic forceps, after photographs | Rigid boxes, padded, one for each side of the door |
| 2. Drops on the floor | Each drop photographed with a scale, then swabbed with a sterile, slightly moistened swab and air-dried; a control swab taken from clean tile nearby | Paper swab boxes in a paper envelope |
| 2A. Glass shard with a drop on its edge | Lifted whole by its faces, not its edges | Rigid box, so the drop is not rubbed |
| 4. Navy fibres on the glass edge in the frame | Clean forceps | Folded paper bindle inside an envelope |
| 5. Brown hair | Clean forceps | Paper bindle |
| 6. Clay boot impression | Photographed at 90 degrees with a scale, then samples of the clay taken | Small rigid containers; known samples later from the alley and building sites |
| 7. Cash drawer with pry marks | The whole drawer, so the marks travel untouched | Box, with the marked lip protected |
| 8. Alley camera recording | Secured at once; copied by a digital examiner | Lesson 18 |
The control swab from clean tile deserves a word. If the floor cleaner on those tiles reacts with a test, the lab needs to know it. A control sample, in the 2000 guide's definition, is material of known source that was presumably uncontaminated, used to check that the surface itself does not interfere with testing.
Each container is labelled with the case number, item number, description, where it was found, date and time, and the collector's initials. It is sealed with evidence tape, and the collector writes initials and the date across the tape so that opening the package would visibly break the seal.
Step 6: the chain of custody
A chain of custody is the written history of who had an item, from the moment it was collected until it appears in court. The 2000 guide defines it as a record of "the chronological history of the evidence," including who collected it and each person who later had custody, with dates. If item 2A goes from Sam to the evidence locker at 3:15 p.m., to a courier the next morning, to the DNA section of the state lab, every hand-off is signed and timed.
The point is not paperwork for its own sake. When the DNA result is read in court, the jury needs to know that the shard tested in the lab is the shard lifted from 14 Dock Street and not some other item that sat beside it. A gap in the chain does not prove tampering, but it lets a reasonable person doubt that the item is what the label says.
Step 7: the people who belong there
The 2000 guide defines an elimination sample as one "of known source taken from a person who had lawful access to the scene," giving examples such as fingerprints from occupants and shoe impressions from emergency medical staff. In Wrenfield the list included Dana's fingerprints and a few of her hairs, both officers' shoe soles, and, through the medical examiner, Walter's fingerprints. Elimination samples protect the investigation from chasing the innocent. When a print on the cash drawer turns out to be Dana's, as one will in Lesson 5, it is set aside in minutes instead of becoming a mystery.
Remember: Package biological items in paper, give every item its own sealed and labelled container, sign every hand-off, and collect samples from everyone who legitimately belongs at the scene.
Change one condition: rain at eleven
Now run the same procedure with one change. Suppose the forecast at 9:00 a.m. had called for heavy rain at 11:00, and the clay boot impression had been on the concrete step outside the back door instead of on the tiles inside. The steps do not change, but the order does. The 2000 guide tells officers to protect evidence from "the elements (rain, snow, wind)" and to concentrate on "the most transient evidence" first. The outside impression becomes the most transient item at the scene. Sam would photograph it at 90 degrees with a scale immediately, cover it with a clean box weighted against the wind, and take clay samples before the rain, while the dry glass inside could wait.
Change a different condition: suppose Officer Ruiz had stepped in two of the drops on his first look. That is not a disaster if it is recorded. The guide says to document "circumstances that require departures from usual procedures." Ruiz's shoes would be photographed and kept as elimination items, the smeared drops photographed and noted as altered, and the report would say so. What damages a case is not an honest mistake. It is a mistake that is hidden and discovered later by the other side.
Common misconceptions
- "Investigators should collect the evidence as fast as possible." Documentation comes first, because an item's position is evidence too, and it is lost the moment the item is lifted. The exception is transient evidence under threat, such as an impression about to be rained on, which is photographed and protected first.
- "Plastic bags keep evidence cleaner." For biological evidence plastic traps moisture, and the resulting bacterial growth can degrade DNA. Paper and other breathable containers are the standard.
- "A tight boundary keeps the scene manageable." A boundary can shrink later, but evidence outside it may be lost before anyone thinks to expand it. Start wide.
- "A mistake at the scene ruins the case." A recorded mistake can be accounted for. An unrecorded one, found later, undermines trust in everything else.
The short version
- The first officer's order is safety, emergency care, control of people, then boundaries set wider than seems necessary.
- A scene log records every person who enters; a walk-through plans the work without touching anything.
- Documentation comes before collection: notes, overall, midrange and close-up photographs with and without scale, and a sketch fixed by triangulation, rectangular coordinates, polar coordinates or a baseline.
- Search in a pattern (lane, grid, zone or spiral), take transient evidence first, and use the least intrusive methods first.
- Biological items go in paper after air-drying; every item is sealed, labelled and tracked by a chain of custody.
- Elimination samples from people with lawful access, and control samples from unstained surfaces, let the lab interpret what it finds.
Sources
- Technical Working Group on Crime Scene Investigation. (2000). Crime scene investigation: A guide for law enforcement (NCJ 178280). National Institute of Justice, U.S. Department of Justice. Section A (initial response, safety, emergency care, persons, boundaries), Section C (documentation, prioritising and collecting evidence) and glossary entries for chain of custody, control sample and elimination sample. ojp.gov
- National Forensic Science Technology Center. (2013). Crime scene investigation: A guide for law enforcement (rev. ed.). Bureau of Justice Assistance, U.S. Department of Justice. Section C, sketch measurement methods, photography and crime scene search methods. nist.gov
- Technical Working Group on Biological Evidence Preservation. (2013). The biological evidence preservation handbook: Best practices for evidence handlers (NISTIR 7928). National Institute of Standards and Technology. Sections on drying wet evidence and packaging best practices. nvlpubs.nist.gov
- Key terms
- scene boundary
- The marked edge of a crime scene; set wide at first because it can be reduced later but not easily expanded.
- scene log
- A record of every person who enters or leaves a scene, with times and purpose.
- walk-through
- An initial look along a chosen path to plan the work, without collecting or moving anything.
- triangulation
- Fixing an item's position by measuring its distance from two fixed points.
- transient evidence
- Evidence likely to change or disappear soon, such as an impression exposed to rain; it is documented and protected first.
- chain of custody
- The written chronological record of everyone who has had an item of evidence, from collection to court.
- elimination sample
- A sample of known source from someone with lawful access to the scene, used to recognise and set aside their traces.
- control sample
- Material of known source from an unstained area, used to check that the surface itself does not affect a test.
- bindle
- A folded sheet of clean paper used to hold small trace items such as hairs and fibres.
What a Match Means: Class, Individual and Probability
- Distinguish class characteristics from individual characteristics, and exclusion from inclusion and inconclusive results.
- Calculate how many people in a population share a feature, and express the strength of a match as a likelihood ratio.
- Recognise the prosecutor's fallacy and the defence attorney's fallacy, and explain why a method's false positive rate limits what any declared match can prove.
The problem: a boot print in red clay
On the floor tiles just inside the back door of the Wrenfield store, Sam Ostrowski photographed a smear of reddish clay with part of a boot tread in it: a zigzag pattern of bars across the ball of the foot, a horseshoe-shaped heel block, and the edge of a logo. A footwear examiner later recognised the design as the sole used on work boots from a manufacturer we will call Ironvale. Because only the front two-thirds of the print survived, the examiner could say only that the boot was somewhere between size 9 and size 11.
Eleven days later, investigators will hold a pair of Ironvale boots in size 10. Detective Sergeant Reyes will ask the question every investigator asks: does it match? Before you answer, you need to know what an answer would mean. This lesson works that out, because the same reasoning applies to fibres, glass, soil, tool marks, fingerprints and DNA. Every comparison method in this course produces a result that has to be weighed in exactly this way.
Class and individual characteristics
Forensic guidelines draw a basic line between two kinds of features. Class characteristics are, in the words of the FBI's materials working group, "traits that define a group of items collectively." The zigzag tread, the heel shape and the size range are class characteristics: every Ironvale sole of that model and size shares them. Individual characteristics are traits that would set one item apart from all others. On a shoe sole they are the cuts, nicks, embedded stones and worn patches that a particular boot picks up by chance as it is worn. Examiners call them randomly acquired characteristics.
A comparison can end three ways:
- Exclusion. If the suspect's boot has a different tread design, it did not make the print. Exclusions on class characteristics are usually the strongest and simplest results a comparison produces.
- Inclusion. If the tread design and size agree, the boot could have made the print, along with every other boot of that design and size. The language you will hear is "consistent with" or "could have been the source of."
- Inconclusive. If the impression is too poor, or the features neither clearly agree nor clearly differ, the honest answer is that the comparison cannot decide.
In the Wrenfield print, the clay smear is too smeared to show cuts or stones. So the best possible result is an inclusion on class characteristics. The next question is how much an inclusion is worth.
Counting who else matches
The value of a class match depends on how common the class is. Suppose, as an invented but realistic figure for this mock case, the relevant population is the 9,000 men aged 16 to 70 living within a short drive of Dock Street, and records from local shops suggest that about 2 percent of them own Ironvale boots in sizes 9 to 11. Then:
Number of possible sources = 9,000 x 0.02 = 180 men.
A suspect whose boots share the class characteristics is one of about 180 men in the area whose boots would also have been "consistent with" the print. That is the clearest way to see the meaning of an inclusion: it moves the suspect from a pool of 9,000 into a pool of 180. That is real information. It is not identification.
The figure of 2 percent is the frequency of the feature in the population. In DNA work the matching idea is called the random match probability: the chance that a person picked at random from the relevant population would share the feature. Lesson 11 calculates one for a DNA profile, where the number is so small that the pool of other possible sources shrinks to nearly nothing. For the boot it is 1 in 50.
The point: An inclusion on class characteristics means the item belongs to a group, and the size of that group decides how much the inclusion is worth.
Two tempting mistakes
Picture the trial. A prosecutor says: "Only 2 percent of men in the area own boots like these, so there is only a 2 percent chance the defendant is innocent." It sounds like arithmetic. It is wrong, and the error has a name, the prosecutor's fallacy, from a 1987 study by the psychologists William Thompson and Edward Schumann.
Here is the mistake. The 2 percent is the probability that an innocent man picked at random would own such boots. The prosecutor has turned it around into the probability that a man who owns such boots is innocent. Those are different questions, and the difference is huge. Of the 180 men who own the boots, at most one made the print. If the boot print were the only evidence, the chance that any particular owner made it would be about 1 in 180, not 98 in 100.
Now the defence lawyer stands up: "There are 180 men with boots like these. My client is just one of 180. The evidence is worthless." That is the defence attorney's fallacy, named in the same study. Before the boot comparison, the suspect was one of 9,000; now he is one of 180. The evidence has made it fifty times more likely that he is the source than it was before. On its own that is not enough to convict anyone. Added to other, independent evidence, it can matter a great deal.
The point: The probability of the evidence if the suspect is innocent is not the probability that the suspect is innocent. Keep the two directions apart and both fallacies disappear.
A better way to say how strong a match is: the likelihood ratio
Forensic statisticians express the strength of evidence by comparing two probabilities. How probable is this observation if the suspect's item is the source? How probable is it if some other item is the source? The ratio of the two is called the likelihood ratio, LR.
For the boot, the observation is "the suspect's boot has the same tread design and size range as the print."
- If the suspect's boot made the print, its class features must agree: probability 1.
- If some other boot made the print, the suspect's boot would agree only by coincidence, which happens for 2 percent of boots: probability 0.02.
LR = 1 / 0.02 = 50. A careful report would say: the observed agreement is about 50 times more probable if the suspect's boot made the print than if another boot from the area did. Notice what it does not say. It does not claim to know whether the suspect is guilty, because that depends on everything else in the case.
The likelihood ratio has a useful property. Multiply it by the odds you held before the evidence, and you get the odds after. Before the boot evidence, if the print-maker is one of 9,000 men and nothing else is known, the odds that it was this suspect are 1 to 8,999. After the boot evidence, they are 50 to 8,999, or about 1 to 180. That is the same answer as counting owners, reached a second way. Lesson 11 shows that for a single-source DNA profile the likelihood ratio is simply 1 divided by the random match probability, which is why DNA ratios run into the billions.
When the matcher can make mistakes
So far we have pretended that the comparison itself is perfect. It is not. A person or a machine declares the match, and declarations can be wrong. The President's Council of Advisors on Science and Technology, whose 2016 report you will study in Lesson 20, defined the two numbers every comparison method needs:
| Measure | Definition | What it tells you |
|---|---|---|
| Sensitivity | How often the method declares a match when the two items really share a source | How often true matches are found |
| False positive rate | How often the method declares a match when the two items come from different sources | How often the method wrongly links an innocent source |
These are measured by testing examiners on pairs where the right answer is known, and they are laid out as a two-by-two table of true positives, false positives, false negatives and true negatives. For a declared match, the likelihood ratio becomes sensitivity divided by false positive rate. Suppose a method has a sensitivity of 0.95 and a false positive rate of 0.01. A declared match is then worth an LR of 95. If the false positive rate were 0.05, the same declaration would be worth only 19, however rare the matching features might be. PCAST put the point directly: the false positive rate "will often be the mathematically determining factor in the method's probative value."
Error rates also have to be measured on enough trials. PCAST gave an example worth remembering: if a study finds no false positives in 25 tests, the true false positive rate "might be as high as roughly 1 in 9." A small, clean study proves less than it seems to. That is why PCAST asked for upper confidence bounds, the highest rate consistent with the data, to be reported rather than the most flattering estimate.
The point: No match can be stronger than the method that declares it. A method's tested false positive rate sets a ceiling on what any match it declares can prove.
Back to the Wrenfield boot
Now you can write the answer the detective needs before anyone examines a boot. If the investigators' boot has a different tread, it is excluded, and that is strong. If it shares the design and size range, it is included along with roughly 180 other pairs in the area: an LR of about 50 for that observation, worth adding to the case but nowhere near identifying a person. And no one should claim more from the smeared Wrenfield print. The 2009 National Academy of Sciences report found no consensus on how many individual characteristics footwear examiners need before declaring an identification, and the 2016 PCAST report found no appropriate empirical studies supporting identifications of particular shoes from randomly acquired marks.
The same report also pushed on the word everyone wants to hear. The idea of individualization, that an item can be tied to one source and no other, should give way, the committee wrote, to "a probabilistic association," with other possible sources not completely discounted. You will see that change in language spread through the field in Module 7.
Common misconceptions
- "Consistent with means it matched, so it came from that source." Consistent with means the item could have been the source, along with everything else that shares those features. Always ask how many others would also be consistent.
- "If a feature is rare, a match proves guilt." A rare feature makes a match strong evidence that the item is the source. Whether the person is guilty depends on the rest of the case, including innocent explanations for how the item got there.
- "An expert who has never made a mistake has an error rate of zero." An error rate is measured by testing on known answers. Experience without that testing measures nothing, and even a clean study needs a confidence bound.
- "Weak evidence is worthless evidence." An LR of 50 does not convict anyone, but it is not zero. Independent pieces of modest evidence can combine into a strong case, which is why each one must be weighed honestly rather than inflated or dismissed.
Where this leaves us
- Class characteristics place an item in a group; individual characteristics, such as randomly acquired marks, may narrow it further if the method has been tested.
- Comparisons end in exclusion, inclusion or inconclusive. Exclusions on class features are usually the strongest results.
- The worth of an inclusion depends on how many other items share the features: population times frequency.
- The likelihood ratio compares the probability of the evidence if the suspect's item is the source with its probability if another item is. Prior odds times LR gives posterior odds.
- The prosecutor's fallacy flips the probability of the evidence given innocence into the probability of innocence; the defence attorney's fallacy dismisses evidence that genuinely narrows the field.
- Sensitivity and false positive rate, measured with confidence bounds, set a ceiling on the strength of any declared match.
Sources
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Executive Office of the President. Appendix A, "Statistical issues" (sensitivity, false positive rate, confidence bounds, Bayesian analysis); footnote 178 on likelihood ratios; Finding 7 on footwear analysis. obamawhitehouse.archives.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Chapter 5, impression evidence summary assessment, p. 149; Chapter 6, on replacing individualization with probabilistic association, pp. 184-185; footnote citing Thompson and Schumann (1987). ojp.gov
- Scientific Working Group on Materials Analysis. (1999). Introduction to forensic fiber examination, section 3.0, terminology for class and individual characteristics. In Forensic fiber examination guidelines. Forensic Science Communications, 1(1). Federal Bureau of Investigation. archives.fbi.gov
- Thompson, W. C., & Schumann, E. L. (1987). Interpretation of statistical evidence in criminal trials: The prosecutor's fallacy and the defense attorney's fallacy. Law and Human Behavior, 11, 167-187. Cited here for the names of the two fallacies, as referenced in the National Research Council report; the article itself was not available to open.
- Key terms
- class characteristic
- A feature shared by a whole group of items, such as a tread design or a shoe size.
- individual characteristic
- A feature that could set one item apart from others, such as a cut acquired by one shoe sole during wear.
- exclusion
- A result showing the item could not have been the source, for example because its tread design differs.
- inclusion
- A result showing the item could have been the source, along with every other item sharing the observed features.
- random match probability
- The chance that a person or item picked at random from the relevant population would share the observed features.
- likelihood ratio
- The probability of the evidence if the suspect's item is the source divided by its probability if another item is the source.
- prosecutor's fallacy
- Treating the probability of the evidence given innocence as if it were the probability of innocence.
- false positive rate
- How often a method declares a match between items that truly come from different sources.
- sensitivity
- How often a method declares a match between items that truly share a source.
Module 2: Fingerprints
How friction ridge skin forms before birth, how invisible prints are made visible on different surfaces, and how examiners compare them. The module follows two Wrenfield prints, one on a brass thumb-turn and one on a steel drawer, and uses the FBI's 2004 Madrid misidentification to show what the method can and cannot promise.
Friction Ridges: How Prints Form and How They Are Found
- Explain how friction ridge skin forms before birth and why its pattern persists through life.
- Describe Level 1, 2 and 3 detail, the main pattern types and the common minutiae.
- Choose a development method from the surface type (porous or nonporous), and explain what an AFIS search does and does not produce.
A brass thumb-turn
The deadbolt on the back door of the Wrenfield store has a small brass thumb-turn on the inside. With the lower pane of glass gone, anyone standing in the alley could reach through the frame and turn it. When Sam Ostrowski shone a flashlight across the brass at a low angle, he saw a faint oval smudge with a hint of curved lines in it. On the front of the steel cash drawer behind the counter he found a second smudge, a partial print near the edge where a hand would pull.
Neither print could be seen in ordinary light. Before either could be compared with anyone's fingers, it had to be made visible without destroying it, and the right way to do that depends on what the print is made of and what it is sitting on. This lesson works through both prints and then changes the surface to show how the method changes with it.
Skin built for grip
The skin on your fingertips, palms and the soles of your feet is different from the skin on your arm. It is raised into ridges, called friction ridges, separated by furrows. Along the top of each ridge runs a line of sweat pores. The NIJ's Fingerprint Sourcebook, written by examiners and scientists for the profession, notes that the fluid from these eccrine sweat glands is 99.0 to 99.5 percent water. The rest is mostly salts and amino acids. When you touch a surface, you leave a copy of your ridges drawn in that residue, often mixed with oils picked up from touching your face or hair.
The ridges form before birth. According to the Sourcebook, the features that make each finger's pattern distinct are established between about 10.5 and 16 weeks of gestation, as ridges grow in the skin over small swellings on the fingertips called volar pads. The size, shape and timing of those pads shape the overall pattern, and countless small random variations in growth set the fine details. Genes influence the general pattern, which is why relatives' prints are more alike than strangers'. But the details are not dictated by genes. Identical twins share their DNA, yet a 1982 study of 196 pairs of twins found that variations in their minutiae "still permit their differentiation."
The pattern then persists. The ridges are anchored in the deeper layers of the skin, which keep regenerating the same surface structure as old cells are shed, so the same pattern grows larger with the hand but does not rearrange. Damage that reaches the deeper layer leaves a permanent scar, which becomes a new feature of its own.
The 2009 National Academy of Sciences report summarised the evidence carefully: "some scientific evidence supports the presumption" that friction ridge patterns are unique to each person and persist through life. Notice the honest wording. And notice what that premise does not settle. Even if every finger in history differs from every other, a smudged partial print on a brass knob may not carry enough detail to show which finger made it. That second question, how much information a particular latent print holds and how reliably examiners read it, is the subject of Lesson 5.
What matters here: Friction ridge detail forms before birth and persists for life, and fingerprints are very likely distinct even between identical twins. But uniqueness of fingers does not guarantee that a partial print can be traced to one of them.
Three levels of detail
Examiners describe a print at three levels, a scheme you will meet again in the FBI's own reports.
| Level | What it describes | Examples |
|---|---|---|
| Level 1 | Overall ridge flow and pattern, visible to the naked eye | Loops, whorls and arches; the core and delta points |
| Level 2 | The paths of individual ridges and where they deviate | Ridge endings, bifurcations (where one ridge splits into two), dots and short ridges |
| Level 3 | Tiny features of the ridges themselves | Ridge edge shapes, ridge widths, pore positions |
Level 1 sorts prints into broad groups. A loop has ridges that enter from one side, curve around and leave on the same side, with one delta, a small triangle where ridges diverge. A whorl has circular or spiral ridges and two deltas. An arch has ridges that flow in one side and out the other with a rise in the middle and no delta. A loop that opens toward the little finger, an ulnar loop, is the most common pattern of all. Level 1 alone can exclude a source: an arch cannot have been made by a finger with a whorl. It cannot identify one.
Level 2 features, often called minutiae or points, carry most of the weight in comparisons. A full fingertip has many of them; a partial latent may show only a handful. Level 3 is the finest and the least reliable to record. An FBI study of the persistence of ridge detail, reported by the Department of Justice Inspector General in 2011, found that Level 3 features are present on the skin but are "not consistently reproduced" from one impression to the next, even between impressions captured on the same day.
Visible, pressed or hidden
The Sourcebook sorts prints into three kinds by how they appear.
- A patent print is visible to the eye: a greasy print on a window, or one left in paint, ink, mud, dust or blood. It needs only to be photographed.
- A plastic print is pressed into something soft, such as putty, soft wax, clay or wet paint, leaving a three-dimensional mould of the ridges. It is photographed with light from a low angle and can be cast.
- A latent print, from the Latin for hidden, cannot be seen until a physical or chemical process makes its residue visible. Both Wrenfield prints are latent.
Whether a latent print is left at all depends on more than contact. The Sourcebook lists conditions before, during and after the touch: how much residue was on the skin, the texture and temperature of the surface, the pressure and any sliding, and what happened to the surface afterwards. A light touch on a rough or wet surface may leave nothing usable. So the absence of a print proves little, which is Locard's principle again from Lesson 1.
Surface first: choosing a development method
The most important question in developing a latent print is what the surface is made of, because that decides where the residue sits.
| Surface type | Examples | Where the residue sits | Typical methods |
|---|---|---|---|
| Nonporous | Glass, metal, plastics, painted wood | On the outermost surface, easily wiped | Powder and tape lift; cyanoacrylate fuming in the lab |
| Porous | Paper, cardboard, untreated wood | Soaked into the material | Amino acid reagents such as ninhydrin, in the lab |
| Semiporous | Glossy magazine covers, some finished wood | Partly on, partly in | Methods for both kinds |
Powder sticks to the moist, oily residue on a nonporous surface. A soft brush carries a little fine powder across the area in light strokes; the ridges pick up powder and the furrows stay clean. The developed print is photographed with a scale, then lifted with clear adhesive tape and placed on a card of contrasting colour. The Sourcebook notes that powder works best on fresh prints, because the residue is nearly all water when it is deposited and dries out quickly.
Cyanoacrylate fuming uses the vapour of the same chemical as superglue. In a closed chamber, the vapour polymerises on the print residue and builds a hard white deposit along the ridges, which can then be photographed, dyed or powdered. It is a laboratory technique with fume controls. Do not try it at home; school labs that teach it use a fume hood and a teacher.
Ninhydrin reacts with amino acids. Siegfried Ruhemann made it by accident in 1910 and noticed it turned skin purple; it was first applied to fingerprints in 1954 and became one of the most widely used methods for paper. Because amino acids soaked into paper stay put, ninhydrin can reveal prints that are years old, appearing as purple ridges, a compound now called Ruhemann's purple. It is a laboratory reagent, not a home one.
Order matters too. Methods run from least to most destructive, each step photographed before the next. And because a fingerprint brush can carry DNA from one surface to another, biological swabs from a surface come before powder on it.
Working the Wrenfield prints
Here is how Sam processed the two prints, following that logic.
- Drawer handle (item 9). Before any powder went near the drawer, he swabbed the handle for touch DNA with a sterile swab and packaged it in paper.
- Drawer front (item 3B), painted steel, nonporous. He photographed the area, tested his black powder on an unmarked corner of the drawer to set the amount, then brushed the smudge. A partial print with clear ridge flow and several minutiae appeared. He photographed it with a scale, lifted it with tape onto a white card, and labelled the card.
- Thumb-turn (item 3A), brass, nonporous and small. Brushing a small curved knob risks smearing the only print on it. Sam photographed it under oblique light, then removed the whole thumb-turn assembly, packaged it so nothing touched the knob, and sent it to the lab. There it was fumed with cyanoacrylate, which fixed the residue in place, and then photographed. The developed print showed a loop pattern and a cluster of minutiae near the core.
Change the surface. Suppose the intruder had also handled the paper envelope that held Walter's bank deposit slips. Paper is porous. Powder would barely work on dried residue soaked into paper, but ninhydrin applied in the lab might bring up purple ridges hours later, even if the envelope had been handled weeks before. Same principle, different chemistry, because the residue is in a different place.
What matters here: The surface decides where the residue sits, and that decides the method: powder or cyanoacrylate for nonporous surfaces, amino acid reagents for porous ones, always least destructive first and DNA before powder.
AFIS proposes; a person decides
Once a latent print is developed, how do you find whose it might be? If there is a suspect, the examiner compares the latent with that person's known prints, called exemplars, taken under controlled conditions. If there is no suspect, the examiner can search a database. An Automated Fingerprint Identification System, AFIS, stores digital known prints. The examiner marks features on the latent print, the software compares that pattern with millions of stored prints, and it returns a ranked list of the closest candidates. In 2011 the FBI's national system held the criminal fingerprints of more than 67 million people, and its searches returned lists of 10 or 20 candidates for an examiner to check by eye. The FBI was then moving to an upgraded system, called Next Generation Identification.
The most important thing to understand about AFIS is what a candidate list is. It is a list of the stored prints that look most like the latent. It is not a list of matches. If the person who left the print has never been fingerprinted, the list still has a first place, held by whoever in the database happens to look most similar. The bigger the database, the more likely it is that someone in it will look very similar by chance.
In Wrenfield, the thumb-turn latent was searched in the state AFIS. At the top of the candidate list was Jonah Pruitt, 31, whose prints were on file because of a burglary conviction four years earlier. Detective Reyes was pleased. Lesson 5 is about what the examiner did next, and why it mattered that she was not told why the detective was pleased.
Common misconceptions
- "Fingerprints are proven unique, so a fingerprint match is certain." Uniqueness is a claim about fingers. Whether a partial, smudged latent print carries enough reliable detail to identify a finger is a separate question about the print and the examiner, and it has a measured error rate.
- "The computer matches the fingerprint." AFIS produces a ranked list of similar candidates. A trained examiner makes every comparison and conclusion, and the top candidate may not be the source.
- "Anyone who touches something leaves a usable print." Residue, pressure, surface texture and later handling all decide whether a usable print is left. Many touches leave nothing identifiable.
- "Identical twins have identical fingerprints." They share DNA, but the fine detail of friction ridges forms through random variation in fetal development, and twins' prints can be told apart.
Pulling it together
- Friction ridges on fingers, palms and soles carry rows of sweat pores; a latent print is a copy of the ridges drawn in residue that is mostly water.
- Ridge detail is set between about 10.5 and 16 weeks of gestation through random developmental variation, and it persists for life.
- Level 1 is the pattern (loops, whorls, arches), Level 2 the minutiae, Level 3 the finest ridge detail, which reproduces inconsistently.
- Prints are patent, plastic or latent. Nonporous surfaces take powder or cyanoacrylate; porous surfaces take amino acid reagents such as ninhydrin, a lab-only chemical.
- Process least destructive first, swab for DNA before powdering, and photograph every stage.
- AFIS returns a ranked list of similar prints, not matches; a person makes every comparison.
Sources
- National Institute of Justice. (2011). The fingerprint sourcebook (NCJ 225320). U.S. Department of Justice. Chapter 2 (anatomy and sweat composition), Chapter 3 (embryology, 10.5 to 16 weeks), Chapter 5 (automation and candidate lists), Chapter 7 (types of prints, surfaces, powders, ninhydrin, cyanoacrylate) and Chapter 14 (twin studies). ojp.gov
- U.S. Department of Justice, Office of the Inspector General. (2011). A review of the FBI's progress in responding to the recommendations in the Office of the Inspector General report on the fingerprint misidentification in the Brandon Mayfield case. Chapter One, sections III and IV (levels of detail, IAFIS, the permanence study). oig.justice.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Chapter 5, friction ridge analysis, pp. 136-145. ojp.gov
- Key terms
- friction ridges
- The raised ridges of skin on fingers, palms and soles, lined with sweat pores.
- latent print
- A print that cannot be seen until a physical or chemical process makes its residue visible.
- patent print
- A visible print, such as one left in paint, ink, dust or grease.
- plastic print
- A three-dimensional print pressed into a soft material such as putty, wax or clay.
- minutiae
- Level 2 features where ridges end, split or form dots and short ridges; the main features used in comparisons.
- volar pads
- Small swellings on the fetal fingertips and palms whose shape and timing influence the ridge pattern.
- cyanoacrylate fuming
- A laboratory method in which superglue vapour polymerises on print residue on nonporous surfaces.
- ninhydrin
- A laboratory reagent that reacts with amino acids in print residue on paper to form purple ridges.
- AFIS
- Automated Fingerprint Identification System: software that searches stored prints and returns a ranked list of similar candidates.
- exemplar
- A known print taken from a person under controlled conditions, for comparison.
Comparing Prints: ACE-V, Error Rates and the Mayfield Case
- Describe the four phases of ACE-V and the three conclusions an examiner can reach.
- Trace the causes of the FBI's 2004 misidentification of Brandon Mayfield as the DOJ Inspector General reported them.
- Interpret the false positive rates from the black-box studies PCAST relied on, and explain how linear analysis and blind verification guard against bias.
The wrong answer we start from
Here is a belief that was stated in American courtrooms for most of the twentieth century and that many people still hold: when a trained fingerprint examiner says two prints match, the match is certain. Examiners testified to it. The 2016 PCAST report collected some examples, including testimony by a former head of the FBI's fingerprint unit that the FBI had "an error rate of one per every 11 million cases," and a study in which mock jurors estimated the false positive rate of fingerprint analysis at 1 in 5.5 million.
This lesson starts from that belief and takes it apart step by step, using the best-documented fingerprint error in history. Then it shows what the field changed, what the error rate turned out to be when someone finally measured it, and how the Wrenfield thumb-turn print was handled because of all that.
How an examiner works: ACE-V
Latent print examiners follow a method called ACE-V, for Analysis, Comparison, Evaluation and Verification. The FBI Laboratory's version, as the Department of Justice Inspector General described it in 2011, runs like this.
- Analysis. The examiner studies the latent print alone: its pattern, its minutiae, its distortion, and its quality. The goal is to decide whether it is "of value," meaning it holds enough reliable information to support a conclusion. A print that is too smeared or partial is declared of no value, and that is the end of it.
- Comparison. The examiner places the latent print beside a known print and compares them feature by feature, tracing ridges in sequence from a common starting point.
- Evaluation. The examiner reaches one of three conclusions: identification (the prints came from the same source), exclusion (they did not), or inconclusive. The FBI requires no minimum number of matching points. An identification is declared when, in the FBI's words, the examiner would not expect to see that much agreement from two prints of different sources.
- Verification. A second qualified examiner repeats the examination. The FBI requires verification of every identification.
Read step 3 again. There is no counting rule and no measured threshold. The decision rests on the examiner's trained judgement of whether the agreement is "sufficient." The 2009 National Academy of Sciences report was blunt about that: ACE-V is a broadly stated framework that "does not guard against bias" and does not guarantee that two analysts following it will reach the same result.
Madrid, 2004: the trace
On 11 March 2004, bombs on commuter trains in Madrid killed almost 200 people and injured more than 1,400. Spanish police recovered a plastic bag of detonators near the attack and sent digital images of fingerprints from it to the FBI. What follows is drawn from the Inspector General's 2006 and 2011 reports.
On 15 March an FBI examiner searched one of the latent prints, labelled LFP 17, through the FBI's national fingerprint database, which returned a list of 20 candidate prints. The examiner came to believe one of them matched. The computer had ranked it fourth. He concluded that LFP 17 came from the left index finger of the person on that card. A unit chief agreed. A retired FBI examiner working on contract verified it. The person was Brandon Mayfield, an attorney in Portland, Oregon. The FBI's own inquiries soon found no evidence that he had recently travelled abroad, and his passport had expired.
On 13 April the Spanish National Police reported that their own examination of Mayfield's prints was negative. The FBI sent an examiner to Madrid to explain its identification. In May, the FBI arrested Mayfield as a material witness. A court-appointed fingerprint expert examined the prints and agreed with the FBI. About two weeks after the arrest, the Spanish police told the FBI they had identified the source of LFP 17: an Algerian man, Ouhnane Daoud. The FBI compared Daoud's prints, withdrew its identification, and Mayfield was released after 14 days in custody. The FBI apologised to him and his family.
Now trace the wrong answer, "four experts agreed, so it must be right," through the Inspector General's findings.
| Step in the reasoning | What actually happened |
|---|---|
| The database found him, so his print must be similar for a reason. | A search of tens of millions of prints is designed to find the most similar ones. The Inspector General named "unusual similarity" between Daoud's and Mayfield's prints as a primary cause. The larger the database, the more likely a close non-match. |
| The examiner saw the features in the latent print. | The examiner used features he saw in Mayfield's known print to change his reading of the latent, which the report called "circular reasoning." |
| The fine detail agreed. | Examiners relied on Level 3 detail without allowing for the poor quality of the latent or for differences in Level 3 detail elsewhere in the print. |
| Differences were explained. | The report found reliance on "inadequate explanations" for differences between the prints. |
| Three more experts checked it. | The verifiers knew the first examiner's conclusion. That is not an independent test. |
| The Spanish negative report was considered. | The Laboratory failed to reexamine the identification after it. |
The Inspector General also examined whether Mayfield's religion played a part. It found that the examiners did not know he was Muslim when they made and verified the identification. Whether what they learned later contributed to the failure to reconsider was, the report said, "a more difficult question," and one examiner admitted that for someone else the Laboratory might have revisited the identification with more care.
Bottom line: The Mayfield error was made by skilled examiners following accepted practice. The causes were a very similar non-matching print from a huge database, reasoning backwards from the known print, overreliance on unreliable fine detail, and verification that was not blind.
What bias looks like in an experiment
If context can push experts toward a wrong identification, it should be possible to show it under controlled conditions. In a 2006 study by the psychologist Itiel Dror and colleagues, described in the PCAST report, five experienced examiners were given pairs of prints they themselves had judged to match in real cases about five years earlier. This time they were told, falsely, that the pair was the one the FBI had wrongly matched in a famous case. Although told to ignore that information, four of the five no longer judged the prints to match.
That is a tiny study, and PCAST said so: too small to measure how large the effect is in casework. Its value was to show that the effect exists among real experts examining real prints. FBI scientists' own later work found something related: examiners tend to mark more minutiae in a latent print after they have seen a matching exemplar, which is the circular reasoning of the Mayfield case showing up in ordinary practice.
Measuring the error rate at last
A claim of near-zero error can only be tested by giving examiners problems where the true answer is known and counting their mistakes, a black-box study, so called because it measures what goes in and what comes out without asking how the examiner reasoned. The first large one was carried out by FBI scientists and the research company Noblis, partly in response to the 2009 National Academy report, and published in 2011.
| Study, as summarised by PCAST | Design | False positives | Upper 95 percent bound |
|---|---|---|---|
| FBI and Noblis, 2011 | 169 examiners, 744 latent-known pairs; non-matching pairs chosen to be close database hits | 6 in 3,628 conclusive comparisons of non-matching pairs, about 1 in 604 | About 1 in 306 |
| Miami-Dade Police Department, 2014 | Funded by the National Institute of Justice | 42 in 995, about 1 in 24 | About 1 in 18 |
The FBI study also found that true matches were correctly identified about 92.5 percent of the time, so some true matches were missed or left inconclusive. In 2016 PCAST concluded that latent print analysis is a "foundationally valid subjective methodology," but with a false positive rate that is "substantial and is likely to be higher than expected by many jurors." Because examiners knew they were being tested, PCAST added, the rate in casework could be higher still. The Department of Justice argued that the Miami-Dade rate was unlikely to apply to the FBI Laboratory, whose verification procedures would catch such errors. PCAST answered that this had not been tested.
There is good news in the FBI study too. Its authors noted that most of the six false positives were on problems where nearly every other examiner reached the right answer, which suggests a truly independent second examiner would have caught them.
What changed: linear ACE-V and blind verification
After Madrid, the FBI Laboratory changed its procedures, and the Inspector General's 2011 follow-up reported the results. Examiners must now complete and document their analysis of a latent print before they look at any known print, a "linear" ACE-V that blocks reasoning backwards from the exemplar. Certain cases get blind verification, in which the second examiner does not know the first examiner's conclusion. Training changed as well: the ACE-V portion of new examiners' training went from about four hours to six weeks of a six-month curriculum.
PCAST added two refinements. Blind verification only works if verifiers cannot guess what they are checking, so they should receive a mix of identifications, exclusions and inconclusives. And laboratories should manage the flow of information so that examiners are not exposed to irrelevant facts about the case, such as a confession or a suspect's record.
The Wrenfield thumb-turn, done properly
When the thumb-turn latent came back from AFIS with Jonah Pruitt at the top of the list, Detective Reyes phoned the lab to say that Pruitt had a burglary record and fitted the case. The lab's case manager took the call and passed on none of it. The examiner received the latent image, the instruction to compare it with the candidate exemplars, and nothing else.
She worked linearly. First she analysed the latent alone and documented its features: a loop opening to the right, a clear core, nine reliable minutiae in the core area, poor detail toward the edges. She declared it of value. Then she compared it with Pruitt's ten-print card. His right thumb, the most likely candidate for a hand reaching through a door, was a loop, and some ridge flow looked similar, but in the core area two minutiae she had marked before seeing his print fell where his print showed continuous ridges, and the ridge count from core to delta differed. She concluded exclusion, and a verifier who did not know her conclusion reached the same result.
Eleven days after the break-in, Corey Vance was arrested after a DNA result you will meet in Lesson 11, and his fingerprints were taken. The same examiner compared the thumb-turn latent with his ten-print card and reached an identification to his right thumb, and a blind verifier, given the pair among other test pairs, agreed. Meanwhile the partial print on the cash drawer had been identified to Dana Whitcomb's right index finger using her elimination prints, which surprised no one who has ever watched her open the drawer.
Look at what the procedure protected. If the examiner had been told about Pruitt's record and the detective's confidence, the Mayfield pattern was available: a similar print, a suspect who fits, and pressure to agree. The exclusion of Pruitt is as important a result as the identification of Vance.
Bottom line: Fingerprint comparison works far better than chance and fails at a measurable rate. Linear analysis, information management and genuinely blind verification are the protections, and a report should state the measured error rates rather than certainty.
Common misconceptions
- "Fingerprint examiners never make mistakes." Black-box studies found false positive rates with upper bounds of about 1 in 306 and 1 in 18, and the Mayfield case shows that skilled examiners can agree on a wrong answer.
- "If several experts agree, the conclusion has been independently confirmed." Agreement is only independent if each examiner reached a conclusion without knowing the others'. Mayfield's verifiers knew.
- "A higher AFIS score means a likelier match." The score measures similarity to the encoded features. Mayfield's print was ranked fourth; the true source was not in the database at all.
- "Knowing more about the case helps the examiner." Facts such as a suspect's record are irrelevant to whether two ridge patterns agree, and studies show such context can sway expert judgement.
Looking back
- ACE-V runs analysis, comparison, evaluation and verification, and ends in identification, exclusion or inconclusive. The FBI uses no minimum point count.
- In 2004 the FBI wrongly identified Brandon Mayfield from a print on Madrid bomb detonators; the error was confirmed by three FBI examiners and a court-appointed expert before Spanish police identified Ouhnane Daoud.
- The Inspector General's causes: unusual similarity, circular reasoning from the known print, overreliance on Level 3 detail, inadequate explanations of differences, and failure to reexamine.
- Black-box studies, as PCAST summarised them, found false positive rates of about 1 in 604 (upper bound 1 in 306) and 1 in 24 (upper bound 1 in 18).
- Linear ACE-V, information management and blind verification reduce the risk of bias-driven error.
- In Wrenfield the AFIS top candidate, Pruitt, was excluded; the thumb-turn print was later identified to Vance and the drawer print to Dana.
Sources
- U.S. Department of Justice, Office of the Inspector General. (2006). A review of the FBI's handling of the Brandon Mayfield case (unclassified and redacted). Executive summary and chapter 2, the IAFIS search and verification. oig.justice.gov
- U.S. Department of Justice, Office of the Inspector General. (2011). A review of the FBI's progress in responding to the recommendations in the Office of the Inspector General report on the fingerprint misidentification in the Brandon Mayfield case. Chapter One: ACE-V procedures, causes of the error, training and research. oig.justice.gov
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Section 5.4 (latent fingerprint analysis, black-box and cognitive-bias studies) and Finding 5. obamawhitehouse.archives.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Friction ridge analysis summary assessment, pp. 142-143. ojp.gov
- Ulery, B. T., Hicklin, R. A., Buscaglia, J., & Roberts, M. A. (2011). Accuracy and reliability of forensic latent fingerprint decisions. Proceedings of the National Academy of Sciences, 108(19), 7733-7738. Figures in this lesson are as reported by PCAST; the article was not opened directly.
- Dror, I. E., Charlton, D., & Peron, A. E. (2006). Contextual information renders experts vulnerable to making erroneous identifications. Forensic Science International, 156, 74-78. Described as summarised by PCAST; the article was not opened directly.
- Key terms
- ACE-V
- Analysis, Comparison, Evaluation and Verification: the framework latent print examiners follow.
- of value
- An analysis-phase judgement that a latent print holds enough reliable detail to support a conclusion.
- identification
- An examiner's conclusion that two prints came from the same source.
- circular reasoning
- Using features seen in a known print to reinterpret the latent print, a cause of the Mayfield error.
- black-box study
- A test that gives examiners problems with known answers and counts their correct and incorrect conclusions.
- contextual bias
- The influence of irrelevant case information, such as a suspect's record, on an expert's judgement.
- linear ACE-V
- Completing and documenting the analysis of the latent print before viewing any known print.
- blind verification
- Verification by a second examiner who does not know the first examiner's conclusion.
Module 3: Trace Evidence
Hair, fibres, glass and soil: the small materials that move between people and places on contact. Each lesson asks what the examination can actually establish, from the FBI's admission of widespread errors in hair testimony to why a match on common window glass or local clay narrows the field without naming anyone.
Hair: What the Microscope Can and Cannot Say
- Describe the cuticle, cortex and medulla, and compare human hair with animal hair under the microscope.
- Explain the hair growth phases and which hairs can yield nuclear DNA, mitochondrial DNA or neither.
- Summarise what the FBI's 2015 review and later research found about microscopic hair comparison testimony, and state what a hair comparison can honestly support.
One brown hair, 6 centimetres long
Item 5 from the Wrenfield store is a single brown hair, about 6 cm long. It was picked off the floor tiles just inside the broken back door with clean forceps and folded into a paper bindle. Two people could plausibly have left it: the intruder, or Dana Whitcomb, who has worked in the store for six years. A hair is a common find at any scene, because people shed head hairs all day. This lesson sets three ways of examining a hair side by side: microscopy, mitochondrial DNA and nuclear DNA. The honest answer about Item 5 depends on knowing what each one can do.
It also tells the story of how microscopic hair comparison was used in American courts for decades, and what the FBI admitted in 2015. That history is the clearest example in this course of a technique that was useful in the laboratory and badly overstated in the witness box.
What a hair is made of
The FBI's 2004 guide to hair microscopy, written by two of its examiners, defines a hair as a slender outgrowth from a follicle in the skin of mammals, made mainly of the protein keratin. Apart from the living cells at its root, a hair is dead, hardened tissue. Under the microscope it has three regions.
| Region | What it is | What examiners look at |
|---|---|---|
| Cuticle | A translucent outer layer of overlapping scales, all pointing from root to tip | Scale pattern; thickness; damage from dyeing, bleaching or backcombing |
| Cortex | The main body of the hair, made of long spindle-shaped cells | Pigment granules and how they are spread; air spaces called cortical fusi; colour along the length |
| Medulla | A central core of cells, which may be absent, broken or continuous | Whether it is present; its width relative to the whole hair; its structure |
Comparison 1: human hair against animal hair
The first question about any hair is whether it is human, and microscopy answers it well. The FBI guide lists the differences.
| Feature | Human head hair | Typical animal hair |
|---|---|---|
| Colour along the shaft | Fairly even from root to tip | Often banded, with sharp colour changes over a short distance |
| Pigment distribution | Even, or slightly denser toward the cuticle | Denser toward the centre, near the medulla |
| Medulla width | Usually less than one third of the hair's diameter, amorphous, often absent or broken | Usually more than one third, continuous and regularly structured, such as the ladder pattern of rabbit hair |
| Cuticle scales | Flattened, overlapping (imbricate) | Variable: crown-like in some rodents and bats, petal-like (spinous) in cats and mink, which never occur on human hair |
| Root | Commonly club-shaped | Highly variable |
Microscopy can also usually tell which part of the body a human hair came from. Scalp hair tends to be long, soft and of moderate width; eyebrow hairs are short and curved like a sabre. It can show whether a hair was cut, broken, dyed or bleached. All of that is useful, and none of it is controversial. Item 5, under the microscope, is plainly a human head hair: imbricate scales, a narrow broken medulla, even brown pigment, a tip cut at an angle.
Comparison 2: shed, growing, or in between
Hairs grow in cycles: a growing phase (anagen), a short transition (catagen), and a resting phase (telogen) at the end of which the hair falls out naturally. The phase shows at the root, and it decides whether the hair can give a full DNA profile.
| Root appearance | Phase | Usual way it left the body | DNA prospects |
|---|---|---|---|
| Hard, bulb-shaped club with little or no tissue attached | Telogen (resting) | Shed naturally | Little or no nuclear DNA; mitochondrial DNA from the shaft |
| Soft, stretched, often with tissue attached | Anagen (growing) | Pulled out by force | Root tissue may give a nuclear DNA profile |
| Bulb with a tag of tissue | Catagen (transition) | Pulled or shed | Variable |
| No root, just a cut or broken end | Any | Cut or broken | Mitochondrial DNA only |
The FBI guide puts the DNA point simply: hairs with large roots and tissue are promising sources of nuclear DNA. Most hairs found at scenes are shed telogen hairs, which have no tissue to offer. Their shafts do carry mitochondrial DNA, a small circular chromosome found in the mitochondria. As the National Human Genome Research Institute's glossary explains, offspring inherit their mitochondria, and so their mitochondrial DNA, from their mother. That makes mitochondrial DNA useful and limited at the same time. It can exclude a person. But a match is shared by that person's mother, siblings and everyone else in the same maternal line, and by unrelated people who happen to carry the same sequence.
Item 5 has a club-shaped root with no tissue: a shed telogen hair. No nuclear DNA profile is likely. That leaves microscopic comparison and mitochondrial DNA.
Why this matters: Microscopy reliably tells human from animal hair and reads a hair's history. Whether a hair can be linked to a person by DNA depends on its root: shed hairs usually give only mitochondrial DNA, which is shared along the maternal line.
Comparison 3: what each method can conclude
Microscopic comparison sets a questioned hair beside a sample of known hairs from a person. According to the FBI guide, the known sample is ideally about 25 head hairs, pulled and combed from different areas of the scalp. The examiner checks colour, diameter, pigment, medulla, cuticle and other features one by one. The FBI guide itself says there is no criterion for how much weight any feature carries; that judgement "can be made only by the individual examiner and must be based on experience."
| Method | Can it exclude? | What does an inclusion mean? | Measured reliability |
|---|---|---|---|
| Microscopic comparison | Yes, when clear differences appear | The hair could have come from the person, or from anyone else whose hair looks the same; no population statistics exist | In a 2002 FBI study, 9 of 80 hair pairs judged microscopically associated were shown by mitochondrial DNA to come from different people |
| Mitochondrial DNA | Yes | The person and their maternal relatives cannot be excluded; database frequencies can be reported | Objective sequence data |
| Nuclear DNA from root tissue | Yes | Can be very strong, as Lesson 11 shows | The best validated method, but needs root tissue |
The 2009 National Academy of Sciences report reached a firm conclusion: the committee "found no scientific support for the use of hair comparisons for individualization in the absence of nuclear DNA." It added that a microscopic association should be confirmed with mitochondrial DNA and that microscopy alone has limited value as proof.
What went wrong in court: the FBI review
For decades before mitochondrial DNA testing of hair became routine at the FBI around 2000, prosecutors across the United States relied on microscopic hair comparison to tie defendants to crimes. FBI examiners also trained hundreds of state and local examiners. In 2012, after three men convicted partly on flawed FBI hair testimony were exonerated, the FBI and the Department of Justice began reviewing old cases with the Innocence Project and the National Association of Criminal Defense Lawyers.
On 20 April 2015 the four partners announced the first results. In the 268 trials reviewed so far in which FBI examiners' testimony was used to incriminate a defendant, "erroneous statements were made in 257 (96 percent) of the cases." Twenty-six of the 28 FBI examiners involved had given testimony or written reports with erroneous statements. At least 35 of the defendants had received the death penalty, and errors were found in 33 of those cases. The errors fell into three kinds, as PCAST later summarised them. Some testimony stated or implied that a hair could be tied to one person to the exclusion of all others. Some attached a made-up statistic or probability to a match. And some cited the examiner's number of past cases and successful matches as if experience proved a conclusion. A 2018 update, reported by the National Registry of Exonerations, found erroneous testimony in 93 percent of 484 cases.
The registry's 2023 study of all known exonerations went further. It counted at least 129 people falsely convicted based at least partly on microscopic hair comparison; among the 125 cases it analysed in detail, 15 people had been sentenced to death. And it found something uncomfortable. Testimony that the FBI's review would have called appropriate contributed to false convictions at least as often as the outright exaggerations did. That included saying a hair was "similar" to or "consistent with" the defendant's. Juries heard "consistent with" as "came from." That is the prosecutor's fallacy of Lesson 3 at work in real courtrooms.
The registry's report also documents a quieter problem. Older hair manuals taught examiners to assign hairs to three racial "ancestry groups." The report notes that hair examiners increasingly regard those categories as outdated, while dermatologists have questioned both whether hair types can be assigned to races and whether they should be. In at least seven exoneration cases, a racial classification of a hair was attached to testimony against a Black defendant.
Why this matters: The failure was not that microscopes lie. It was that examiners and lawyers presented a comparison with no population data and no measured error rate as if it could identify a person, and that juries heard even careful language as identification.
Item 5, reported honestly
Under a warrant, investigators collected known head hairs from Corey Vance; Dana Whitcomb gave elimination hairs voluntarily. The examiner's findings, in the plain language a modern report uses:
- Item 5 is a human scalp hair, shed naturally (telogen root), about 6 cm long, brown, with a cut tip.
- Compared with Vance's known hairs, which are black, coarser and densely pigmented, Item 5 is microscopically dissimilar. Vance is excluded as its source by microscopy.
- Compared with Dana's known hairs, Item 5 shows no significant differences. That means Dana cannot be excluded. It does not mean the hair is hers.
- Mitochondrial DNA from the shaft gave the same sequence as Dana's reference sample. Dana and her maternal relatives cannot be excluded as the source.
Put together, the most plausible account is the dull one: the hair is probably Dana's and was shed in the shop where she works every day. Item 5 tells the investigation nothing about the intruder, and a report that said so in one sentence would be doing its job. If the examiner had written "consistent with Dana Whitcomb" and stopped, a reader could easily have taken it for an identification, which is exactly the trap the registry documented.
Common misconceptions
- "A hair examiner can tell whose hair it is." Microscopy can exclude people and can say a hair is similar to someone's, but no population data exist to say how many other people's hair looks the same. Identification needs DNA.
- "Every hair carries a full DNA profile." Shed hairs usually lack root tissue and yield only mitochondrial DNA, which is shared along the maternal line. A nuclear profile needs root tissue.
- "Careful words like 'consistent with' are always safe." The registry found such phrases contributed to false convictions as often as exaggerations did, because listeners heard them as identification. A good report also says how common the features are, or that no one knows.
- "Hair comparison was proven invalid, so hairs are useless." Hairs still answer real questions: human or animal, which body area, cut or pulled, dyed or not, and they can be screened before DNA testing. The problem was the claim to identify people from appearance alone.
Summing up
- A hair has a cuticle of scales, a cortex holding pigment and a medulla; microscopy reliably separates human from animal hair and can show body area and treatment.
- Root shape shows the growth phase. Shed telogen hairs rarely yield nuclear DNA; their shafts carry mitochondrial DNA, inherited from the mother and shared along the maternal line.
- Microscopic comparison can exclude, but an inclusion has no population statistics behind it. A 2002 FBI study found 9 of 80 microscopic associations were different people by mitochondrial DNA.
- In 2015 the FBI reported erroneous statements in 257 of 268 trials reviewed (96 percent); 26 of 28 examiners were involved. The 2023 registry study counted at least 129 false convictions resting partly on hair comparison.
- Item 5 is a shed scalp hair, unlike Vance's and indistinguishable from Dana's, with Dana's mitochondrial sequence: it tells us nothing about the intruder.
Sources
- Deedrick, D. W., & Koch, S. L. (2004). Microscopy of hair part 1: A practical guide and manual for human hairs. Forensic Science Communications, 6(1). Federal Bureau of Investigation. Sections on structure, animal versus human hairs, DNA examinations, sampling and the root. archives.fbi.gov
- Federal Bureau of Investigation. (2015, April 20). FBI testimony on microscopic hair analysis contained errors in at least 90 percent of cases in ongoing review [Press release]. fbi.gov
- Cole, S. A., Weinstock Paredes, J., Possley, M., & Otterbourg, K. (2023). Microscopic hair comparison analysis and convicting the innocent (Version 1.2). National Registry of Exonerations. Executive summary and section IX.A.5. The persistent link now serves a later version. National Registry of Exonerations
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Analysis of hair evidence, pp. 155-161. ojp.gov
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Section 2 on the DOJ hair review and its three categories of error, and section 5.7 on hair analysis. obamawhitehouse.archives.gov
- National Human Genome Research Institute. (2026). Mitochondrial DNA. In Talking glossary of genomic and genetic terms. genome.gov
- Key terms
- cuticle
- The outer layer of a hair, made of overlapping scales that point from root to tip.
- cortex
- The main body of a hair, holding the pigment granules.
- medulla
- The central core of a hair; usually narrow or absent in human hair and wide and structured in many animal hairs.
- telogen
- The resting phase of hair growth; telogen hairs are shed naturally with a club-shaped root and little tissue.
- anagen
- The growing phase of hair; a forcibly removed anagen hair may carry root tissue with nuclear DNA.
- mitochondrial DNA
- DNA in the mitochondria, inherited from the mother and shared along the maternal line; present in hair shafts.
- microscopic hair comparison
- Side-by-side comparison of a questioned hair with known hairs; it can exclude, but has no population statistics for inclusions.
- scale cast
- An impression of a hair's cuticle scales made in clear film, such as nail polish, for viewing under magnification.
Fibres: Common Things, Uncommon Combinations
- Classify textile fibres as natural or manufactured and describe how microscopy, polarised light, microspectrophotometry and infrared spectroscopy identify and compare them.
- Explain primary and secondary transfer and why transferred fibres are lost quickly.
- List the factors that raise or lower the weight of a fibre association, and explain why a fibre match is class evidence.
The problem: four navy fibres on a broken edge
Caught on a jagged edge of glass still standing in the back-door frame of the Wrenfield store were four dark navy fibres, each a few millimetres long. Sam Ostrowski photographed them in place, lifted them with clean forceps and folded them into a paper bindle as Item 4. Whoever reached through that frame to turn the deadbolt probably snagged a sleeve on the glass. The fibres are almost certainly from the intruder's clothing, which makes them more promising than the hair in Lesson 6.
So here is the problem for this lesson. Suppose investigators later find a navy garment belonging to a suspect. What questions does a fibre examiner have to answer, in what order, before anyone can say what those four fibres mean? We will work them one at a time and then pull out the general rules.
Question 1: what kind of fibre is it?
Textile fibres fall into two great families. Natural fibres come from plants (cotton, flax, ramie), animals (wool, silk, specialty furs) or minerals. Manufactured fibres are made in factories, some from natural materials such as wood pulp, which gives rayon, and most from synthetic polymers such as polyester, nylon and acrylic. The FBI-sponsored working group that wrote the US fibre examination guidelines in 1999 noted that cotton is by far the most common plant fibre in textiles, and wool from sheep the most common animal fibre. Over half of all fibres used in textiles are manufactured, with polyester and nylon the most common, followed by rayons, acetates and acrylics.
The first look is through a stereomicroscope, then a compound microscope. Natural fibres show the structure of the plant or animal they came from: wool, for instance, is hair and has scales like the hair in Lesson 6. Manufactured fibres are extruded through tiny nozzles, so they tend to be uniform along their length. The shape of the nozzle sets the fibre's cross-section: round, trilobal, flat, dog-bone and many others. Many carry a delustrant, a fine white pigment that dulls their shine and shows up as specks under magnification. The guidelines note that delustrants occur only in manufactured fibres.
The Wrenfield fibres were smooth, uniform in diameter, dotted with delustrant and slightly kidney-shaped in cross-section: manufactured fibres.
Question 2: which polymer?
Two instrumental methods identify the generic class of a manufactured fibre without consuming much of it.
- Polarised light microscopy. A polarised light microscope has two polarising filters, one below the sample and one above it. Many manufactured fibres are birefringent, meaning their refractive index differs depending on the direction light vibrates through them, because the polymer chains are lined up along the fibre during manufacture. The size of that difference, the birefringence, differs from one polymer to another and helps tell fibre types apart.
- Infrared spectroscopy. A fibre absorbs infrared light at wavelengths set by the chemical bonds in its polymer, producing a spectrum that works like a chemical fingerprint for the fibre type, and often its subclass.
The working group's advice on order is worth remembering: choose the methods that give "the most exclusionary information first." Use nondestructive tests before destructive ones, such as solubility tests or heating a fibre until it breaks down in a pyrolysis instrument. An early exclusion saves everything after it. In Wrenfield, both methods said acrylic.
Question 3: what colour, exactly?
Colour is where fibre evidence gets its power. The working group pointed out that synthetic dyes belong to many chemical categories, that dye batches are small, and that shade varies from batch to batch, so colour is "a powerful discriminant." Two navy fibres can look identical to the eye and differ in the light they absorb.
Examiners compare colour in three ways. The first is side by side under a comparison microscope. The second uses a microspectrophotometer, a microscope fitted with a spectrometer that records how much light a single fibre absorbs at each wavelength across the visible range. The third, where enough fibre exists, extracts the dye and separates its components with thin-layer chromatography. The Wrenfield fibres had a single, smooth dye spectrum with an absorption peak in the orange-red, which is why they look blue.
In short: A fibre is identified in stages, from natural or manufactured, to polymer, to colour, using the least destructive and most exclusionary tests first. Each stage can exclude a source; none of them alone can identify one.
Question 4: does it agree with a known source?
Eleven days after the break-in, a warrant search of Corey Vance's truck turned up a navy zip-up hoodie, a knitted jacket with a hood. The examiner cut a small sample from it as the known. That sample was then compared with the four questioned fibres on every property measured so far: generic class (acrylic in both), cross-section, diameter range, delustrant, colour under the comparison microscope, and the dye spectrum. They agreed on all of them.
What can the examiner conclude? The 1999 guidelines answer with unusual care. To say a fibre "originated from" a particular garment, either that garment would have to be the only one of its kind ever made, or someone would have to have watched the transfer happen. Neither is likely. So the examiner concludes that the questioned fibres are "consistent with originating from" the known garment, and that other garments made with the same fibre and dye cannot be ruled out except by context. The 2009 National Academy of Sciences report put the same idea more flatly: a fibre match "can provide only class evidence." It added that no studies exist on which to base a threshold for when two fibres come from the same production batch.
Question 5: how much does the agreement weigh?
Class evidence can be weak or quite strong. The guidelines list what pushes the weight up or down, and they translate directly into questions about Wrenfield.
| Factor | Why it matters | Wrenfield |
|---|---|---|
| How common the fibre type is | White cotton and blue denim are everywhere; unusual fibres weigh more | Acrylic is less common than polyester or cotton, but navy acrylic knitwear is widely sold |
| Colour and dye | Dye batches are small and shades vary, so an exact spectral match narrows the group | Spectra agree |
| Number of fibres | More transferred fibres suggest direct, more forceful contact; even one can matter | Four |
| Where they were found | Location can fit or contradict an account of events | On the glass edge a reaching arm would brush: highly relevant |
| Multiple associations | Several independent fibre types linking two items are much harder to explain by coincidence | Only one fibre type |
| Cross transfer | Fibres going both ways between two items greatly reduce the chance of coincidence | Not possible here: the store has no carpet or fabric to transfer back |
No one has a database that says how many navy acrylic sweatshirts with that exact dye exist in Wrenfield. The guidelines warn that exact probability statistics for fibres are "problematic at best" and should involve professional statisticians. So the honest report says what was found, says it is class evidence, and says plainly that its frequency is unknown. It is one strand in the case, and Lesson 22 shows how such strands are weighed together.
Transfer and persistence: the clock is always running
Fibres move by primary transfer, directly from one fabric to another on contact, and by secondary transfer, through an intermediate. A fibre from your sweater can reach a chair by your sitting on it, and then reach the next person who sits there. That second route is why a single fibre in an odd place proves very little about direct contact.
Transferred fibres do not stay put. The working group summarised the research: transferred fibres are lost "at a geometric rate," that is, a large fraction falls away in the first period after contact, then a large fraction of what remains in the next period, and so on, faster on moving clothes than still ones. Tightly woven fabrics shed fewer fibres than loose knits; new garments shed loose surface fibres; damage during contact greatly increases transfer. Two practical consequences follow. Clothing has to be collected quickly. And finding no fibres from a suspect's garment does not mean no contact happened, which is Locard's principle from Lesson 1 again.
In Wrenfield the fibres were caught on glass, not on a moving garment, so they stayed where they snagged until Sam collected them that morning. The navy hoodie was found eleven days later, which does not matter for the fibres on the glass but means any store material that once clung to the hoodie would long since have been lost.
The general rules
Working the problem through gives a procedure that applies to almost every kind of trace evidence in this module. Identify the type, then compare increasingly specific properties, excluding as early as possible. Describe agreement as consistency with a source, not identification. Weigh the agreement by how common the class is, how many items and associations there are, and where the material was found. And consider transfer and persistence before deciding what a presence or an absence means.
In short: A fibre match puts a garment in a group. Rare fibre types, distinctive dyes, many fibres, several associations and cross transfer make the group small; common fibres and a single association leave it large.
Common misconceptions
- "Matching fibres prove the suspect's clothing was there." They show the fibres are consistent with that garment and with every other garment made of the same fibre and dye. Fibres are class evidence.
- "Fibres stay on clothing until it is washed." Transferred fibres are lost rapidly, at a geometric rate, especially on clothes that are being worn and moved.
- "A fibre found on someone shows they touched the source." Secondary transfer can carry fibres through an intermediate person or object, so a single fibre in an unusual place is weak evidence of direct contact.
- "Common fibres are worthless as evidence." A common fibre adds little alone, but several independent associations, or fibres transferred in both directions, are hard to explain by coincidence.
What to remember
- Natural fibres come from plants, animals or minerals; manufactured fibres are made from regenerated or synthetic polymers. Polyester and nylon are the most common manufactured fibres; cotton the most common plant fibre.
- Examination moves from microscopy to polarised light, infrared spectroscopy and dye analysis by microspectrophotometry or chromatography, least destructive and most exclusionary first.
- Agreement on every property means "consistent with originating from" the known item; the National Academy of Sciences calls a fibre match class evidence only.
- Weight rises with rarity, distinctive dye, number of fibres, relevant location, multiple associations and cross transfer.
- Fibres transfer directly and indirectly and are lost at a geometric rate, so absence proves little and collection must be quick.
Sources
- Scientific Working Group on Materials Analysis. (1999). Introduction to forensic fiber examination. In Forensic fiber examination guidelines, chapter 1, sections 4.0 to 6.0 (significance, source determination, transfer and persistence, sampling). Forensic Science Communications, 1(1). Federal Bureau of Investigation. archives.fbi.gov
- Scientific Working Group on Materials Analysis. (1999). Microscopy of textile fibers. In Forensic fiber examination guidelines, chapter 2 (terminology, physical characteristics of manufactured fibres, polarised light, cross sections, solubility). Forensic Science Communications, 1(1). Federal Bureau of Investigation. archives.fbi.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Analysis of fiber evidence, pp. 161-163. ojp.gov
- Key terms
- natural fibre
- A fibre from a plant, animal or mineral source, such as cotton, wool or silk.
- manufactured fibre
- A fibre made in a factory from regenerated natural polymers (such as rayon) or synthetic polymers (such as polyester, nylon and acrylic).
- delustrant
- A fine pigment, usually white, added to manufactured fibres to reduce their shine; seen only in manufactured fibres.
- birefringence
- The difference between a fibre's refractive indices for light vibrating along and across it; used to tell fibre types apart.
- microspectrophotometer
- A microscope with a spectrometer that measures how much light a single fibre absorbs at each wavelength, to compare colour objectively.
- primary transfer
- Direct movement of fibres from one item to another on contact.
- secondary transfer
- Movement of fibres through an intermediate person or object.
- persistence
- How long transferred material stays where it landed; fibres on worn clothing are lost at a geometric rate.
Glass: Fractures, Density and Refractive Index
- Read radial and concentric cracks, apply the 4R rule to find the side of impact, and work out the order of impacts.
- Explain how refractive index is measured by immersion and the Becke line, and how density and elemental analysis add to it.
- Interpret a glass comparison as exclusion or class-level association, and explain why a known sample from the broken source is essential.
A pane with a hole in it
The back door of the Wrenfield store has a lower pane of ordinary flat window glass, about 3 mm thick. On Monday morning it had a ragged hole near the deadbolt, cracks running out from the hole, and glass on both sides: a scatter of fragments on the tiles inside and a smaller scatter on the concrete step outside. Before removing anything, Sam Ostrowski marked each piece still in the frame with a small arrow showing which way was up and a letter for which surface faced the alley. Then he collected the glass left in the frame as the known sample, kept the inside and outside fragments in separate rigid boxes, and labelled everything as Item 1.
Glass answers two different questions, and this lesson walks through both as procedures. The first is about the pane itself: which side was it struck from? The second is about a suspect: could the tiny fragments found on someone's clothing have come from this pane? Then it changes one fact in each procedure to show how the answer can flip.
The guidance comes from a set of guidelines written in 2004 by the Scientific Working Group for Materials Analysis, an FBI-sponsored group of glass examiners, and published in the FBI's Forensic Science Communications in 2005. The working group defined glass simply as "an inorganic product of fusion that has cooled to a rigid condition without crystallizing."
Procedure 1: which side was the pane struck from?
Step 1: find the point of impact and the crack types. When a stone, a hammer or an elbow strikes a pane at low speed, the glass bends away from the blow and cracks. Two kinds of crack appear.
- Radial cracks run outward from the point of impact like the spokes of a wheel.
- Concentric cracks form roughly circular rings around the point of impact, usually in short straight segments that end at radial cracks. The guidelines note they form when the pane is held firmly on all sides, as a pane in a door frame is.
Step 2: read the edges of the radial cracks. Look at the broken edge of a radial crack close to the point of impact, under low magnification and angled light. You will see curved ridges running across the edge, called Wallner lines or rib marks. The guidelines give a rule examiners remember as the 4R rule: "Ridges on Radial cracks are at Right angle to the Rear." Follow the ridges across the edge. At one surface they curve away; at the other they meet the surface at a right angle. The surface they meet squarely is the rear, the side opposite the blow.
Step 3: check the rule applies. The guidelines warn that the 4R rule is unreliable for laminated glass, tempered glass and small windows held tightly in a frame. It also needs the pane's original orientation, which is why Sam's arrows and letters matter. Without them, a correct reading of the ridges tells you which surface is the rear but not which way that surface faced.
Step 4: apply it to Wrenfield. On radial cracks near the hole, the ridges met the surface Sam had marked as the inside face at right angles. The inside face was the rear, so the blow came from the alley side. That fits an intruder outside the door. Notice that the glass on the outside step does not contradict it. When a window breaks, most fragments fly forward, but some fly backward toward whoever struck it; the guidelines' reading list includes a study of exactly this backward fragmentation and of glass transferred to the clothing of people standing nearby.
Step 5: if there were several impacts, order them. A crack cannot run across a gap that already exists. So when cracks from one impact stop at cracks from another, the stopped cracks came second. With two holes in a pane, the radial cracks of the later hole end where they meet the cracks of the earlier one.
The upshot: Radial cracks, concentric cracks and the 4R rule tell the side of a low-speed impact, provided the glass is ordinary flat glass and its orientation was recorded before it was moved. Crack junctions give the order of impacts.
Changed input: suppose the door had safety glass
Now change one fact. Many doors use tempered safety glass, which is treated so that when it breaks it falls apart into small, roughly cube-shaped pieces instead of long shards. With tempered glass the 4R rule is unreliable by the working group's own warning, and there may be little of the pane left in the frame to read. Same procedure, opposite outcome: the side of impact could not be determined from the glass, and the report would say so rather than guess. A heat crack would be different again: the guidelines describe heat cracks in ordinary glass as curved and smooth-edged, with no point of origin, and the side that was heated cannot be told from the edges.
Procedure 2: could these fragments have come from this pane?
Eleven days after the break-in, the lab examined the jacket seized from Corey Vance's truck, the navy zip-up hoodie you met in Lesson 7. Picking through debris from its cuffs under a stereomicroscope, the examiner found three tiny fragments of clear glass, each about a millimetre across. Fragments that small cannot be fitted back into the pane, so a physical match, the only kind of glass comparison the guidelines treat as reaching a single source, is out of the question. The comparison has to be made on properties of the glass itself.
Step 1: measure the refractive index. Refractive index (RI) compares the speed of light in a vacuum with its speed in the glass. It depends on the glass's composition and on how it was cooled, so glass from different sources often has measurably different refractive indices, even when the differences are tiny. The guidelines call it "the most commonly measured property in the forensic analysis of glass."
The measurement uses a simple optical effect. Put a fragment in a liquid with almost the same refractive index and it nearly disappears, because light crosses the boundary without bending. Under a microscope a bright halo, the Becke line, appears at the fragment's edge. The guidelines state the rule: as the distance between the objective and the slide is increased, the Becke line "will always move toward the higher refractive index medium." So an examiner can tell whether the glass or the liquid has the higher index just by watching the halo while focusing.
In the modern method, the fragment sits in a special silicone oil on a hot stage under a phase-contrast microscope. Warming the oil steadily lowers its refractive index, while the glass's changes very little. The instrument changes the temperature until the fragment's edge vanishes, the match point, and converts that temperature into the oil's refractive index using calibration standards. At the match point, glass and oil have the same RI.
Step 2: measure the known sample's range. Glass is not perfectly uniform. The guidelines stress the "inherent heterogeneity" of properties within a single source and the need to analyse a known sample from it. So the examiner measured ten fragments from the pane left in the frame, giving a range, not a single value.
Step 3: compare. All three cuff fragments fell within the range of the door glass.
Step 4: add other properties if possible. Density, measured by finding a liquid in which the fragment neither sinks nor floats, is impractical for fragments under 2 to 3 mm, the guidelines say, so it was skipped. Elemental analysis measures the concentrations of major, minor and trace elements; the guidelines cover methods including X-ray fluorescence and inductively coupled plasma mass spectrometry, several of which destroy the sample, so they come last. The lab's elemental results for the cuff fragments also fell within the range of the door glass.
Step 5: interpret. The guidelines are clear about what agreement means. Comparing class characteristics "associate materials to a group but never to a single source." Flat window glass is produced in enormous quantities, and many panes share the same refractive index and composition. The honest report says the three fragments could have come from the Wrenfield door or from any other glass with the same properties. It also notes how the fragments could arrive innocently. Glass fragments from everyday breakage are common, which is one reason the location on the cuff and the number of fragments matter to the weight.
The upshot: Refractive index and elemental composition can exclude a source or place fragments in a group of glass with the same properties. Only a physical fit of broken edges ties glass to one object.
Changed input: one decimal place
Change one number. Suppose the three cuff fragments had refractive indices that differed from every door fragment by more than the measurement's variation, a difference in the fourth decimal place. Then the conclusion flips from association to exclusion: the cuff glass did not come from that pane. The guidelines put it for density in words that hold for refractive index and composition too: samples that are distinguished "did not originate from the same source." Exclusion is the strong result in glass, as it was for boots in Lesson 3. Association is the weak one.
Common misconceptions
- "Glass on the outside means it was broken from inside." Fragments fly in both directions, and some fly back toward the person who broke the pane. The side of impact is read from the cracks, not from where the fragments landed.
- "Matching refractive index proves the glass came from that window." Many panes share the same refractive index and composition. A match places fragments in a group; only a physical fit of edges identifies a single object.
- "The 4R rule works on any broken glass." It is unreliable for tempered and laminated glass and small tightly held panes, and it needs the pane's original orientation.
- "Measuring more properties always multiplies the evidence." Refractive index and density are strongly correlated, so adding density to RI improves discrimination only modestly, about twofold according to studies the guidelines cite.
Putting it together
- Low-speed impacts make radial and concentric cracks; ridges on radial cracks meet the rear surface at right angles (the 4R rule), so record orientation before moving anything.
- Later cracks stop at earlier ones, giving the order of impacts. Tempered and laminated glass, small tight panes and heat cracks do not follow the rule.
- Refractive index is measured by immersion: the Becke line moves toward the higher-index medium as the focus distance increases, and the temperature-variation method finds the match point.
- A known sample from the broken source is essential because glass varies within one source.
- Agreement in refractive index, density and elemental composition is class evidence; a difference excludes; a physical fit identifies.
- In Wrenfield the pane was struck from the alley side, and three cuff fragments fell within the door glass's range: consistent with the door or any similar glass.
Sources
- Scientific Working Group for Materials Analysis. (2005). Introduction to forensic glass examination. Forensic Science Communications, 7(1). Federal Bureau of Investigation. archives.fbi.gov
- Scientific Working Group for Materials Analysis. (2005). Glass fractures. Forensic Science Communications, 7(1). Federal Bureau of Investigation. Sections 3, 5 and 7 (crack types, the 4R rule, high-velocity and thermal fractures). archives.fbi.gov
- Scientific Working Group for Materials Analysis. (2005). Glass refractive index determination. Forensic Science Communications, 7(1). Federal Bureau of Investigation. Terminology (Becke line, match point) and section 5. archives.fbi.gov
- Scientific Working Group for Materials Analysis. (2005). Glass density determination. Forensic Science Communications, 7(1). Federal Bureau of Investigation. Sections 5 and 8 (fragment size limits; correlation with refractive index). archives.fbi.gov
- Scientific Working Group for Materials Analysis. (2005). Elemental analysis of glass. Forensic Science Communications, 7(1). Federal Bureau of Investigation. Section 1 (methods covered; destructive methods last). archives.fbi.gov
- University of Wisconsin-Madison, Department of Physics. (2023). Index of refraction [Wonders of Physics outreach activity]. wp.physics.wisc.edu
- Texas A&M University Department of Chemistry. (n.d.). Disappearing beaker [Chemistry Road Show demonstration sheet]. chem.tamu.edu
- Key terms
- radial crack
- A crack running outward from the point of impact like a wheel spoke.
- concentric crack
- A crack forming a rough ring around the point of impact, usually ending at radial cracks.
- 4R rule
- Ridges on Radial cracks are at Right angles to the Rear: the surface the ridges meet squarely is the side opposite the blow.
- Wallner lines
- Curved ridges on a broken glass edge, used to read the direction a crack travelled.
- refractive index
- The ratio of the speed of light in a vacuum to its speed in a material.
- Becke line
- A bright halo at the edge of a transparent fragment in liquid; it moves toward the higher-index medium as the focus distance increases.
- match point
- The temperature and wavelength at which a glass fragment and its immersion oil have the same refractive index, so the fragment nearly disappears.
- physical match
- A fit between broken edges showing two pieces were once one object; the only glass comparison that reaches a single source.
Soil: Reading Dirt Like a Map
- Describe soil as a mixture of mineral particles of different sizes, organic matter, water and air, and explain why it varies from place to place and with depth.
- Compare soil samples by colour, particle size, mineral content and other features, and read a comparison table to reach exclusions and class-level associations.
- Explain how known soil samples should be collected, and why little systematic data on soil variability limits what an association can mean.
Red clay on white tiles
Just inside the back door of the Wrenfield store, on white floor tiles, Sam Ostrowski found a smear of reddish clay with part of a boot tread pressed into it. This is Item 6, the same print you met in Lesson 3. The alley outside is grey gravel and crushed stone. So the clay did not come from the few steps between the alley and the door. It travelled into the store on a boot from somewhere else.
That "somewhere else" is the question soil evidence can sometimes help answer. This lesson builds the answer around one table comparing the clay on the tiles with four known samples, and then reads the table row by row. Before that, you need to know what soil is and why it differs from place to place.
What soil is made of
Soil is a mixture. Its mineral part is rock broken into particles of very different sizes. The OpenStax Biology 2e textbook gives one common scheme: particles 0.1 to 2 mm across are sand, those between 0.002 and 0.1 mm are silt, and anything smaller than 0.002 mm is clay. (Classification systems draw the lines in slightly different places, but the order is always the same.) Mixed in is organic material, called humus: living and dead microorganisms and the remains of plants and animals in different stages of decay. Water and air fill the spaces between.
The proportions of sand, silt and clay give a soil its texture, which you can feel: sand is gritty, silt smooth like flour, clay sticky when wet and hard when dry. Washington State University's extension service notes that soil texture falls into one of 12 standard categories based on those percentages.
Soil also changes with depth. A vertical section through it, the soil profile, shows distinct layers called horizons, each with its own physical and chemical properties. And it changes across the landscape, because five factors shape every soil: the parent material it formed from, climate, topography, living things, and time. A clay laid down in one valley may be absent on the next hill, and a garden soil enriched for decades with compost will differ from bare subsoil a metre away. That variability is what makes soil useful as evidence, and it is also what makes soil hard to interpret.
What examiners compare
A 2024 research-needs statement from the Organization of Scientific Area Committees (OSAC) for Forensic Science lists the techniques in common use in casework. They are colour, particle size distribution, and polarised light microscopy of the mineral grains. Then come X-ray diffraction, which identifies minerals from the way their crystals scatter X-rays, and scanning electron microscopy with energy dispersive X-ray spectroscopy, which images individual particles and measures the elements in them. In plain terms:
| Property | How it is examined | What it can show |
|---|---|---|
| Colour | Side by side under the same light, both dry and moist, since water darkens soil | A quick screen; clearly different colours exclude a common source |
| Particle size | Sieving and settling to measure how much sand, silt and clay is present | Texture; differences in the coarse fraction are easy to see |
| Minerals | Polarised light microscopy of grains; X-ray diffraction of the fine fraction | Which minerals are present and in what rough proportions; rare grains can be distinctive |
| Elements in particles | Scanning electron microscopy with X-ray analysis | Composition of individual grains and man-made particles |
The same OSAC statement is frank about the limits. Little research has compared how well these techniques actually separate soils from different places or recognise soils from the same place. More advanced methods, such as analysing the DNA of soil organisms or the waxes from plant leaves, have shown promise in research but are not commonly used in forensic laboratories. A companion statement, approved in June 2024, notes that there are no large-scale, systematic studies of how much soil varies across a landscape and with depth using the methods examiners actually use.
Worth holding on to: Soil is compared on colour, texture, minerals and particle composition. Clear differences exclude a common source. Agreement places samples in a group, and nobody yet knows well how large that group usually is.
The comparison table
Here are the Wrenfield results. Q is the questioned clay from the tiles. K1 to K4 are known samples. K1 is clay scraped from the soles of the boots seized from Corey Vance's truck, and K2 is reference soil from the Millrace housing site where he works. K3 is soil from the alley behind the store, and K4 is soil from the garden of the friend's house where Vance says he spent Sunday evening.
| Sample | Colour (dry) | Texture | Minerals and particles | Compared with Q |
|---|---|---|---|---|
| Q: clay smear on store tiles | Reddish brown | Clay-rich, little sand | Quartz grains coated with red iron oxide; flakes of mica; a few grains of pink feldspar | (questioned sample) |
| K1: Vance's boot soles | Reddish brown | Clay-rich, little sand | Same three components in similar proportions | No significant differences |
| K2: Millrace housing site subsoil | Reddish brown | Clay-rich, little sand | Same three components in similar proportions | No significant differences |
| K3: alley behind the store | Grey | Gravel and coarse sand | Crushed limestone; no red-coated quartz | Different: excluded as the source of Q |
| K4: garden of the alibi house | Dark brown | Loam, rich in organic matter | Mixed grains, abundant plant fragments, no red-coated quartz | Different: excluded as the source of Q |
Reading the table
Rows K3 and K4: two exclusions. The clay on the tiles did not come from the alley, which confirms what you could guess from the colours: whoever made the print brought the clay in from elsewhere. Nor did it come from the garden of the house where Vance says he was. Notice what that second exclusion does not prove. It does not show he was not at that house, because a boot carries soil from wherever it last walked through mud, not from everywhere it has been. It shows only that the clay in the store is not that garden's soil.
Rows K1 and K2: two associations. The clay on Vance's boots and the subsoil at the Millrace site are indistinguishable from Q by every property measured. That fits an account in which boots carried Millrace clay into the store. But the weight of that agreement depends on how many other places have the same clay. The county soil survey shows the same red clay subsoil under much of east Wrenfield, wherever building work, gardening or a broken water main has brought it to the surface. Dozens of workers walk on the Millrace site every day, and many residents of east Wrenfield have walked through that clay at some time.
So the honest summary is a class-level association: the clay on the tiles is consistent with the Millrace site and with Vance's boots, and with any other place where the same red clay is exposed. That is genuinely useful in combination with the other evidence, and it is nowhere near identifying a person. It also points investigators in a direction. If the clay had turned out to contain an unusual mineral found only in one quarry, the group would have been much smaller.
Collecting known soil: one sample is never enough
Because soil varies over short distances, a single scoop from "the Millrace site" could easily miss the patch the boot actually touched, or could match by accident. The Bureau of Justice Assistance's 2013 crime scene guide sets out the practice. Use clean tools and a fresh bindle or container for each sample. Photograph and document any impression before collecting nearby soil. Collect at least three tablespoons from each location, a little deeper than the evidence appears to have penetrated. Take comparison samples close to the evidence location and at several points around it, up to about 100 feet away. And sample any alibi site that someone says they visited. Soil stuck to a movable object is collected with the object and air-dried. Where soil has built up in layers, as it does under a vehicle's wheel arches, the layering is preserved, because the outer layer may show where the vehicle went most recently.
Since 2024, a consensus standard for this work, ASTM E3272-23, Standard Guide for the Collection of Soils and Other Geological Evidence for Criminal Forensic Applications, has been on the OSAC Registry of approved standards. A factsheet from the American Academy of Forensic Sciences explains that it covers questioned soil on objects such as vehicles and upholstery. It also covers strategies for collecting known reference soil from the surface and below it.
Worth holding on to: Known soil has to be sampled at several points around the location of interest, and at any alibi site, with clean tools and separate containers, because soil varies over short distances.
Common misconceptions
- "Soil from one place is uniform, so one sample represents it." Soil changes with depth and over short distances. Several samples around the location, and samples from alibi sites, are needed before a comparison means much.
- "If the soil matches, the suspect was at that exact spot." A match places the soil in a group that shares those properties. The size of that group is often unknown, and in Wrenfield it covers much of east Wrenfield.
- "A boot carries soil from everywhere its owner has been." Soil on a sole is mostly from the last muddy ground it crossed. Finding no soil from a place does not show the person was never there.
- "Soil analysis is an exact science with known error rates." The common methods are well-established measurements, but OSAC's own committees say little research has compared how well they separate soils, and systematic studies of soil variability are lacking.
What you now know
- Soil is mineral particles (sand, silt and clay, in order of decreasing size), organic matter, water and air; texture comes from the proportions of the particle sizes.
- Soils form in horizons and vary across landscapes because of parent material, climate, topography, living things and time.
- Casework compares colour, particle size, minerals (polarised light microscopy and X-ray diffraction) and particle chemistry (scanning electron microscopy with X-ray analysis).
- Clear differences exclude a source; agreement is a class-level association whose weight depends on how widespread that soil is.
- Known soil is collected at several points around the location and at alibi sites, with clean tools and separate containers, under guidance now set out in ASTM E3272-23.
- In Wrenfield the store clay excluded the alley and the alibi garden, and was consistent with the Millrace site and Vance's boots, and with the red clay under much of east Wrenfield.
Sources
- OpenStax. (2018). The soil. In Biology 2e, section 31.2. Rice University. Particle size classes, humus, horizons and the five soil-forming factors. openstax.org
- Washington State University Extension, Lewis County. (2023). Evaluating your soil texture [Handout]. wsu.edu
- OSAC Trace Materials Subcommittee. (2024). Evaluation of current methodologies in forensic soil comparisons [Research needs assessment]. National Institute of Standards and Technology. nist.gov
- OSAC Trace Materials Subcommittee. (2024). Assessing heterogeneity of soils at a site [Research needs assessment, approved June 27, 2024]. National Institute of Standards and Technology. nist.gov
- National Forensic Science Technology Center. (2013). Crime scene investigation: A guide for law enforcement (rev. ed.). Bureau of Justice Assistance. Section C, collection procedure for soil and rock samples. nist.gov
- American Academy of Forensic Sciences. (2024). Factsheet for ANSI/ASTM standard guide E3272-23: Collection of soils and other geological evidence for criminal forensic applications. aafs.org
- Key terms
- soil texture
- The proportions of sand, silt and clay in a soil; it falls into one of 12 standard categories.
- sand, silt and clay
- Mineral particle size classes from coarse to fine; clay particles are smaller than 0.002 mm.
- humus
- The organic part of soil: microorganisms and the decaying remains of plants and animals.
- soil horizon
- A layer in the soil profile with physical and chemical properties different from the layers above and below.
- X-ray diffraction
- A method that identifies minerals from the way their crystal structures scatter X-rays.
- reference soil
- Known soil collected from a location of interest, at several points, for comparison with questioned soil.
- alibi site
- A place a person says they were, sampled so that its soil can be compared with the evidence.
Module 4: Blood and DNA
What drops of blood can and cannot reveal about how a person moved, how DNA is turned from a stain into a profile and a statistic, and the hard cases at the edge of the technology: mixtures, transfer, lineage markers and genetic genealogy. The Wrenfield drip trail and the bloodstained glass shard run through all three lessons.
Bloodstains: What Drops and Patterns Can Show
- Explain the difference between presumptive and confirmatory tests for blood, and why neither is done at home in this course.
- Calculate a drop's impact angle from its width and length, and read directionality in drip stains and drip trails.
- Summarise what the 2009 National Academy of Sciences report and the 2021 black-box study found about the reliability of bloodstain pattern conclusions.
The problem: which way was the intruder walking?
Across the floor of the Wrenfield store runs a line of dark red-brown drops, each about a centimetre across, from the broken back door to the counter and back again. Near the counter there is a small cluster of round drops, and on the front of the cash drawer a smeared mark. Detective Reyes wants to know three things. Is it blood? Whose is it? And what does the pattern say about what the person did in the store?
The second question belongs to DNA and Lessons 11 and 12. This lesson works on the first and the third. It is also the lesson where the gap between what the physics can show and what experts have sometimes claimed is especially wide, so the second half looks hard at the evidence on accuracy.
Step 1: is it blood? Screening and confirming
The 2009 National Academy of Sciences report makes a point every investigator learns early: "blood is not always red, some red substances are not blood." Rust, paint, ketchup and wine all leave red-brown marks, and old blood can look black or brown. So identification is done in steps.
A presumptive test is, in the words of the 2013 federal crime scene guide, "a non-confirmatory test used to screen for the presence of a substance." Most presumptive blood tests are catalytic: the heme group in haemoglobin speeds up a reaction that changes colour or gives off light. They have a long history. The NIJ Fingerprint Sourcebook records that Kastle and Meyer developed their phenolphthalein test in 1903 and that luminol, which glows in the presence of blood, was proposed for the purpose in 1937. A positive presumptive test means blood may be present. It does not prove it, and it says nothing about whether the blood is human.
Confirmation comes later in the laboratory. The National Academy report notes that immunological tests can now identify human haemoglobin or glycophorin A, proteins specific to human blood, which makes them more specific than the older colour tests. DNA testing then answers whose blood it is.
In this course you will not run any of these tests. They use reagents that belong in a laboratory, and the labs here use no real blood. Your experiments in the activity use a harmless substitute, and they teach the physics of drops, which works the same way for any liquid of similar thickness.
In Wrenfield, swabs from three drops gave positive presumptive tests at the scene, and the laboratory later confirmed human blood on the glass shard, Item 2A.
Step 2: the shape of one drop
A drop of liquid falling straight down onto a smooth, hard surface leaves a roughly circular stain. A drop striking the surface at a slant leaves an ellipse, stretched along the direction it was travelling. The flatter the angle, the longer the ellipse. Bloodstain analysts call the angle between the drop's path and the surface the angle of impact, which the Scientific Working Group on Bloodstain Pattern Analysis defined as "the acute angle (alpha), relative to the plane of a target, at which a blood drop strikes the target."
The relationship analysts use links the angle to the stain's width and length. As a 2015 study in Scientific Reports by Nick Laan and colleagues puts it, the width and length of the stain's elliptical outline are "empirically related" to the impact angle by:
sin(angle of impact) = width / length
Worked example. One drop on the store floor measures 6.0 mm wide and 12.0 mm long, measuring the ellipse itself and leaving out the narrow tail at one end. Width divided by length is 6.0 / 12.0 = 0.50. The angle whose sine is 0.50 is 30 degrees. So that drop struck the floor at about 30 degrees.
Second example. A drop 9.5 mm wide and 10.0 mm long: 9.5 / 10.0 = 0.95, and the angle whose sine is 0.95 is about 72 degrees, close to vertical. A circle gives 1.0 and 90 degrees.
Two cautions keep this honest. First, the measurement is sensitive. A stain 6.0 by 12.0 mm gives 30 degrees; mismeasure the length by one millimetre either way and you get anything from about 28 to 33 degrees. Second, the formula is an empirical relationship for an ideal ellipse on a smooth, non-absorbent surface. Rough floors, fabric and carpet distort stains.
So what? The shape of a single drop gives its angle of impact through sin(angle) = width / length, but only as well as the stain can be measured and only on surfaces where the ellipse forms cleanly.
Step 3: direction and the drip trail
The long axis of an elongated stain shows the line along which the drop was moving, and the working group's term for the stain's indication of that motion is directionality. Typically the narrower, tapered end, often with small spines, points in the direction of travel.
The working group also named the patterns that matter here. A drip stain is one "resulting from a falling drop that formed due to gravity," and a drip trail is a pattern "resulting from the movement of a source of drip stains between two points." Drops falling from a hand while the person is standing still land nearly round. Drops falling from a hand while the person walks carry the walker's forward speed, so they strike at a slant and stretch in the direction of walking.
Now read the Wrenfield floor. Between the door and the counter there are two overlapping lines of elongated drops. In one line the tapered ends point toward the counter; in the other they point toward the door. At the counter there is a cluster of nearly round drops, where the source stopped moving for a while. On the drawer front is a swipe pattern, defined as a transfer of blood from a blood-bearing surface with signs of movement between the surfaces, consistent with a bleeding hand pulling the drawer.
The simplest account consistent with all of it: a person with a bleeding hand walked from the door to the counter, stood at the drawer, and walked back out. Combined with the blood on the broken glass edge, it fits someone who cut a hand reaching through the pane.
Notice what the floor does not show. There is no spatter, no pattern of the kind the working group links to force applied to a source of blood. Nothing in the store suggests that anyone was struck. Walter Penhallow's flat upstairs, behind its locked door, held no blood at all. That absence matters to the question you set up in Lesson 1, although on its own it cannot settle when Walter died. Lessons 13 to 15 do that.
Step 4: how far can patterns go? The evidence on reliability
Drop shapes and drip trails are the most physically straightforward part of bloodstain pattern analysis. Interpreting complex spatter at violent scenes, such as how a wound was made or where a victim was standing, is much harder, and this is where the field has been criticised.
The 2009 National Academy report gave a mixed verdict. "Scientific studies support some aspects of bloodstain pattern analysis," it said; one can tell, for example, whether blood spattered quickly or slowly. But "some experts extrapolate far beyond what can be supported," and the report concluded that "the uncertainties associated with bloodstain pattern analysis are enormous." It also noted that the main certification body required 240 hours of course instruction but no science education, and called analysts' opinions "more subjective than scientific."
The physics of origin estimates has its own known bias. Analysts traditionally estimate where a spatter pattern came from by tracing straight lines back from the stains, the stringing method. Laan and colleagues pointed out that real drops follow curved paths under gravity and air resistance, so straight-line reconstructions overestimate the height of the source, by as much as 45 cm depending on the distance from the wall. Their experiments showed that including gravity and drag gave more accurate results.
Then, in 2021, came the first large black-box study of the discipline, funded by the National Institute of Justice and led by Austin Hicklin at the research company Noblis. It gave 75 practising bloodstain pattern analysts patterns produced under known conditions or taken from casework. The NIJ's summary reports that about 11 percent of the analysts' conclusions were wrong, and that two analysts' conclusions contradicted each other about 8 percent of the time. Most worrying, when an analyst made an error, a second analyst repeated the same error 18 to 34 percent of the time, a problem because review by a second analyst is a common safeguard. The researchers pointed to the lack of uniform terminology and classification standards as one cause and recommended developing them. They also cautioned that study error rates are not precise measures of casework error rates.
So what? Single-drop geometry and simple drip trails rest on measurable physics. Complex reconstructions rest heavily on judgement, and when tested, practising analysts were wrong on about one conclusion in nine.
Common misconceptions
- "A red-brown stain is blood." Many substances look like blood, and blood itself darkens with age. Screening tests only indicate blood may be present; confirmation and DNA come in the lab.
- "A presumptive test proves human blood." Catalytic tests respond to heme, which is not specific to humans. Human-specific immunological tests or DNA are needed for that.
- "Blood patterns reveal exactly what happened." Drop angles and simple trails can be measured, but complex reconstructions are subjective; the 2021 black-box study found about 11 percent of conclusions wrong.
- "Tracing straight strings from stains finds the exact source." Drops curve under gravity and drag, so straight-line methods systematically overestimate the height of the source.
The takeaway
- Identification runs from presumptive screening (catalytic colour or light tests such as phenolphthalein and luminol) to confirmation (human-specific tests) to DNA; none of these reagents belongs in a home lab.
- Impact angle: sin(angle) = width / length of the stain's ellipse, measured without the tail; the result is only as good as the measurement and the surface.
- Elongated drops show the line of travel, and the tapered end usually points the way the drop was moving; a drip trail records a moving source.
- The Wrenfield trail shows a bleeding person walking from the door to the counter, standing at the drawer and walking out, with no spatter anywhere.
- The National Academy found bloodstain uncertainties "enormous," and the 2021 black-box study found about 11 percent of analysts' conclusions erroneous, with errors often repeated by a second analyst.
Sources
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Biological evidence at the scene, pp. 129-130; bloodstain pattern analysis, pp. 177-179. ojp.gov
- Scientific Working Group on Bloodstain Pattern Analysis. (2009). Recommended terminology. Forensic Science Communications, 11(2). Federal Bureau of Investigation. archives.fbi.gov
- Laan, N., de Bruin, K. G., Slenter, D., Wilhelm, J., Jermy, M., & Bonn, D. (2015). Bloodstain pattern analysis: Implementation of a fluid dynamic model for position determination of victims. Scientific Reports, 5, 11461. nature.com
- National Institute of Justice. (2022, February 28). Study reports error rates for bloodstain pattern analysis. Summary of Hicklin, R. A., et al. (2021), Accuracy and reproducibility of conclusions by forensic bloodstain pattern analysts, Forensic Science International, 325, 110856. nij.ojp.gov
- National Institute of Justice. (2011). The fingerprint sourcebook (NCJ 225320). Chapter 7, history of presumptive blood tests used to enhance prints in blood. ojp.gov
- National Forensic Science Technology Center. (2013). Crime scene investigation: A guide for law enforcement (rev. ed.). Bureau of Justice Assistance. Glossary, "presumptive test." nist.gov
- Key terms
- presumptive test
- A screening test that indicates a substance such as blood may be present but does not confirm it.
- confirmatory test
- A more specific test, such as an immunological test for human haemoglobin, that establishes what a substance is.
- angle of impact
- The acute angle between a falling drop's path and the surface it strikes; sin(angle) = width / length of the stain.
- directionality
- The feature of a bloodstain that indicates the direction the blood was moving when it landed.
- drip trail
- A pattern of drip stains left by a source of dripping blood moving between two points.
- swipe pattern
- A transfer of blood from a bloody surface onto another surface, showing movement between them.
- spatter stain
- A stain from a drop dispersed through the air by force applied to a source of liquid blood.
- black-box study
- A test of practitioners on samples whose true answers are known, measuring how often their conclusions are right.
DNA: From Extraction to Profile
- Describe the steps that turn a stain into a DNA profile: extraction, quantitation, PCR amplification of STR loci, capillary electrophoresis and interpretation.
- Read an STR profile as pairs of repeat numbers at the 20 CODIS core loci and decide between inclusion and exclusion.
- Calculate a random match probability with the product rule, and explain why relatives, errors and databases change what it means.
A shard of glass in a rigid box
Item 2A is a sliver of window glass about 4 cm long with a dark red-brown drop dried on its broken edge. It was lifted by its flat faces, never its edges, and packed in a rigid box so nothing would rub the drop. In Lesson 10 the laboratory confirmed the drop was human blood. This lesson follows it through the DNA section of the laboratory, one step at a time, until it becomes a list of numbers and a statistic. Then it changes one number to show how the answer can flip.
The 2016 PCAST report, which was severe about several forensic methods, called DNA analysis of single-source samples one of the "excellent examples of objective methods whose foundational validity has been properly established." The 2009 National Academy of Sciences report reached the same conclusion, giving its reasons: there are biological explanations for individual-specific results, the probability of a coincidental match can be calculated, procedures are well specified and tested, and the standards for interpretation are clear and repeatable. Seeing why requires following the procedure.
Step 1: extraction
DNA sits inside cells, wrapped in proteins and mixed with everything else in the sample. In blood, it comes from white blood cells, because mature red blood cells have no nucleus. Extraction breaks the cells open, strips away proteins and other material, and leaves the DNA in a clean solution. Laboratories use several chemistries for this, some binding DNA to silica and washing everything else away. The principle is the one you will use in the activity with peas or strawberries: break the cells and their membranes, remove the proteins, and separate the DNA.
Because the method is so sensitive, contamination control matters from this point on: separate rooms for evidence and reference samples, single-use tools, and blanks run alongside the evidence to show that no stray DNA crept in.
Step 2: how much DNA, and is it human?
Before copying anything, the analyst measures how much human DNA was recovered. Too little, and the result may be patchy or random; too much, and the instruments overload. A drop of blood like the one on Item 2A normally gives plenty.
Step 3: copy selected regions with PCR
Forensic DNA testing does not read the whole genome. It looks at a set of chosen places, called loci, where people differ. At each locus there is a short sequence repeated end to end, a short tandem repeat or STR. PCAST describes the repeats as consecutive copies of a segment 2 to 6 base pairs long. People differ in how many copies they have. At a locus where the repeat is four letters long, one person might carry 11 copies on one chromosome and 14 on the other.
The polymerase chain reaction, PCR, copies just those regions. In the National Human Genome Research Institute's definition, PCR produces "millions to billions of copies of a specific segment of DNA," using short synthetic pieces of DNA called primers to pick out the segment, and repeated rounds of DNA synthesis. Each round can roughly double the number of copies, so 30 rounds could in principle turn one copy into about a billion (2 multiplied by itself 30 times is just over a billion). The primers carry fluorescent dye labels, so every copy glows.
Step 4: sort the copies by size
Copies from a locus with 14 repeats are longer than copies with 11 repeats. Capillary electrophoresis sorts them by length. In PCAST's description, the method relies on the fact that "longer fragments move more slowly than shorter fragments through a polymer solution." An electric field pulls the fragments through a thin, gel-filled tube past a laser; as each glowing fragment passes, a detector records it. Software compares the arrival times with fragments of known size and turns the result into a graph called an electropherogram: a line with peaks, one peak for each allele, at positions that translate into repeat numbers.
Step 5: read the profile
Everyone inherits one copy of each locus from their mother and one from their father. So at each locus a single person shows either two peaks (two different repeat numbers, called heterozygous) or one taller peak (the same number twice, homozygous). The FBI requires profiles uploaded to its national database to include 20 core loci; seven were added on 1 January 2017 to the original 13. The FBI notes that these loci were chosen in non-coding regions and that none has been shown to cause or predict any disease, so the profile is a set of identification markers, not a medical record.
Here are six of the 20 loci from Item 2A, with Corey Vance's reference profile from a court-ordered cheek swab beside it.
| Locus | Item 2A, blood on glass | Vance reference |
|---|---|---|
| D8S1179 | 13, 14 | 13, 14 |
| D21S11 | 29, 30 | 29, 30 |
| TH01 | 6, 6 | 6, 6 |
| FGA | 21, 24 | 21, 24 |
| vWA | 16, 18 | 16, 18 |
| D18S51 | 15, 16 | 15, 16 |
| ... 14 more loci | all agree | all agree |
Item 2A shows exactly one or two alleles at every locus, the mark of a single source. Earlier, before Vance was a suspect, the profile had been searched against the national database and produced no match, which simply meant the source's profile was not on file. When his reference sample was compared, the two profiles agreed at all 20 core loci.
Step 6: what does the match mean? The product rule
A match means Vance cannot be excluded as the source. The question from Lesson 3 follows: how many other people would also match? The random match probability answers it, using the frequency of each allele in a reference population. PCAST sets out the arithmetic. At a locus with two different alleles with frequencies p and q, the genotype frequency is 2pq. At a locus with the same allele twice, it is p squared. Because the loci are inherited independently, the frequencies for each locus are multiplied together, the product rule.
Worked example with three loci. The allele frequencies here are invented round numbers for practice, not real population data.
- D8S1179, alleles 13 and 14, frequencies 0.30 and 0.20: 2 x 0.30 x 0.20 = 0.12
- D21S11, alleles 29 and 30, frequencies 0.20 and 0.25: 2 x 0.20 x 0.25 = 0.10
- TH01, allele 6 twice, frequency 0.23: 0.23 x 0.23 = 0.0529
Multiply: 0.12 x 0.10 x 0.0529 = 0.000635, or about 1 in 1,600. Three loci already narrow the field to one person in about sixteen hundred. Every further locus multiplies by another fraction. If each of the remaining 17 loci matched about one person in ten, the probability would shrink by another factor of ten 17 times over, far below one in the number of people who have ever lived. Real reports use measured frequencies for each population and apply small corrections, but the logic is exactly this.
For a single-source profile, PCAST notes, the likelihood ratio of Lesson 3 is simply 1 divided by the random match probability. That is why DNA reports carry such enormous numbers.
The core of it: A DNA profile is a list of repeat numbers at 20 loci. A match means the person cannot be excluded; the product rule turns allele frequencies into a random match probability, and for a single source the likelihood ratio is its reciprocal.
Changed input: one allele
Now change one number. Suppose Vance's reference had shown 15, 17 at D18S51 instead of 15, 16, with clean, unambiguous peaks in both profiles. Then the profiles differ at a locus, and Vance is excluded as the source of the blood, however well everything else agrees. One clear difference in a single-source profile is decisive in a way no number of agreements can be, which is why DNA has freed people as well as convicted them, as Lesson 12 shows.
Real profiles are not always that clean. A tiny or degraded sample can lose an allele or show extra artifact peaks, and the analyst has to judge which peaks are real. That is where judgement re-enters even a well-validated method.
What the statistic does not say
Three limits keep a DNA match honest.
- Relatives. The random match probability assumes an unrelated person. PCAST notes that for first-degree relatives such as brothers, it may be on the order of 1 in 100,000 with the original 13 loci, and identical twins are expected to match perfectly.
- Human error. PCAST observed that "errors due to human failures will dominate the chance of coincidental matches." A swapped tube or contaminated sample is far more likely than a coincidental match, which is why proficiency testing and the disclosure of a laboratory's quality problems matter.
- How and when. A match says whose DNA it is, not how or when it got there. Here the blood is on the freshly broken edge of the glass the intruder reached through, which narrows the innocent explanations considerably. For a trace of touch DNA on a door handle it would not, as Lesson 12 explains.
The database behind the search
The search that came up empty used the FBI's Combined DNA Index System, CODIS. Its national level, the National DNA Index System, began operating in October 1998 under the DNA Identification Act of 1994. The FBI reports that as of June 2026 it held more than 20.3 million offender profiles, 6.4 million arrestee profiles and 1.48 million forensic profiles from crime scenes, and had produced more than 808,000 hits assisting more than 784,000 investigations. A database hit is an investigative lead: the FBI notes that the laboratories holding the matching profiles contact each other to confirm it, because names are not stored at the national level. In Wrenfield there was no hit at all; the match came later, from a direct comparison with Vance's own reference sample.
Common misconceptions
- "DNA testing reads a person's whole genetic code." Forensic profiling measures repeat lengths at 20 selected non-coding loci, chosen for identification, not for medical information.
- "A one-in-a-billion match statistic means a one-in-a-billion chance the person is innocent." That is the prosecutor's fallacy from Lesson 3. The statistic is the chance an unrelated random person would match; it says nothing about relatives, lab error or how the DNA got there.
- "A database hit is proof of guilt." A hit is a lead. It is confirmed with a new reference sample, and then the question becomes how the DNA came to be there.
- "More loci always mean certainty." More loci shrink the coincidence probability, but the chance of human error does not shrink with them, and PCAST warned that error will dominate.
Recap
- The steps are extraction, quantitation, PCR amplification of STR loci with dye-labelled primers, capillary electrophoresis and interpretation of the electropherogram.
- Each person has two alleles at each locus; the FBI requires 20 core loci, seven of them added on 1 January 2017.
- Random match probability: 2pq for two different alleles, p squared for one allele twice, multiplied across loci. For a single source, the likelihood ratio is its reciprocal.
- One clear difference excludes; agreement at all loci means the person cannot be excluded.
- Relatives, human error and the question of how and when DNA arrived all limit what a match means.
- Item 2A gave a single-source profile with no CODIS hit; Vance's court-ordered reference matched at all 20 loci.
Sources
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Section 5.1, DNA analysis of single-source and simple-mixture samples, and footnotes 173-189. obamawhitehouse.archives.gov
- Federal Bureau of Investigation. (n.d.). Combined DNA Index System (CODIS): overview, National DNA Index System and CODIS core loci. Accessed October 27, 2026. le.fbi.gov
- Federal Bureau of Investigation. (2026). CODIS-NDIS statistics, as of June 2026. le.fbi.gov
- National Human Genome Research Institute. (2026). Polymerase chain reaction (PCR). In Talking glossary of genomic and genetic terms. genome.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. DNA analysis summary assessment, pp. 132-133. ojp.gov
- Genetic Science Learning Center. (2013). How to extract DNA from anything living. University of Utah. learn.genetics.utah.edu
- Key terms
- locus
- A specific place in the genome; forensic profiles examine 20 core loci.
- short tandem repeat (STR)
- A sequence of 2 to 6 base pairs repeated end to end; people differ in the number of repeats.
- allele
- One version of a locus; at an STR locus, named by its number of repeats.
- PCR
- Polymerase chain reaction: a technique that makes millions to billions of copies of a chosen DNA segment.
- capillary electrophoresis
- Separation of DNA fragments by length as they move through a polymer-filled tube; shorter fragments move faster.
- electropherogram
- The graph of peaks produced by capillary electrophoresis; each peak marks an allele.
- product rule
- Multiplying the genotype frequencies at independent loci to get the frequency of a whole profile.
- random match probability
- The chance that an unrelated person chosen at random would have the same DNA profile.
- CODIS
- The FBI's Combined DNA Index System, whose national level holds offender, arrestee and crime scene profiles.
DNA's Hard Questions: Mixtures, Transfer and Genetic Genealogy
- Explain why DNA mixtures are harder to interpret than single-source samples, and weigh the case for and against probabilistic genotyping software.
- Explain how DNA transfer limits what a match can say, and how Y-chromosome and mitochondrial markers trace family lines.
- Describe investigative genetic genealogy and the safeguards in the Department of Justice's 2019 interim policy, and summarise what DNA exonerations have shown.
A swab with too many people on it
Item 9 is a swab from the handle of the Wrenfield cash drawer, taken before any fingerprint powder went near it. Its electropherogram does not look like Item 2A's. At several loci there are three or four peaks instead of one or two, and some peaks are tall while others barely rise above the background. The laboratory's conclusion: a mixture of DNA from at least two people. The major contributor's profile matched Dana Whitcomb's reference sample. The minor contributor's peaks were too low and too few to interpret, so no comparison could be made with anyone.
That result is ordinary, and it opens the hard questions in DNA evidence. How should a mixture be interpreted? What does DNA on a handle mean, when DNA moves from hand to object to hand? And how far should investigators go in searching for relatives of an unknown donor? Experts disagree about the first and third, and this lesson sets out each side and what would settle it.
Dispute 1: can software interpret complex mixtures reliably?
Why mixtures are hard. A 2024 scientific foundation review by the National Institute of Standards and Technology (NIST), written by John Butler and colleagues, opens its findings bluntly: "DNA mixtures, in which the DNA of more than one individual is present in a sample, are inherently more difficult to interpret than high-quality single-source DNA samples." Peaks from different people overlap, alleles they share sit on top of one another, and with very small amounts of DNA the copying process itself produces random dropouts and artifacts. The review lists what drives complexity: the number of contributors, the amount from each, their ratio, the sample's quality and how many alleles they share.
The old way and its failure. For years many laboratories summarised mixtures with a simple statistic called the combined probability of inclusion, which asks what fraction of people would be included as possible contributors. In 2016 PCAST judged that approach, as used for complex mixtures, "an inadequately specified, subjective method that has the potential to lead to erroneous results," and concluded it was not foundationally valid. It described a 2011 study by Itiel Dror and G. Hampikian in which the DNA from a real case in Georgia was given to 17 expert examiners without the case background the original analysts had known. Only one of the 17 agreed with the original conclusion that the suspect could not be excluded; 12 excluded him.
The case for probabilistic genotyping. The modern approach uses probabilistic genotyping software, computer programs that model peak heights, dropout and artifacts statistically and calculate a likelihood ratio for whether a person of interest contributed. Supporters point out that such software uses far more of the information in a profile than the old methods. NIST's review agrees that a probabilistic genotyping framework "offers the best available tool for DNA mixture interpretation," and PCAST called the approach a "promising" one.
The case for caution. PCAST found that published evidence in 2016 supported the software only within limits: some programs, mixtures of up to three people, with the minor contributor making up at least 20 percent of the DNA. NIST's 2024 review adds several cautions of its own. Likelihood ratios "are assigned and not measured," and different analysts may assign different values to the same evidence; "there is no single, true likelihood ratio." Publicly available validation data lack the detail needed for an independent assessment of reliability. And current proficiency tests focus mainly on single-source samples and simple two-person mixtures, not the low-level, many-person mixtures common in casework.
What would settle it. Both sides agree on the remedy, which is more evidence of the right kind: published validation data on samples as complex as casework, studies comparing laboratories on the same mixtures, and proficiency tests that include hard mixtures. Until then, a mixture result should come with a statement of how similar it is to the samples the software was validated on.
Key idea: Single-source DNA is close to objective. Complex mixtures require judgement and modelling, and their reliability has to be shown with validation on similar samples, not assumed from DNA's reputation.
Transfer: whose DNA, but not how or when
The minor contributor on the drawer handle could be the intruder. It could also be a customer who handed Dana a note she later put in the drawer, or someone who shook her hand that morning. NIST's review states the problem plainly: "DNA can be transferred from one surface or person to another, and this can potentially occur multiple times." Highly sensitive methods make it more likely that analysts detect DNA unrelated to the crime. A likelihood ratio about whose DNA it is says nothing about how or when it got there, so NIST warns that reporting one as a standalone number "can be misleading" without its assumptions. It also notes that scientific data on DNA transfer, persistence and prevalence in realistic situations still have significant gaps.
None of this makes DNA worthless. NIST's own words: the fact that DNA can transfer "does not negate the value of DNA evidence," but its value "depends on the circumstances of the case." Compare the two Wrenfield items. Blood on the freshly broken edge of the glass the intruder reached through is hard to explain by innocent transfer. A faint trace of skin DNA on a handle touched daily by the person who works there is easy to explain. Same technology, very different meaning.
Lineage markers: following one family line
Two kinds of DNA are inherited through one parent only. Mitochondrial DNA comes from the mother, as you saw with the hair in Lesson 6. The Y chromosome, which only males carry, passes from father to son, so markers on it, called Y-STRs, are shared by men along a paternal line. Lineage markers are useful when ordinary profiles fail: mitochondrial DNA survives in hair shafts and old bone, and Y-STRs can pick out a male contributor in a mixture dominated by female DNA. Their weakness is the same as their strength. A match includes a whole family line, so the statistics are far weaker than a 20-locus profile's, and Lesson 16 shows how a Y-chromosome result once revealed a break in a family tree five centuries long.
Dispute 2: searching for relatives through genealogy databases
The technique. When a crime scene profile finds no match in CODIS, the donor may still have relatives who have taken consumer DNA tests. Investigative genetic genealogy, which the Department of Justice calls forensic genetic genealogical DNA analysis and searching, tests the crime scene sample for more than half a million single nucleotide polymorphisms (SNPs), single-letter variations spread across the genome, and uploads that profile to genealogy services whose users have shared their own data. Long shared stretches of DNA suggest close relatives; shorter ones, distant cousins. Genealogists then build family trees to narrow the candidates.
The case for. The technique can identify suspects in cases where every other lead is exhausted, and can put names to unidentified human remains. The Department's policy presents it as a tool to identify violent criminals and also to "exonerate innocent suspects."
The case against, or for limits. The people whose DNA makes the search work are relatives who never consented to helping police find a family member, and the data reveal relationships people may not know about. These are questions of privacy and consent, not of laboratory accuracy.
The rules adopted. The Department of Justice's interim policy, approved in September 2019 and effective 1 November 2019, sets conditions for federal investigators and for agencies using Department funds:
- Use is limited to unsolved violent crimes, meaning homicides and sex crimes (with narrow exceptions approved by a prosecutor), and to identifying the remains of suspected homicide victims.
- The profile must first have been searched in CODIS without a confirmed match, and reasonable investigative leads must have been pursued.
- Investigators must identify themselves as law enforcement and use only genealogy services that explicitly notify their users that police may search them.
- "A suspect shall not be arrested based solely on a genetic association." Any suspect must be confirmed by ordinary STR testing against the crime scene profile.
- Informed consent is required before collecting reference samples from relatives, unless a prosecutor approves covert collection because asking would compromise the investigation.
- Genealogy profiles are never uploaded to CODIS.
What would settle it. Science cannot. The method's accuracy is checked case by case by the required STR confirmation. Whether its benefits justify searching the genetic data of people who are not suspects is a question for legislatures, courts and the public, which is why rules like these exist.
Wrenfield never needed this. The blood on Item 2A was single source, and a suspect emerged by ordinary investigation. Genealogy searching is reserved for the hardest cases.
What DNA has done for the wrongly convicted
DNA's most important legacy may be what it revealed about the rest of the justice system. The Innocence Project records that the first DNA exoneration in the United States took place in 1989, and that it counted 375 DNA exonerations by 2020, when it stopped tracking every case. Its figures show that 69 percent involved eyewitness misidentification and 43 percent involved misapplication of forensic science, including the hair testimony you met in Lesson 6. In about half the cases, the Innocence Project reports, the real perpetrator was later identified. DNA did not just free people. It provided a check, case by case, on how often the other evidence had been wrong, and Module 7 follows where that led.
Common misconceptions
- "A DNA result is always objective." Single-source profiles are close to objective, but complex mixtures require modelling and judgement, and experts given the same mixture have reached opposite conclusions.
- "If your DNA is on something, you touched it." DNA can transfer indirectly, sometimes more than once. A match says whose DNA it is, not how or when it got there.
- "Genetic genealogy finds the culprit by itself." It produces leads about relatives. Under the Department of Justice policy, no one may be arrested on a genetic association alone; a standard DNA comparison must confirm any suspect.
- "A Y-STR or mitochondrial match identifies one person." Lineage markers are shared along a family line, so a match includes many relatives.
What to carry forward
- Mixtures are inherently harder than single-source samples; complexity grows with contributors, low quantities, unbalanced ratios and shared alleles.
- PCAST found the older combined probability of inclusion approach not foundationally valid for complex mixtures and probabilistic genotyping valid only within tested limits (up to three contributors, minor at least 20 percent, in 2016).
- NIST's 2024 review: probabilistic genotyping is the best available tool, but likelihood ratios are assigned, not measured, and public validation data and proficiency tests fall short for complex mixtures.
- DNA transfers, sometimes repeatedly; a match tells whose DNA, not how or when it arrived. Context decides its value.
- Y-STRs follow the paternal line and mitochondrial DNA the maternal line; matches include relatives.
- Investigative genetic genealogy searches SNP profiles in consumer databases; the 2019 Department of Justice policy limits it to violent crimes and unidentified remains and forbids arrest on a genetic association alone.
- The Innocence Project counted 375 DNA exonerations by 2020; 43 percent involved misapplied forensic science.
Sources
- Butler, J. M., Iyer, H., Press, R., Taylor, M. K., Vallone, P. M., & Willis, S. (2024). DNA mixture interpretation: A NIST scientific foundation review (NIST IR 8351). National Institute of Standards and Technology. Key takeaways 2.1-2.7, 4.3-4.4 and 5.1-5.6. doi.org
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Section 5.2 and Finding 3 on complex mixtures. obamawhitehouse.archives.gov
- U.S. Department of Justice. (2019). Interim policy: Forensic genetic genealogical DNA analysis and searching (approved September 2, 2019; effective November 1, 2019). justice.gov
- Innocence Project. (n.d.). DNA exonerations in the United States. Accessed October 27, 2026. innocenceproject.org
- National Human Genome Research Institute. (2026). Y chromosome; Mitochondrial DNA. In Talking glossary of genomic and genetic terms. genome.gov
- Key terms
- DNA mixture
- A sample containing DNA from more than one person; inherently harder to interpret than a single-source sample.
- probabilistic genotyping software
- Computer programs that model peak heights, dropout and artifacts to calculate a likelihood ratio for a mixture.
- combined probability of inclusion
- An older mixture statistic that PCAST judged not foundationally valid for complex mixtures.
- DNA transfer
- Movement of DNA from a person or surface to another, possibly more than once, without direct contact by the source.
- Y-STR
- An STR marker on the Y chromosome, shared by men along the paternal line.
- single nucleotide polymorphism (SNP)
- A one-letter variation in the DNA sequence; genealogy profiles use hundreds of thousands of them.
- investigative genetic genealogy
- Searching a crime scene SNP profile in genealogy databases to find relatives, then building family trees to produce leads.
- exoneration
- The clearing of a person convicted of a crime, for example when DNA shows they were not the source of key evidence.
Module 5: The Body as Evidence
The upstairs half of the Wrenfield case. Toxicology asks what was in Walter Penhallow's body and whether it mattered; the death investigation asks what can and cannot be said about when he died; insects narrow the timing; and bones found during a search raise the first question every forensic anthropologist asks. Death is handled throughout as a medical examiner would describe it: briefly and without graphic detail.
Toxicology: What Was in the Body, and Did It Matter?
- Explain why toxicologists collect several specimens and prefer peripheral blood after death, including what postmortem redistribution is.
- Distinguish screening, confirmation and quantitation, and explain why a confirmation test must use a different chemical principle.
- Estimate a blood alcohol concentration with the Widmark formula and show how much its uncertainty matters.
The problem: a heart medicine in the blood
On the Tuesday after Walter Penhallow was found, the medical examiner, Dr. Lena Hartigan, had an autopsy finding and a question. The finding: severe narrowing of the arteries that supply the heart, and scarring from an old heart attack. The question: did anything Walter swallowed contribute to his death? His kitchen held a pharmacy bottle of metoprolol, a common heart medication, prescribed to him and nearly full. If he had taken too much, or mixed it with alcohol or something else, the story might change. If the intruder had somehow been involved, toxicology might show that too.
So the laboratory's job was to answer three questions in order. What substances are present? How much of each? And does that amount mean anything for this death? This lesson works through them, then turns to the most common toxicology test of all, blood alcohol, where a famous formula meets a large uncertainty.
Step 1: which specimens, and why more than one?
At autopsy the examiner collected blood from a femoral vein in the leg, blood from the heart, vitreous humour (the clear gel inside the eye), urine and a sample of liver. Why so many?
The answer is a phenomenon called postmortem redistribution. As the toxicologist Iain McIntyre explains in a 2014 paper, drug concentrations in the blood after death "may not always replicate the antemortem drug levels," because drugs move after death, diffusing out of organs and tissues into nearby blood. When it happens, blood from the heart and central body cavity generally shows higher concentrations than blood from peripheral sites, most commonly the femoral vein in the leg. Drugs that are fat-soluble and spread widely into tissues are most prone to it. So toxicologists prefer peripheral blood for measuring concentrations, compare it with central blood, and use the liver concentration as another clue. Even femoral blood is not immune: McIntyre cites a case series in which postmortem femoral concentrations exceeded the concentrations measured before death for five of six drugs.
Vitreous humour is useful precisely because it is sealed away in the eye, partly protected from these shifts, and urine shows what the body was excreting, which can reveal drug use in the preceding days even when blood levels have fallen.
Step 2: screening, then confirmation, then quantitation
A toxicologist cannot test for every chemical in existence, so testing runs in stages. The forensic toxicology standard on method validation, ANSI/ASB Standard 036 (2019), defines the stages.
- Screening is "an assay designed to rule out the presence of analytes or to suggest their presence," flagging what needs further testing. Many screens are immunoassays, which use antibodies that bind to a drug or class of drugs. They are fast and sensitive, but a positive screen is not an identification, because similar molecules can bind the same antibody.
- Confirmation uses an assay that is more specific and, in the standard's words, "based on a different chemical principle than a screening method." Two different principles rarely make the same mistake. The usual confirmation methods separate the mixture by chromatography and identify each compound by mass spectrometry, gas chromatography-mass spectrometry (GC-MS) or liquid chromatography with tandem mass spectrometry (LC-MS/MS). The National Academy of Sciences called GC-MS "the near universal test" for identifying unknown drug substances in seized-drug work, and the same logic runs through toxicology.
- Quantitation measures how much is present, with calibration standards and controls, and reports a concentration such as milligrams per litre.
Chromatography is worth a sentence because you will do a simple version in the activity. A mixture is carried by a moving phase (a gas, a liquid, or water creeping up paper) past a stationary phase. Compounds that cling more to the stationary phase lag behind, so the mixture separates into its components. The mass spectrometer then breaks each separated compound into charged fragments whose masses form a pattern characteristic of that molecule.
Remember: A screen suggests; a confirmation by a different chemical principle identifies; quantitation measures. A positive screen alone is never a finding.
Step 3: what does the number mean?
Walter's results, as reported to Dr. Hartigan:
| Specimen | Finding |
|---|---|
| Femoral blood | Metoprolol detected and confirmed by LC-MS/MS; concentration within the range reported for people taking the drug as prescribed |
| Heart blood | Metoprolol about twice the femoral concentration |
| Femoral blood and vitreous humour | No alcohol detected |
| Broad screen of blood and urine | No other drugs detected |
Read the table the way a toxicologist would. The femoral concentration, the best estimate of the level at death, matches ordinary use of a prescribed medicine, which also fits the nearly full bottle. The higher heart-blood value is what postmortem redistribution predicts, and it is exactly why a toxicologist does not interpret heart blood alone: taken by itself, a doubled value might have suggested an overdose that never happened. No alcohol and no other drugs were found.
Interpretation has further traps. Ranges for "therapeutic," "toxic" and "lethal" concentrations published in reference tables overlap, because people differ in tolerance, health and other medicines. A concentration that would harm one person may be routine for another who has taken the drug for years. So the toxicologist does not declare a cause of death. The report states what was found and what it is consistent with, and the medical examiner weighs it alongside the autopsy, the medical history and the scene. Here the toxicology does not explain the death, and the heart disease does. The next lesson follows how that becomes a cause and manner of death, and why the timing matters as much as the cause.
Blood alcohol: a number with an error bar
Most toxicology tests in the United States involve living people, and the most common question is blood alcohol. The National Highway Traffic Safety Administration explains that alcohol is absorbed through the stomach and small intestine, passes into the bloodstream, and is metabolised by the liver. Blood alcohol concentration (BAC) is measured as grams of alcohol per decilitre of blood. It is illegal in every state to drive with a BAC of .08 g/dL or higher, except Utah, where the limit is .05. NHTSA's figures also show why the limit is not a safety line: in 2024, 2,028 people were killed in crashes in which a driver had a BAC between .01 and .07. In 2024, 11,904 people died in crashes involving a driver at .08 or above.
Sometimes a toxicologist is asked to estimate a BAC that was never measured, or to work backward from a test taken hours later. The classic tool is a formula published by Widmark in 1932. As set out by the forensic toxicologist Ashraf Mozayani in a presentation hosted by NIST:
C = A / (r x W) - (beta x t)
Here A is the mass of alcohol consumed, W is body mass, r is the Widmark factor (the share of body mass through which alcohol spreads), beta is the elimination rate and t is the time since drinking began. Mozayani gives r as 0.68 plus or minus 0.17 for men and 0.55 plus or minus 0.11 for women, and an average elimination rate of about 0.018 g/dL per hour, with individuals ranging from 0.009 to 0.035.
Worked example (hypothetical). A man of 70 kg (70,000 g) drinks two US standard drinks quickly. The National Institute on Alcohol Abuse and Alcoholism defines a standard drink as about 14 grams of pure alcohol, so A = 28 g.
- Peak estimate with r = 0.68: 28 / (0.68 x 70,000) = 0.00059 grams per gram, which is about 0.059 grams per 100 grams, roughly 0.059 g/dL.
- Two hours later, with beta = 0.018: 0.059 - (0.018 x 2) = 0.023 g/dL.
Now apply the uncertainty. If his true r is 0.51 rather than 0.68, the peak estimate rises to about 0.078; if it is 0.85, it falls to about 0.047. If his elimination rate is 0.009 rather than 0.018, the two-hour estimate is about 0.041; at 0.035, it reaches zero. Combine the extremes (r of 0.51 and the slowest elimination) and the two-hour estimate is about 0.060. The same drinks, the same man, and the plausible answers run from zero to more than twice the central estimate. Widmark's method also assumes absorption is complete, which Mozayani notes takes between 30 minutes and 2 hours after drinking.
That is why Mozayani's presentation argues that a single BAC value reported without its range misleads, and cites a court in Snohomish County, Washington, which held that admitting a breath-test value "without stating a confidence interval" was unfairly prejudicial. It is also why no calculation can tell anyone it is safe to drive after drinking.
Remember: A blood alcohol estimate from the Widmark formula is a range, not a number, because body composition, absorption and elimination all vary between people.
Common misconceptions
- "A positive drug screen proves the drug was there." A screen suggests or rules out. Identification requires confirmation by a more specific method based on a different chemical principle.
- "Blood from anywhere in a body after death gives the same drug level." Postmortem redistribution can raise concentrations, especially in heart and central blood, so peripheral blood is preferred and interpreted with care.
- "A concentration above the therapeutic range means an overdose killed the person." Therapeutic, toxic and lethal ranges overlap, and tolerance varies. The medical examiner, not the toxicology number alone, decides cause of death.
- "Under .08 means unimpaired." NHTSA records over two thousand deaths in 2024 in crashes involving drivers between .01 and .07. Impairment begins well below the legal limit.
The short version
- Postmortem toxicology collects several specimens: peripheral (femoral) blood is preferred because drugs can redistribute after death, raising central blood levels; vitreous humour and urine add information.
- Testing runs screen, then confirmation by a different chemical principle (usually chromatography with mass spectrometry), then quantitation.
- Interpretation weighs concentration against overlapping reference ranges, tolerance and the case; the medical examiner decides cause of death.
- Walter's femoral metoprolol fitted prescribed use, his heart-blood level was higher as redistribution predicts, and no alcohol or other drugs were found: toxicology does not explain the death.
- BAC limits are .08 g/dL in most states and .05 in Utah. Widmark estimates (C = A / rW - beta t) carry wide uncertainty and should be reported as ranges.
Sources
- McIntyre, I. M. (2014). Identification of a postmortem redistribution factor (F) for forensic toxicology. Journal of Analytical Science and Technology, 5, 24. springeropen.com
- AAFS Standards Board. (2019). ANSI/ASB Standard 036: Standard practices for method validation in forensic toxicology (1st ed.). Section 3, definitions of screening, confirmation and quantitative methods. aafs.org
- National Highway Traffic Safety Administration. (n.d.). Drunk driving. U.S. Department of Transportation. Accessed October 27, 2026. nhtsa.gov
- Mozayani, A. (2017). The estimation of blood alcohol concentration: Widmark revised [Presentation slides]. Hosted by the National Institute of Standards and Technology. nist.gov
- National Institute on Alcohol Abuse and Alcoholism. (n.d.). What is a standard drink? National Institutes of Health. niaaa.nih.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Analysis of controlled substances, pp. 134-135. ojp.gov
- Key terms
- postmortem redistribution
- The movement of drugs after death from organs and tissues into nearby blood, often raising concentrations in central blood.
- vitreous humour
- The clear gel inside the eye, a protected specimen useful for alcohol and other tests after death.
- screening method
- A test designed to rule out a substance or suggest its presence, indicating further testing may be needed.
- immunoassay
- A screening test that uses antibodies binding to a drug or drug class; fast but not specific enough to identify.
- confirmation
- A more specific test based on a different chemical principle from the screen, such as GC-MS or LC-MS/MS.
- chromatography
- Separation of a mixture as a moving phase carries its components past a stationary phase at different speeds.
- blood alcohol concentration (BAC)
- Grams of alcohol per decilitre of blood; .08 g/dL is the legal driving limit in most US states.
- Widmark formula
- C = A / (r x W) - beta x t, an estimate of blood alcohol from the amount drunk, body mass, distribution factor and elimination.
The Death Investigation: Cause, Manner and the Limits of the Clock
- Compare medical examiner and coroner systems and explain why the National Academy of Sciences recommended replacing coroners.
- Distinguish cause of death from manner of death and apply the four manner categories.
- Explain why body cooling and other postmortem changes give a range for the time of death, not an hour, and combine them with circumstantial evidence.
The wrong answer we start from
At 9:30 on Monday morning, standing on the stairs below Walter Penhallow's flat, Detective Sergeant Reyes put her theory into a single sentence: "He was cold and stiff when the officers found him at 8:05, so he died last night, when the burglar came." It sounds like science. On television a pathologist glances at a body and names the hour. This lesson takes that sentence apart, piece by piece, and replaces it with what a death investigation can honestly say. Along the way it explains who investigates deaths in the United States, and the difference between how someone died and why.
Everything here about Walter is fictional, and it is described the way a medical examiner's report would describe it: briefly, clinically, and without graphic detail.
Who answers the question: coroners and medical examiners
When a person dies suddenly, unexpectedly or by violence, the death falls under the legal authority of a coroner or a medical examiner. As the Centers for Disease Control and Prevention puts it, a medicolegal investigation is "a scientific inquiry into a death" under that office's jurisdiction, and each state sets its own rules for which deaths must be investigated and what training investigators need.
The two offices are very different. The coroner is an office brought from England, where, the 2009 National Academy of Sciences report notes, it was formalised in the twelfth century to protect the crown's financial interests. In the United States, the report found that 82 percent of coroners are elected, and that coroners "may or may not be physicians, may or may not have medical training, and may or may not perform autopsies." The CDC adds that in most states coroners are not required to be physicians or forensic pathologists. Medical examiners, by contrast, are appointed and are almost always physicians, often forensic pathologists, doctors with specialist training in investigating death.
The National Academy committee was blunt about the gap. It called the disconnect between a medical professional's findings and what a lay coroner may independently certify "the weakest link in the process," and its Recommendation 11 urged incentive funding for states to establish medical examiner systems, "with the goal of replacing and eventually eliminating existing coroner systems." Wrenfield's county has a medical examiner, Dr. Lena Hartigan, a forensic pathologist.
Cause and manner: two different questions
A death certificate answers two questions that are easy to confuse. The cause of death is the disease or injury that led to death, such as coronary artery disease or a head injury. The manner of death is the category of circumstance. The National Academy report lists the medicolegal autopsy's role as determining the cause and helping to determine "the manner of death as natural, suicide, homicide, or accident."
| Manner | Meaning | Example |
|---|---|---|
| Natural | Death due entirely to disease or ageing | Heart disease |
| Accident | Unintended injury | A fall from a ladder |
| Suicide | Injury the person inflicted intending to die | (handled with care in any report) |
| Homicide | Death at the hands of another person | Death caused by another person's actions |
The same cause can come with different manners. A fatal head injury could be an accident (a fall), a homicide (a blow) or, rarely, something else; the cause describes the body, and the manner describes the circumstances. That is exactly why the time of death mattered so much for Walter. If a burglar's intrusion had frightened Walter into a fatal heart attack, the manner of his death would become a hard question, even though the cause would still be heart disease. If Walter died before the burglary, the manner is natural and the burglary is a separate event.
The point: Cause is the disease or injury; manner is the circumstance. The same cause can have different manners, so the facts around a death, including its timing, matter as much as the autopsy.
Debugging the sentence: "cold"
After death, the body stops producing heat and begins to cool toward the temperature of its surroundings. The standard method for estimating time since death from cooling, as two studies by L. S. Wilk and colleagues in Amsterdam describe it, is a model developed by Claus Henssge in the late 1970s and usually presented as a chart called a nomogram. It relates the core temperature to the time since death, adjusting for body weight, clothing and the surface the body lies on.
Three facts break the detective's reasoning.
- Cooling is not steady. Henssge's model describes cooling with a double exponential curve: temperature falls slowly at first, then faster, then ever more slowly as it approaches the room temperature. A rule that a body loses a fixed number of degrees every hour does not describe that curve.
- Cooling ends. Once the body reaches room temperature, it stops changing. A body at room temperature could have reached it a day earlier or three days earlier. "Cold" means many hours, not last night.
- Even the best model gives a range. Wilk and colleagues report that estimates from Henssge's nomogram carry uncertainties of about plus or minus 2.8 hours at best and up to about 7 hours. The model classifies bodies only by weight, so two people of the same weight but different build cool at different rates, and conditions unlike those behind the model require subjective corrections or rule it out altogether.
When the medical examiner's investigator reached the flat at 9:50 on Monday, she recorded the room temperature and the body temperature, as the National Institute of Justice's guide for scene investigators requires, and found them essentially equal. That reading said only that Walter had died many hours earlier, too long ago for the cooling method to give an estimate at all.
Debugging "stiff" and the other changes
The NIJ guide tells scene investigators to document every postmortem change before the body is moved: livor (the settling of blood to the lowest parts of the body, noting its colour, location and whether it blanches when pressed), rigor (the stiffening of muscles, noting its stage and where it is present), the degree of decomposition, insect activity, the scene temperature and the body temperature. These changes develop and then pass in a sequence over hours and days, which is why they help. But the timing of each varies with temperature, body build and circumstances, so they give broad, overlapping windows. Documenting them, the guide notes, helps establish cause and manner, "provide information as to the time of death," corroborate witnesses, and show whether a body has been moved.
So "stiff" narrows nothing to a night either. In Walter's case the investigator's documented changes, together with early decomposition, were consistent with death more than a day before he was found, and possibly two or more. That is a range measured in days.
The point: Postmortem changes give ranges that widen with time. A cold body says "many hours"; a sequence of changes says "roughly this many days." None of them names an hour.
Replacing the sentence: combine independent evidence
Medical examiners narrow the window by combining the body with everything else that has a time on it. In Walter's case:
| Evidence | What it says about time |
|---|---|
| Neighbour Ines Carvalho spoke with him as he locked up | Alive at 6:15 p.m. Friday |
| Text message to his daughter | Alive at 9:40 p.m. Friday |
| Saturday's newspaper still on his doorstep; Ruth's call at 10:15 a.m. Saturday unanswered | Probably not up and about on Saturday morning |
| Body temperature equal to room temperature; documented postmortem changes | Death well over a day before 8:05 a.m. Monday |
| Insects collected in the flat (Lesson 15) | A minimum time since death, which turns out to reach back to Saturday |
Each line has its own weakness: people sometimes ignore phone calls, and newspapers are left out for many reasons. But they are independent of one another and point the same way. Dr. Hartigan's conclusion, once the insect evidence came back, was that Walter died between his last text on Friday night and about midday on Saturday. The autopsy showed severe coronary artery disease and an old heart-attack scar, and no injuries. Toxicology (Lesson 13) found nothing that contributed. She certified the cause of death as heart disease and the manner as natural.
The burglary happened on Sunday night, at least a day and a half later. The intruder did not cause Walter's death, and there is no evidence he even knew Walter was there. The detective's theory was reasonable at 9:30 on Monday. By the end of the week, evidence had tested it and it had failed, which is how a theory should be treated.
Common misconceptions
- "A pathologist can tell the exact time of death." Even the standard cooling model carries uncertainties of hours at best, and once a body reaches room temperature it gives no estimate at all. Time of death is a range, narrowed by combining independent evidence.
- "Bodies cool by a fixed amount every hour." Cooling follows a curve that depends on body build, clothing, surroundings and the surface beneath, and stops at room temperature.
- "Cause and manner of death mean the same thing." Cause is the disease or injury; manner is the circumstance: natural, accident, suicide or homicide.
- "A coroner is always a doctor." In most states coroners are not required to be physicians, and most are elected; medical examiners are almost always physicians.
Where this leaves us
- Deaths under legal jurisdiction are investigated by coroners (mostly elected, often not physicians) or medical examiners (appointed, almost always physicians); the National Academy of Sciences recommended replacing coroner systems.
- Cause is the disease or injury; manner is natural, accident, suicide or homicide. The same cause can have different manners.
- Henssge's cooling nomogram is the standard method, with uncertainties of about 2.8 to 7 hours, and it cannot be used once a body has reached room temperature.
- Scene investigators document livor, rigor, decomposition, insects and temperatures; these give broad windows, not an hour.
- Walter died between Friday night and Saturday midday of heart disease, manner natural, well before the Sunday burglary.
Sources
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Chapter 9, "Medical examiner and coroner systems: Current and future needs," from p. 241, and Recommendation 11. ojp.gov
- Centers for Disease Control and Prevention, Public Health Law Program. (2015). Coroner and medical examiner laws. cdc.gov
- National Institute of Justice. (2011). Death investigation: A guide for the scene investigator (NCJ 234457). U.S. Department of Justice. Section on documenting postmortem changes. ojp.gov
- Wilk, L. S., Hoveling, R. J. M., Edelman, G. J., Hardy, H. J. J., van Schouwen, S., van Venrooij, H., & Aalders, M. C. G. (2020). Reconstructing the time since death using noninvasive thermometry and numerical analysis. Science Advances, 6, eaba4243. University of Amsterdam repository copy. pure.uva.nl
- Wilk, L. S., Edelman, G. J., Roos, M., Clerkx, M., Dijkman, I., Vera Melgar, J., Oostra, R.-J., & Aalders, M. C. G. (2021). Individualised and non-contact post-mortem interval determination of human bodies using visible and thermal 3D imaging. Nature Communications, 12. nature.com
- Key terms
- medicolegal death investigation
- A scientific inquiry by a coroner's or medical examiner's office into a death under its legal jurisdiction.
- coroner
- An official, usually elected, responsible for death investigation; in most states not required to be a physician.
- medical examiner
- An appointed official, almost always a physician and often a forensic pathologist, who investigates deaths.
- cause of death
- The disease or injury that led to death.
- manner of death
- The circumstance of death: natural, accident, suicide or homicide.
- postmortem interval
- The time that has passed since death; always estimated as a range.
- Henssge's nomogram
- The standard chart for estimating time since death from body cooling, with uncertainties of hours.
- livor and rigor
- The settling of blood after death and the stiffening of muscles; documented at scenes but giving only broad time windows.
Insects and the Time Since Death
- Describe the blow fly life cycle and explain why insect development gives a minimum time since death.
- Calculate accumulated degree hours from temperature records and use them to estimate when insects colonised remains.
- Explain the limits of entomological estimates, including temperature reconstruction, access, species data and variation.
Small evidence in a sealed vial
When the medical examiner's investigator documented Walter Penhallow's flat on Monday morning, she followed the checklist in the National Institute of Justice guide, which includes "insect and animal activity." The window over the kitchen sink was open a few centimetres, as it often was in the warm weeks of late September, and she found blow fly eggs and young maggots in the room. She collected samples into labelled vials, some preserved at once and some kept alive, placed a temperature logger in the flat, and sent everything to Dr. Paul Iversen, a forensic entomologist.
Lesson 14 ended with a range for Walter's death measured in days. This lesson shows how insects narrow it, step by step, using a calculation you can do with a pencil. As in every lesson about death in this course, the description stays on the science.
Why insects keep time
A 2011 review by J. Amendt and colleagues defines forensic entomology as "the science of collecting and analysing insect evidence to aid in forensic investigations," and states its main use: determining "the minimum time since death," either from the age of the oldest insects that developed on the body or from which species are present.
Blow flies are the key insects. A 2023 study by Amanda Roe and Leon Higley calls them "the most important single group of insects in forensic entomology," because many species are strongly attracted to decay and arrive early. The National Library of Medicine's exhibition on forensic science describes the life cycle of the black blow fly: adult females arrive within minutes and lay eggs; the eggs hatch into first-stage maggots within about 24 hours; these feed and moult into second-stage, then third-stage maggots; after more feeding, the third-stage maggots leave to pupate and eventually emerge as adult flies.
| Stage | What happens |
|---|---|
| Egg | Laid soon after the flies find the remains |
| First larval stage (L1) | Hatches and begins feeding |
| Second larval stage (L2) | After a moult; larger, still feeding |
| Third larval stage (L3) | Feeds, then stops and wanders away from the remains |
| Pupa | Develops inside a hardened case |
| Adult | Emerges; the cycle can begin again |
The logic is simple. Flies cannot lay eggs on remains before death, and if they had access, they usually arrive soon after. So the age of the oldest insects is a minimum time since death: the person died at least that long ago, and possibly longer if the flies were delayed.
Temperature is the clock's speed
Insects are cold-blooded. As a 2004 conference paper from the University of Nebraska explains, blow flies develop at rates "largely dependant on the temperature of their surroundings": slower when cool, faster when warm, and not at all below a threshold temperature at which development stops. So the age of a maggot cannot be read in hours directly. It has to be read in heat.
Entomologists use accumulated degree hours (ADH). For each hour, take the temperature, subtract the threshold (often called the base temperature), and add up the results. A stage of development requires a roughly fixed amount of accumulated heat, whatever the temperature that delivered it, within limits.
ADH = sum over each hour of (temperature - base temperature)
Hours colder than the base add nothing.
Worked example: Walter's flat
The numbers in this example are simplified for teaching. Real cases use published development data for the identified species, at the right temperatures.
Step 1: identify the oldest stage and the species. Dr. Iversen identified the larvae as a common green blow fly and found the oldest were in the second larval stage. He reared some of the live larvae to adulthood to confirm the species.
Step 2: look up how much heat that stage needs. Suppose the published data for this species say it reaches the second larval stage after about 500 ADH above a base temperature of 10 degrees Celsius.
Step 3: reconstruct the temperature. The logger in the flat, compared with the thermostat setting and the local weather station, showed the room held close to 22 degrees Celsius over the weekend. Each hour therefore contributed 22 - 10 = 12 degree hours.
Step 4: divide. 500 ADH / 12 degree hours per hour = about 42 hours.
Step 5: count back. The oldest larvae were collected at about 10:30 a.m. on Monday. Forty-two hours earlier is about 4:30 p.m. on Saturday. So eggs were laid no later than about Saturday afternoon, and Walter died before that. This is a minimum: if the flies took time to find their way through the window, he died earlier still.
Change one input. Suppose the thermostat had been set to 16 degrees. Each hour would then contribute only 6 degree hours, and the same larvae would have needed about 500 / 6 = 83 hours, pushing the minimum back to Thursday night, before Walter was seen alive on Friday. That contradiction would tell the entomologist that something in the inputs was wrong: the temperature reconstruction, the species, or the development data. Two independent lines of evidence that cannot both be true are a signal to recheck, not to choose the convenient one.
What matters here: The oldest insects give a minimum time since death, read in accumulated heat, not in hours. A small error in temperature makes a large error in time.
Combining with Lesson 14
Put the insect evidence beside the rest. Walter was alive at 9:40 p.m. on Friday. He did not take in Saturday's newspaper or answer his daughter's call at 10:15 a.m. on Saturday. The insects say he died before about Saturday afternoon. Together these point to a death between Friday night and Saturday midday, which is the window Dr. Hartigan certified. The Sunday-night burglary came at least a day and a half later.
Where the clock can go wrong
Forensic entomology is a real science with real limits, and its practitioners are the first to list them.
- Development data disagree. The 2004 Nebraska paper notes discrepancies in the published ADH figures and thresholds for blow flies, arising from differences in experimental design, and warns that such discrepancies could exaggerate an estimate and "cost an innocent person their freedom or help free a guilty person."
- Individuals vary. Roe and Higley found that the timing of each stage transition is spread out in a bell-shaped (normal) distribution, with the greatest variation in the later larval stages. Their results challenge the habit of collecting only the largest maggots to judge the stage of a population.
- Temperature must be reconstructed. Nobody measures the temperature at a scene before it is discovered. Entomologists rebuild it from weather stations and loggers placed afterward, and any error carries straight into the estimate.
- Maggots make their own heat. The National Library of Medicine exhibit notes that masses of third-stage maggots can raise the temperature around them by more than 10 degrees Celsius, so later stages develop faster than the air temperature predicts.
- Access can be delayed. Indoors, behind closed windows, in winter or when remains are wrapped or buried, flies may arrive late or not at all, which is why the estimate is a minimum.
Over longer periods, entomologists also use the order in which different insect species arrive and leave, called succession, which the Amendt review lists as the second main method. And the same evidence has other uses. Some flies infest living people and animals, so larvae can show how long a person or pet was neglected, and larvae can even be tested for drugs.
Common misconceptions
- "Insects tell you the time of death." They tell you the minimum time since insects colonised the remains. Death may have come earlier, especially when flies had no quick access.
- "Bigger maggots are always older." Size depends on temperature and food as well as age, and stage transitions vary between individuals. Stage is judged from structures such as the breathing slits at the rear, with the variation taken into account.
- "Development time is a fixed number of hours." Development depends on accumulated heat above a threshold, so the same stage takes far longer in a cool room than a warm one.
- "Insect evidence is only useful for murders." It is used in natural and accidental deaths like Walter's, and in cases of neglect of living people and animals.
Pulling it together
- Forensic entomology's main use is the minimum time since death, from the age of the oldest insects or from the succession of species.
- Blow flies arrive early; their eggs hatch into three larval stages, then pupae and adults.
- Development depends on temperature: ADH = the sum over each hour of (temperature - base temperature).
- Walter's example: about 500 ADH at 12 degree hours per hour is about 42 hours, so eggs were laid no later than Saturday afternoon. A colder room would change the answer greatly.
- Limits include conflicting development data, individual variation, reconstructed temperatures, maggot-mass heat and delayed access.
- Combined with the last sighting, text, newspaper and phone call, the insects place Walter's death between Friday night and Saturday midday.
Sources
- Amendt, J., Richards, C. S., Campobasso, C. P., Zehner, R., & Hall, M. J. R. (2011). Forensic entomology: Applications and limitations. Forensic Science, Medicine, and Pathology, 7, 379-392. Abstract. link.springer.com
- Roe, A. L., & Higley, L. G. (2023). Stage transitions in Lucilia sericata and Phormia regina (Diptera: Calliphoridae) and implications for forensic science. Insects, 14(4), 315. mdpi.com
- Huntington, T. E., Higley, L. G., & Baxendale, F. P. (2004). Temperature-dependent development of the blow fly Calliphora vicina and the effects on the estimation of the postmortem interval [Abstract G67]. Proceedings of the American Academy of Forensic Sciences. aafs.org
- National Library of Medicine. (n.d.). Life cycle of the black blow fly. In Visible proofs: Forensic views of the body [Exhibition]. nlm.nih.gov
- National Institute of Justice. (2011). Death investigation: A guide for the scene investigator (NCJ 234457). U.S. Department of Justice. ojp.gov
- Key terms
- forensic entomology
- The science of collecting and analysing insect evidence to aid forensic investigations.
- minimum postmortem interval
- The least time that can have passed since death, given the age of the oldest insects that developed on the remains.
- blow fly
- A fly of the family Calliphoridae, among the first insects to colonise remains.
- larval stage (instar)
- One of the three feeding stages of a maggot, separated by moults.
- base temperature
- The temperature below which an insect's development stops.
- accumulated degree hours (ADH)
- The sum, over each hour, of the temperature above the base temperature; a measure of the heat available for development.
- succession
- The predictable order in which different insect species arrive at and leave remains over time.
- myiasis
- Infestation of living people or animals by fly larvae, which can show how long neglect has lasted.
What Bones Reveal
- Apply the three opening questions of forensic anthropology: is it bone, is it human, and is it of medicolegal significance?
- Describe how sex, age and stature are estimated from a skeleton, and why each is reported as a range or interval.
- Follow the identification of Richard III's remains and explain how its likelihood ratios combined skeletal, dating and DNA evidence.
Thursday, in the woods above the lake
On the Thursday after the Wrenfield burglary, a line of volunteers and officers searching the woodland above the lakeshore found what they were looking for: the store's empty cash box and Walter Penhallow's laptop, dumped in a hollow 400 metres from Dock Street. Twenty metres further on, a volunteer called out. In the leaf litter lay a scatter of weathered bones, some long, some flat, a few with teeth still in a jaw.
The officers did what the training says. They stopped, taped off the area, photographed everything in place, and called the medical examiner's office, which called a forensic anthropologist from the state university. Most people's minds jump straight to a missing person. A forensic anthropologist starts with three duller questions, and the answers usually end the matter quickly. This lesson follows those questions in the woods above Wrenfield, then follows a far more famous set of bones through every question an anthropologist can ask, to a conclusion backed by numbers.
The first three questions
The standard that sets out this opening work, ANSI/ASB Standard 150 (2021), drafted by the Organization of Scientific Area Committees' anthropology subcommittee, calls determining medicolegal significance "an important first step in analyzing remains." It breaks that step into three questions, each with defined possible answers.
| Question | How it is answered | Possible conclusions |
|---|---|---|
| 1. Is it skeletal material at all? | Gross form, and microscopic or elemental analysis if needed (stones, roots and plastic can look like bone) | Skeletal; consistent with skeletal; not skeletal; inconclusive |
| 2. Is it human? | Gross anatomy, microscopic structure (histology) or biochemical tests | Human; consistent with human; nonhuman; inconclusive |
| 3. Is it of medicolegal significance, meaning human remains of recent origin? | Signs such as recent dental work or surgery, the context (coffin hardware points to an old burial) and how the remains have weathered | Medicolegally significant; cannot exclude; not medicolegally significant; inconclusive |
Notice the familiar shape. Like fingerprints and fibres, each question has an inconclusive option, and the standard requires reports to include enough documentation for someone else to evaluate the conclusion independently.
In Wrenfield, the answers came within the hour. The material was bone. Compared with the anthropologist's reference collection, the shapes and proportions of the long bones, the shoulder blade and the jaw with its grinding teeth matched a white-tailed deer and nothing human. Conclusion: nonhuman. Question 3 never arose. The standard adds a sensible note: nonhuman remains can still have legal significance, for example if an animal was poached, so the anthropologist passed a note to the state wildlife agency. Then everyone went back to the burglary.
Bottom line: The first questions are whether it is bone, whether it is human, and whether it is recent enough to matter to a death investigation. Many finds end at question 2.
Building a biological profile
When remains are human and recent, the anthropologist builds a biological profile: an estimate of sex, age at death, stature and population affinity that narrows the list of missing people who might match. The AAFS Standards Board has published a standard for each part, and they share one theme: report ranges and intervals, and say how they were reached.
Sex. ANSI/ASB Standard 090 notes that "in most cases, the pelvis is more sexually dimorphic than other regions of the skeleton," because it is shaped by childbirth. The skull and measurements of other bones also help, and statistical methods that combine several measurements are usually more accurate than single ones. The standard also requires that sex estimation "be made independently of suspected or presumptive identification to minimize bias." In other words, the anthropologist should not be told whose skeleton the police think it is, the same protection you met with fingerprints in Lesson 5.
Age. Under ANSI/ASB Standard 133, age estimates for children rely on how far the teeth and bones have developed; for adolescents and young adults, on dental development and on the union of the growth plates at the ends of long bones, which fuse in a known sequence; and for adults, on maturation and the degenerative changes of later life. The standard requires age to be "reported as an interval," and notes that methods for younger people give narrower intervals than those for older people, because variation from life history grows with age.
Stature. ANSI/ASB Standard 045 describes two methods. The anatomical method adds up the heights of all the bones that contribute to stature plus a correction for soft tissue. The regression method uses an equation relating stature to the length of a long bone such as the femur, which differs by population and sex. The standard is firm that a 90 percent (or wider) prediction interval should be reported: "Reporting only a point estimate is unacceptable."
A worked example shows why. The numbers below illustrate the form such equations take; real casework uses a published, validated equation for the right population.
- Suppose an equation reads: stature (cm) = 2.4 x femur length (cm) + 61, with a 90 percent prediction interval of plus or minus 5 cm.
- A femur measures 45.0 cm. 2.4 x 45.0 = 108.0, and 108.0 + 61 = 169.0 cm.
- The report gives the interval: about 164 to 174 cm. A missing person listed at 172 cm is consistent; one listed at 185 cm is unlikely, although the standard warns that a stature discrepancy alone should not exclude a match, partly because recorded heights of missing people are often self-reported.
Population affinity. Anthropologists sometimes estimate which reference populations a skeleton most resembles. ANSI/ASB Standard 132 (2023) uses the term population affinity instead of ancestry, explains that ancestry is "oftentimes conflated with race," and states plainly: "This document does not endorse races as valid biological categories." Results should be expressed cautiously, with phrases such as "consistent with," and never used alone to exclude a match.
Injuries and their timing. ANSI/ASB Standard 147 classifies skeletal damage by when it happened. Antemortem trauma occurred before death and shows healing. Perimortem trauma occurred around the time of death, while bone was still fresh, with no healing. Postmortem damage happened after bone had lost its fresh properties, from weathering, animals or digging. Telling them apart is what separates an old healed fracture or a shovel mark from an injury at death.
Bottom line: Every part of a biological profile is an estimate with an interval, produced without knowing whom investigators hope it is, and documented so another expert can check it.
A 527-year-old missing person case
On 22 August 1485, King Richard III of England was killed at the Battle of Bosworth. The last-known resting place recorded for him was the Grey Friars friary in Leicester. In 2012, a skeleton was excavated at the presumed site of the friary. In 2014, a team of researchers, with Turi King as first author, published the case for its identity in Nature Communications, treating it, in their words, as "a 500-year-plus missing person case."
Here is how each line of evidence fitted, as the paper reports it.
| Evidence | Finding |
|---|---|
| Sex and age | Male, aged 30 to 34 at death |
| Skeleton | Severe scoliosis (a sideways curve of the spine) that would have set one shoulder higher than the other |
| Injuries | Numerous perimortem injuries consistent with death in battle |
| Radiocarbon dating | Death between 1456 and 1530 AD at 95.4 percent probability |
| Mitochondrial DNA | A perfect match to Michael Ibsen and a single-letter difference from Wendy Duldig, both descended through an unbroken female line from Richard's eldest sister, Anne of York |
| Y-chromosome DNA | No match to five living male-line relatives descended from the 5th Duke of Beaufort |
| DNA-predicted hair and eye colour | Consistent with an early portrait of Richard |
The Y-chromosome mismatch looks like a problem, and the team treated it honestly. A Y chromosome passes from father to son, so a mismatch means that somewhere in the many generations between Richard's family and the living Beaufort descendants, a recorded father was not the biological father: a false-paternity event. The paper notes this could have happened anywhere in the line and need not involve Richard himself. Lineage markers reveal family history, as Lesson 12 warned.
Putting numbers on it. This is where Lesson 3 pays off. The team calculated likelihood ratios. Using deliberately conservative assumptions, the genetic evidence alone gave an LR of 79. The non-genetic evidence (the site, the age and sex, the scoliosis, the injuries, the radiocarbon date) gave an LR of 85,000. Combined, the LR was 6.7 million. They then showed what happens with different starting assumptions. Starting from a deliberately sceptical prior probability of 0.025 that the skeleton was Richard's, the genetic evidence alone raised it to only about two in three. But with all the evidence combined, the probability that the skeleton is Richard III's came out between 0.999994 and 0.9999999 depending on the prior. Check the first number yourself: prior odds of 0.025 to 0.975 times 79 gives odds of about 2 to 1, which is a probability of about two thirds.
The identification is a model for how forensic anthropology should work: several independent lines of evidence, each estimated with its uncertainty, combined openly, with the inconvenient result reported and explained rather than hidden.
Common misconceptions
- "Bones found in the woods are probably a missing person." Many finds are animal bones, and some human remains are old burials with no medicolegal significance. Those are the first questions an anthropologist answers.
- "A skeleton gives an exact age and height." The standards require intervals: age ranges and stature prediction intervals of 90 percent or more. A single number alone is not acceptable.
- "Skeletons reveal a person's race." The current standard uses population affinity, says ancestry is often conflated with race, and does not endorse races as valid biological categories.
- "A DNA mismatch means the identification is wrong." In Richard III's case, the Y-chromosome mismatch was explained by a false-paternity event in an intervening generation, while the maternal-line DNA and the other evidence pointed strongly the other way.
Looking back
- Forensic anthropology begins with three questions: skeletal or not, human or not, medicolegally significant or not. The Wrenfield bones were a white-tailed deer.
- The pelvis is usually the most informative part of the skeleton for sex; sex estimates are made without knowing the presumed identity.
- Age comes from development in the young and degeneration in adults, reported as an interval that widens with age.
- Stature comes from the anatomical or regression method and must be reported with a 90 percent or wider prediction interval.
- Population affinity is estimated cautiously and races are not treated as biological categories; trauma is classed as antemortem, perimortem or postmortem.
- Richard III's identification combined skeletal, dating and DNA evidence into a likelihood ratio of 6.7 million, despite a Y-chromosome mismatch explained by false paternity.
Sources
- King, T. E., Fortes, G. G., Balaresque, P., Thomas, M. G., Balding, D., Delser, P. M., Neumann, R., Parson, W., Knapp, M., Walsh, S., Tonasso, L., Holt, J., Kayser, M., Appleby, J., Forster, P., Ekserdjian, D., Hofreiter, M., & Schurer, K. (2014). Identification of the remains of King Richard III. Nature Communications, 5, 5631. nature.com
- AAFS Standards Board. (2021). ANSI/ASB Standard 150: Standard for determination of medicolegal significance from skeletal remains in forensic anthropology (1st ed.). aafs.org
- AAFS Standards Board. (2019). ANSI/ASB Standard 045: Standard for stature estimation in forensic anthropology (1st ed.). aafs.org
- AAFS Standards Board. (2019). ANSI/ASB Standard 090: Standard for sex estimation in forensic anthropology (1st ed.). aafs.org
- AAFS Standards Board. (2024). ANSI/ASB Standard 133: Standard for age estimation in forensic anthropology (1st ed.). aafs.org
- AAFS Standards Board. (2023). ANSI/ASB Standard 132: Standard for population affinity estimation in forensic anthropology (1st ed.). aafs.org
- AAFS Standards Board. (2024). ANSI/ASB Standard 147: Standard for analyzing skeletal trauma in forensic anthropology (1st ed.). Definitions of antemortem, perimortem and postmortem. aafs.org
- Key terms
- medicolegal significance
- Relevance to a death investigation; for bones, usually human remains of recent origin.
- biological profile
- An anthropologist's estimates of sex, age at death, stature and population affinity from a skeleton.
- epiphyseal union
- The fusion of the growth plates at the ends of long bones, used to estimate the age of adolescents and young adults.
- prediction interval
- The range within which a value such as stature is expected to fall with a stated probability, required in place of a single estimate.
- population affinity
- An estimate of which reference populations a skeleton most resembles; the current standard does not treat races as biological categories.
- perimortem trauma
- Skeletal injury that occurred around the time of death, while bone was fresh, with no healing.
- false-paternity event
- A break in a recorded father-to-son line, revealed when Y-chromosome markers do not match.
Module 6: Marks and Machines
Two kinds of evidence left by tools: the marks a pry bar or a gun leaves on softer metal, and the records a camera or phone leaves in its memory. Tool marks show how a long-trusted discipline answered its critics; digital evidence shows how preservation, hash values and honest clocks keep data trustworthy.
Tool Marks and Firearms: Striations, Impressions and Judgement
- Distinguish impressed from striated tool marks and class from individual characteristics, and describe how a comparison microscope is used.
- Set out the dispute over firearms and tool mark identification: the AFTE standard of sufficient agreement, PCAST's 2016 finding, and the black-box studies and court rulings since.
- Explain the limits the Department of Justice now places on examiners' testimony, and what objective methods are being developed.
Two dents in an aluminium lip
The steel cash drawer from the Wrenfield store has a soft aluminium lip along its front edge, and the intruder forced it with a tool. Under magnification the lip shows two impressed marks where a flat blade bit into the metal, each 19 millimetres wide. On one side of each mark is a small step, as though the blade's corner was chipped. Eleven days later, a warrant search of Corey Vance's truck turned up a flat steel pry bar with a 19 mm blade and a chip missing from one corner.
Did that bar make those marks? Tool mark examiners have answered questions like this in court for a century. Firearms examination is the same discipline, applied to the marks a gun leaves on bullets and cartridge cases. It is also the discipline where the argument between practitioners and scientific reviewers has been loudest and longest. This lesson explains the method, then sets out both sides of the dispute and what has happened since.
How tool marks are made and compared
A tool leaves two kinds of mark. An impressed mark forms when a tool is pressed into a softer surface, like the blade pushed into the aluminium lip. A striated mark forms when a tool slides across a surface, scraping a pattern of fine parallel lines called striae. Firearms produce both. Rifling in the barrel, the spiral grooves that spin the bullet, scrapes striations along a bullet. The parts that strike and hold the cartridge case press impressions into it.
The comparison follows the same logic you met with fibres and glass. As PCAST describes it, the examination "begins with an evaluation of class characteristics." These are features fixed by design before manufacture, such as blade width or the number and twist of rifling grooves. If class characteristics differ, the result is an elimination. If they agree, the examiner compares individual characteristics: the fine marks produced by random imperfections in manufacture and by wear. The examiner makes test marks with the suspect tool in a soft material, or test-fires the suspect gun. Then the questioned and test marks are viewed side by side under a comparison microscope, which shows both in one field of view. AFTE calls this side-by-side microscopic comparison the "most widely accepted method" of tool mark examination.
In Wrenfield, class characteristics agreed: blade width, bevel and profile. Test impressions made with the bar in soft metal showed the same step from the chipped corner. Fine marks from the blade's worn edge lined up across the split field. The examiner reported that the marks were made by the bar. What that conclusion rests on is the subject of the rest of this lesson.
Position 1: the discipline's case
The Association of Firearm and Tool Mark Examiners (AFTE) sets out a "Theory of Identification." As PCAST summarises it, an examiner may conclude two items share a common origin when their marks are in "sufficient agreement." That is defined as the examiner being convinced that a different origin is extremely unlikely, and the theory openly states that conclusions are subjective. Practitioners point to decades of casework, and to training and proficiency testing. They also point to many studies in which examiners compared marks from consecutively manufactured tools and guns, and made few errors. That is the hardest test, because such tools are as alike as tools can be.
The Department of Justice took this side firmly. In a statement published in January 2021, it said the PCAST report "contained several fundamentally incorrect claims." Among them, it said, was the claim that error rates for pattern comparison "can only be established through 'appropriately designed' black box studies." An appendix listed eighteen firearms error-rate studies published between 1998 and 2020. The statement argued that "no single error rate is generally applicable to all laboratories, all examiners, and all cases." It agreed with PCAST on one point: "all laboratory test and feature comparison analyses have non-zero error rates."
Position 2: the reviewers' case
The 2009 National Academy of Sciences report noted that not enough is known about how marks vary among tools and guns. So, it concluded, "we are not able to specify how many points of similarity are necessary for a given level of confidence in the result." It added that "sufficient studies have not been done to understand the reliability and repeatability of the methods."
PCAST went further in 2016. It called AFTE's theory "circular," since "sufficient agreement" is defined by the examiner's own conviction. It found that many earlier studies had been designed in ways that underestimated false positive rates. Only one study met its criteria: a study conducted at the Department of Energy's Ames Laboratory and published as a report in 2014. That study estimated a false positive rate of 1 in 66, with an upper bound of 1 in 46. With a single study, PCAST concluded, firearms analysis "currently falls short of the criteria for foundational validity." Whether it should be admitted in court, PCAST said, "is a decision that belongs to the courts."
Why this matters: The dispute is not about whether examiners are careful. It is about what kind of evidence is needed to show how often a subjective judgement of "sufficient agreement" is wrong, and whether a single number can describe it.
What happened next: more studies, and the inconclusive problem
The Ames Laboratory ran a second, larger study, completed in 2020 and designed in direct response to PCAST. The Supreme Court of Maryland described both studies in detail in its 2023 decision in Abruquah v. State.
| Study | Design | False positives | Inconclusive answers |
|---|---|---|---|
| Ames I (2014) | 218 examiners, cartridge cases from 25 same-model handguns | 22 of 2,180 non-matching comparisons (1.01 percent); 20 of the 22 came from 5 examiners | 33.7 percent of non-matching sets |
| Ames II (2020) | 173 examiners, bullets and cartridge cases, three phases testing accuracy, repeatability and reproducibility | 0.7 percent for bullets and 0.92 percent for cartridge cases | 20.5 percent of matching and 65.3 percent of non-matching bullet sets |
The false positive rates look low, and the Department of Justice and prosecutors relied on them. But the court focused on two other numbers. First, inconclusives: on non-matching bullets, examiners declined to decide nearly two times in three. Supporters say an inconclusive is the honest answer when marks are poor. Critics reply that in a test where every sample has a known answer, a high inconclusive rate on non-matches can hide errors that would become identifications in real casework. Second, consistency. When examiners were given the same matching bullet sets again without being told, they gave the same answer only 79 percent of the time; for non-matching bullet sets, 64.7 percent of the time.
The court's ruling, filed on 20 June 2023, steered between the positions. It found that the methodology "can support reliable conclusions that patterns and markings on bullets are consistent or inconsistent with those on bullets fired from a particular known firearm." But it held that the examiner "should not have been permitted to offer an unqualified opinion" that the crime scene bullets were fired from the defendant's gun.
New rules for what examiners may say
The Department of Justice also changed how its own examiners testify. Its Uniform Language for Testimony and Reports for firearms and tool mark pattern examination, effective 15 August 2020, allows three conclusions: source identification, source exclusion and inconclusive. It defines an identification as the examiner's opinion that the probability of a different source "is so small that it is negligible," and it lists what examiners must not say. They may not claim uniqueness, use the word "individualization," or say a mark came from a source "to the exclusion of all other sources." They may not claim the discipline is "infallible or [has] a zero error rate," or cite the number of cases they have worked as a measure of accuracy. Nor may they claim "100% certainty" or a "reasonable degree of scientific certainty." Notice the contrast with older public language: the ATF's page on its National Integrated Ballistic Information Network still describes the marks on cartridge cases as a "fingerprint." In court, Department examiners may no longer talk that way.
That network, NIBIN, illustrates where automation helps. ATF reports that its imaging system has generated more than a million leads by linking cartridge cases from different scenes, results produced "in just hours or days." Those are leads for examiners and investigators to follow up, not identifications. Further ahead, the National Institute of Standards and Technology maintains an open research database of three-dimensional surface scans of bullets and cartridge cases. It was built to support "objective firearm identification" with "quantitative confidence limits," so that computer algorithms can one day report the strength of a match as a measured number rather than a judgement.
Back to the pry bar
Apply all of this to Wrenfield. The class characteristics agree. The chipped corner is a distinctive feature that a blade from the same factory would not share unless it had been damaged in the same way. That is meaningful evidence. But the report should use the 2020 language, avoid any claim of uniqueness or certainty, and disclose what is known about error rates. That last step is harder than it sounds, because the large black-box studies concern firearms. Whether their rates apply to a pry bar on aluminium is itself an open question of validity as applied. The court in Maryland would likely have allowed the examiner to say the marks are consistent with the bar. It would not have allowed an unqualified claim that only this bar could have made them.
Common misconceptions
- "Every tool and gun leaves a unique mark, so a match is certain." Uniqueness has not been demonstrated, and the Department of Justice now forbids its examiners to claim it. What matters is how often examiners wrongly declare matches, which is measured in black-box studies.
- "Low false positive rates settle the question." In the Ames studies, many non-matching comparisons were called inconclusive, and examiners often did not repeat their own answers. How to count inconclusives is a live dispute.
- "Automated systems like NIBIN identify guns." NIBIN generates leads by comparing images; examiners and investigators then follow them up.
- "Courts have thrown out firearms evidence." Courts have mostly limited how strongly it may be stated. Maryland's highest court allowed testimony that marks are consistent or inconsistent with a gun, but not an unqualified identification.
Summing up
- Impressed marks come from pressure and striated marks from sliding; comparison moves from class to individual characteristics, using test marks and a comparison microscope.
- AFTE's standard of "sufficient agreement" is subjective by its own account; PCAST called it circular and in 2016 found only one appropriately designed study (false positives 1 in 66, upper bound 1 in 46).
- The Department of Justice rejected PCAST's criteria in 2021, while agreeing that all such methods have non-zero error rates.
- Ames I and Ames II found false positive rates around 1 percent but high inconclusive rates and imperfect repeatability; in 2023 Maryland's Supreme Court barred unqualified identification testimony.
- Department of Justice examiners may report identification, exclusion or inconclusive, but may not claim uniqueness, certainty or a zero error rate.
- NIBIN produces investigative leads; NIST's open 3D database supports objective, measured comparison methods.
Sources
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Section 5.5 and Finding 6. obamawhitehouse.archives.gov
- U.S. Department of Justice. (2021, January). United States Department of Justice statement on the PCAST report: Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. justice.gov
- Abruquah v. State, No. 10, September Term, 2022 (Supreme Court of Maryland, filed June 20, 2023). mdcourts.gov
- U.S. Department of Justice. (2020). Uniform language for testimony and reports for the forensic firearms/toolmarks discipline: Pattern examination (effective August 15, 2020). Index page of current ULTR documents. justice.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Toolmark and firearms identification, pp. 150-155. ojp.gov
- Bureau of Alcohol, Tobacco, Firearms and Explosives. (2026). National Integrated Ballistic Information Network (NIBIN). atf.gov
- Zheng, X. A. (2019). NIST Ballistics Toolmark Research Database (Version 1.0). National Institute of Standards and Technology. tsapps.nist.gov
- Key terms
- impressed mark
- A tool mark made when a tool is pressed into a softer surface.
- striated mark
- A pattern of fine parallel lines made when a tool slides across a surface.
- rifling
- Spiral grooves inside a gun barrel that spin the bullet and mark its surface.
- comparison microscope
- Two microscopes joined by an optical bridge so questioned and test marks can be viewed side by side.
- sufficient agreement
- AFTE's standard for identification: the examiner is convinced a different source is extremely unlikely; it is subjective by its own account.
- inconclusive
- A conclusion that the marks neither support identification nor exclusion; how to count it in error-rate studies is disputed.
- NIBIN
- ATF's National Integrated Ballistic Information Network, which links cartridge case images from different scenes as investigative leads.
- ULTR
- The Department of Justice's Uniform Language for Testimony and Reports, which limits what its examiners may claim.
Digital Evidence: Files, Hashes, Clocks and Location
- Explain the principles for handling digital evidence: do not change it, use trained examiners, document everything, and work under legal authority.
- Use a cryptographic hash to verify that a copy of a file is identical to the original, on your own files.
- Correct a timeline for a device clock's offset, and explain what cell-site records can and cannot show and why Carpenter v. United States requires a warrant.
23:40 on the screen, 22:53 in the world
The alley behind Corran Hardware and Marine is watched by a single camera that records onto a small digital video recorder in the store's office. On Monday morning Detective Reyes watched the recording on the recorder's screen: a hooded figure walks up the alley, stops at the back door, and the glass breaks. The timestamp burned into the corner of the picture read 23:40 on Sunday. That number went into the first draft of the timeline. It was wrong by 47 minutes, and this lesson shows how a digital examiner found that out and why it mattered.
A rule before anything else: in this lesson you work only on your own files and your own devices. Investigators examine other people's devices only with legal authority, such as a warrant or the owner's consent, and so should you. Nothing here involves getting into anyone else's data.
Step 1: the principles
The National Institute of Justice's guide for first responders to electronic crime scenes, published in its second edition in 2008, sets out three principles.
- "The process of collecting, securing, and transporting digital evidence should not change the evidence."
- "Digital evidence should be examined only by those trained specifically for that purpose."
- "Everything done during the seizure, transportation, and storage of digital evidence should be fully documented, preserved, and available for review."
The guide adds a warning that applies to everyone: improperly accessing data on electronic devices may violate federal laws, and officers may need additional legal authority before they look. Digital evidence is handled under the same rules of chain of custody you met in Lesson 2, plus rules of its own.
Step 2: copy without changing, then prove the copy is exact
Opening files on a computer can change them, and NIST's 2006 guide notes that background processes on a running system "might be writing to a system's hard drive, even if no person is currently using the computer." So examiners do not work on the original. NIST's 2022 scientific foundation review of digital investigation, by James Lyle and colleagues, sets out the first three tasks: protect the original data "from unintended modification," acquire the data by copying it to an image file, and "ensure integrity of acquired data" with cryptographic hashing. When a drive is copied, a write-blocker, which NIST's earlier guide describes as a tool that "prevents a computer from writing to computer storage media connected to it," sits between the drive and the examiner's computer.
The key tool is the hash value. A cryptographic hash function reads every bit of a file and produces a short fixed-length string of characters, a kind of digital fingerprint of the content. Microsoft's documentation for the Windows PowerShell command Get-FileHash states the two properties that matter: "changing even a single character in the contents of a file changes the hash value," while renaming a file does not change its hash, because the hash depends only on the content. NIST's 2006 guide to forensic techniques adds that a change of "a single bit in the data will cause a completely different message digest."
So the procedure is simple. Compute the hash of the original, make the copy, compute the hash of the copy, and compare. If the two strings are identical, the copy is identical. Compute the hash again before court, and anyone can check that nothing has changed since.
In Wrenfield, the digital examiner exported the alley footage from the recorder in its original format, computed a SHA-256 hash value on the spot, and wrote it in her notes. At the lab, she computed it again from the stored copy: the same 64 characters. Older algorithms such as MD5 and SHA-1 are still found in older cases, but Microsoft's documentation notes they are "no longer considered secure" and should be used only for simple change checks.
In short: Work on verified copies, not originals. A matching hash value shows a copy is bit-for-bit identical; changing a single character would change the hash completely.
Step 3: check the clock
A timestamp is only as good as the clock that made it. NIST's guide warns analysts that "file times may not always be accurate," and the first reason it lists is that "the computer's clock does not have the correct time," for example because it was never synchronised with an authoritative time source. Many devices synchronise automatically over the internet using the Network Time Protocol. A small video recorder in a hardware store office, set up years ago and never connected, may simply drift.
The examiner tested it. At 9:15 a.m. on Monday, by her phone, which synchronises automatically with the network, she photographed the recorder's screen showing its own clock: 10:02. The recorder was 47 minutes fast. A week later she checked again and found it 48 minutes fast, so the clock drifts by about a minute a week. Over one weekend the offset could not have changed by more than a minute.
| Event | Recorder timestamp | Corrected time (subtract 47 minutes) |
|---|---|---|
| Hooded figure enters the alley | 23:36 | 22:49 |
| Glass breaks | 23:40 | 22:53 |
| Figure leaves the alley | 23:51 | 23:04 |
In short: Every device timestamp needs a clock check against a trusted reference, documented with a photograph, and every time in the timeline needs the same correction.
Step 4: location records and the law
Investigators also obtained, with a warrant, the records of Corey Vance's mobile phone. Why a warrant? In Carpenter v. United States, decided on 22 June 2018, the Supreme Court explained that each time a phone connects to a cell site it "generates a time-stamped record known as cell-site location information (CSLI)," and it held that the government's acquisition of such records was a search under the Fourth Amendment. The government "will generally need a warrant to access CSLI," the Court said, with exceptions for emergencies.
The Court also described the limits of the data. Cell sites divide the area they cover into sectors, and the precision of a record "depends on the size of the geographic area covered by the cell site." In Carpenter's own case, the government's brief, as the Court quoted it, said the records placed him within a wedge-shaped sector ranging from one-eighth to four square miles, although the Court noted that precision is improving as cell sites multiply.
Vance's records showed his phone using the sector that covers Dock Street from 22:41 to 23:07 on Sunday night. Line that up with the corrected camera times, 22:49 to 23:04, and the windows overlap. But Vance said he spent the evening at a friend's house 300 metres from the store, and that house lies inside the same sector. So the phone records are consistent with his being in the alley, and equally consistent with his account. They do not separate the two. Only the other evidence can.
Change one input: a slow clock
Now suppose the examiner had found the recorder 47 minutes slow instead of fast. Then 23:40 on the screen would mean 00:27 on Monday. Vance's phone left the Dock Street sector at 23:07 on Sunday, so at 00:27 it was elsewhere. The same footage and the same phone records would then point away from him. A single sign, plus or minus, flips the meaning of the evidence, which is why the clock check is photographed, documented and repeated.
What digital evidence can claim
NIST's 2022 review concluded that "digital evidence examination rests on a firm foundation based in computer science," and reported that extensive testing of over 250 widely used digital forensic tools found that most perform their intended functions "with only minor anomalies." It also noted that computers store far more than users see, "storing time and location data on photos," for example, and that digital errors tend to be systematic rather than random, so the right question is not "what is the error rate?" but "what could make this tool or this clock wrong, and has that been checked?" A camera that is reliably 47 minutes fast is not unreliable evidence. It is evidence with a known correction.
Common misconceptions
- "A timestamp on a recording is the true time." Device clocks drift or are set wrongly. Every timestamp needs checking against a trusted reference before it goes into a timeline.
- "Opening a file to look at it changes nothing." Accessing files can alter them and the system's records. Examiners work on hash-verified copies, using write-blockers when they copy drives.
- "Renaming a file changes its hash." The hash depends only on content; renaming changes nothing, while changing one character changes the hash completely.
- "Phone records show exactly where a person was." Cell-site records place a phone within a sector whose size varies; in Carpenter they spanned one-eighth to four square miles. And a phone's location is not proof of who was carrying it.
What to remember
- Digital evidence should not be changed by collection, should be examined by trained people, and should be fully documented; access needs legal authority.
- Examiners copy data with write-blockers and verify copies with cryptographic hashes; a single changed character changes the hash completely.
- Device clocks must be checked against trusted time. The Wrenfield recorder was 47 minutes fast, so 23:40 on screen was 22:53.
- Since Carpenter v. United States (2018), the government generally needs a warrant for cell-site location records, which place a phone only within a sector.
- Vance's phone records fit both his account and the prosecution's; a reversed clock offset would have pointed away from him.
- NIST finds digital forensics well founded in computer science, with errors that are mostly systematic and must be checked case by case.
Sources
- National Institute of Justice. (2008). Electronic crime scene investigation: A guide for first responders (2nd ed., NCJ 219941). U.S. Department of Justice. Principles for digital evidence. ojp.gov
- Lyle, J. R., Guttman, B., Butler, J. M., Sauerwein, K., Reed, C., & Lloyd, C. E. (2022). Digital investigation techniques: A NIST scientific foundation review (NIST IR 8354). National Institute of Standards and Technology. Executive summary and key takeaways. nvlpubs.nist.gov
- Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. Sections on write-blockers, message digests and file times. nvlpubs.nist.gov
- Microsoft. (n.d.). Get-FileHash (PowerShell 7.6 documentation). Microsoft Learn. learn.microsoft.com
- Carpenter v. United States, 585 U.S. ___ (2018), No. 16-402, decided June 22, 2018. Slip opinion. supremecourt.gov
- Perl documentation. (n.d.). shasum: Print or check SHA checksums. perldoc.perl.org
- Key terms
- digital evidence
- Information stored or transmitted in digital form that may be used in an investigation or court.
- forensic image
- An exact bit-for-bit copy of digital storage, made so examiners can work without touching the original.
- write-blocker
- A hardware or software tool that prevents a computer from writing to storage media connected to it.
- hash value
- A fixed-length string computed from a file's content; changing a single character changes it completely, but renaming does not.
- SHA-256
- A widely used cryptographic hash algorithm; the default for Windows PowerShell's Get-FileHash.
- clock offset
- The difference between a device's clock and the true time, measured against a trusted reference and applied to every timestamp.
- cell-site location information (CSLI)
- Time-stamped records generated when a phone connects to a cell site, placing it within a sector.
- metadata
- Data about data, such as the time, device and location stored inside a photo file.
Module 7: Science on Trial
The national reviews that asked which forensic methods had ever been properly tested: the 2009 National Academy of Sciences report, the 2016 PCAST report and the arguments that followed, and what exonerations revealed about how forensic science goes wrong and how laboratories now guard against it.
The 2009 National Academy of Sciences Report
- Explain how and why Congress commissioned the 2009 report, and state its central finding about individualization.
- Summarise the report's assessment of each major forensic discipline, from DNA and drug chemistry to bite marks and bloodstain patterns.
- Describe the report's main recommendations and which were and were not carried out.
A sentence in an appropriations act
On 22 November 2005, a spending law with a long name became law: the Science, State, Justice, Commerce, and Related Agencies Appropriations Act of 2006. Buried in it, by way of a Senate committee report, was a short instruction. The committee observed that while "a great deal of analysis exists of the requirements in the discipline of DNA, there exists little to no analysis of the remaining needs of the community outside of the area of DNA." It directed the Attorney General to fund the National Academy of Sciences to create "an independent Forensic Science Committee."
That committee, co-chaired by Harry T. Edwards, a federal appeals court judge, and Constantine Gatsonis, a statistician at Brown University, heard from laboratory directors, medical examiners, practitioners in many disciplines, scholars, lawyers and police. Its report, Strengthening Forensic Science in the United States: A Path Forward, was published by the National Research Council in 2009. Almost every lesson in this course has quoted it. This lesson tells its story directly: what the committee found, what it asked for, and what happened.
What surprised the committee
The co-chairs wrote in their preface that what surprised them most was "the consistency of the message" they heard from witnesses of every background. The forensic science system, they summarised, "has serious problems that can only be addressed by a national commitment to overhaul the current structure."
The problems the report described were not mainly about bad individuals. They were structural. Forensic laboratories varied widely in capacity, oversight, staffing, certification and accreditation. Many lacked "mandatory and enforceable standards, founded on rigorous research and testing." Backlogs, even in DNA processing, had "grown dramatically." Research and training had weak ties to universities. Death investigation, through a patchwork of coroners and medical examiners, was described as "a system in need of significant improvement." And many laboratories sat inside police departments or prosecutors' offices, a structure the committee believed could compromise their independence.
The central finding
One sentence from the report's summary states its central finding. "With the exception of nuclear DNA analysis, however, no forensic method has been rigorously shown to have the capacity to consistently, and with a high degree of certainty, demonstrate a connection between evidence and a specific individual or source."
Read it carefully, because it is often misquoted. It does not say other methods are worthless. It says none had been rigorously shown to support individualization, the claim that evidence came from one specific person or object, consistently and with high certainty. The committee added that "the analytically based disciplines generally hold a notable edge over disciplines based on expert interpretation." It also found important differences among the interpretive disciplines. There were, for example, "more established protocols and available research for fingerprint analysis than for the analysis of bite marks."
The upshot: In 2009 the National Academy of Sciences found that only nuclear DNA analysis had been rigorously shown to connect evidence to a specific individual consistently and with high certainty. The other disciplines ranged from sound chemistry to methods with no scientific basis for their strongest claims.
The report, discipline by discipline
Chapter 5 of the report assessed each major discipline in turn. Its conclusions, which you have met throughout this course, are gathered here.
| Discipline | The committee's assessment, in brief | Lesson |
|---|---|---|
| DNA analysis | Scientifically sound: biological basis for individual-specific results, quantified match probabilities, validated procedures and clear standards. Still subject to handling errors. | 11-12 |
| Controlled substances | Chemical foundations "sound," with adequate understanding of uncertainties; GC-MS the near universal identification test. | 13 |
| Friction ridges (fingerprints) | A valuable tool; careful comparison can plausibly discern a common source, but "claims that these analyses have zero error rates are not scientifically plausible." ACE-V too broad to guarantee repeatability or guard against bias. | 4-5 |
| Footwear and tyre impressions | No consensus on how many individual characteristics are needed, and no data on their variability or on the method's reliability. | 3 |
| Tool marks and firearms | Class characteristics helpful, but "sufficient studies have not been done to understand the reliability and repeatability of the methods." | 17 |
| Hair | "No scientific support for the use of hair comparisons for individualization in the absence of nuclear DNA." | 6 |
| Fibres | Chemistry provides firmer footing, but a match "can provide only class evidence." | 7 |
| Bite marks | May sometimes reliably exclude, but the committee "received no evidence of an existing scientific basis for identifying an individual to the exclusion of all others." | 20 |
| Bloodstain patterns | Some aspects supported by science, but "the uncertainties associated with bloodstain pattern analysis are enormous." | 10 |
| Digital and multimedia | An emerging discipline needing standards and research. | 18 |
Look down the middle column and a pattern appears. The disciplines that rest on measurement and chemistry fared well. The disciplines that rest on an expert's judgement of whether two patterns agree fared worse. That was not because their practitioners lacked skill. It was because almost no one had measured how often that judgement was right.
Thirteen recommendations
The report made thirteen recommendations. The most important, in short form:
- Congress should create an independent federal entity, a National Institute of Forensic Science, to lead research, set standards and oversee the field.
- Standard terminology and model laboratory reports should be established for reporting and testifying.
- Research should establish the validity of forensic methods and measure their accuracy and reliability.
- Public forensic laboratories should be removed from the administrative control of law enforcement agencies and prosecutors' offices.
- Research should study human observer bias and sources of human error, including the effects of knowing case information.
- Measurement, validation and proficiency testing tools should be developed with the National Institute of Standards and Technology.
- Laboratory accreditation and individual certification of forensic professionals should be mandatory.
- Laboratories should establish routine quality assurance and quality control to identify mistakes, fraud and bias.
- A national code of ethics should be established.
- Forensic science education and graduate research should be strengthened.
- Medical examiner systems should be funded, "with the goal of replacing and eventually eliminating existing coroner systems."
- Fingerprint databases should be made interoperable nationwide.
- Forensic scientists should be prepared for evidence from events affecting homeland security.
What happened next
The keystone recommendation failed. Congress did not create a National Institute of Forensic Science. What came instead, as the 2016 PCAST report recounted, were two smaller bodies. In 2013 the Department of Justice and the National Institute of Standards and Technology created the National Commission on Forensic Science. It was a federal advisory committee of 32 members, co-chaired by the Deputy Attorney General and the Director of NIST. The Attorney General formally adopted its first recommendations, on laboratory accreditation. The Commission's charter expired on 23 April 2017 and was not renewed.
In 2014 NIST established the Organization of Scientific Area Committees for Forensic Science (OSAC), a body of more than 600 volunteer members, mostly forensic practitioners, to develop standards. Its registry of approved standards now lists 264 documents, including standards you have used in this course for soil collection, stature estimation and the medicolegal significance of bones. A standard reaches the registry only with a two-thirds vote of both the subcommittee that proposed it and OSAC's standards board.
Other recommendations moved partly. Accreditation spread: by 2020, the Bureau of Justice Statistics found about nine in ten publicly funded crime laboratories accredited by a professional organisation. Research on bias and error expanded, including the FBI's fingerprint black-box study, which was undertaken in response to the report. A few jurisdictions made their laboratories independent. PCAST noted that Houston, after disbanding its police crime laboratory twice in three years, turned it into an independent forensic science center despite political pushback. Such moves have been the exception rather than the rule, and coroners still serve in many states.
The upshot: The report changed the questions the field asks of itself. It did not get the institution it asked for, and the work it called for, testing methods and measuring their error rates, has been done unevenly and largely since.
Common misconceptions
- "The National Academy of Sciences said forensic science is junk." It praised DNA analysis and drug chemistry, called fingerprints a valuable tool, and concentrated its criticism on unsupported claims of individualization and on the lack of research measuring accuracy.
- "The report banned methods it criticised." The committee had no power to ban anything. Courts decide admissibility; the report asked for research, standards and structural reform.
- "Its recommendations were all adopted." The central recommendation, an independent National Institute of Forensic Science, was never created. Standards and accreditation advanced; laboratory independence and coroner reform largely did not.
- "Problems came from a few bad analysts." The committee described structural problems: fragmentation, lack of standards and research, under-resourcing and lack of independence.
Putting it together
- Congress commissioned the study in the appropriations act signed on 22 November 2005; Judge Harry T. Edwards and statistician Constantine Gatsonis co-chaired the committee.
- Central finding: only nuclear DNA analysis had been rigorously shown to connect evidence to a specific source consistently and with high certainty.
- Assessments ranged from sound (DNA, drug chemistry) through promising but untested (fingerprints, tool marks) to unsupported for identification (hair, bite marks), with bloodstain uncertainties called enormous.
- Thirteen recommendations included an independent National Institute of Forensic Science, research on validity and bias, mandatory accreditation and certification, laboratory independence and medical examiner systems.
- No institute was created; the National Commission on Forensic Science ran from 2013 until its charter expired in April 2017, and OSAC, founded in 2014, now lists 264 standards on its registry.
Sources
- National Research Council, Committee on Identifying the Needs of the Forensic Science Community. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Preface; Summary (introduction, findings, recommendations 1-13); Chapter 5 summary assessments. Copy hosted by the National Criminal Justice Reference Service. ojp.gov
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Sections 1 and 2 (history since 2009, NCFS, OSAC, Houston). obamawhitehouse.archives.gov
- U.S. Department of Justice. (2017). National Commission on Forensic Science [Archived website]. justice.gov
- National Institute of Standards and Technology. (2026). OSAC Registry. Accessed October 27, 2026. nist.gov
- Brooks, C. (2023). Publicly funded forensic crime laboratories, 2020 (NCJ 306473). Bureau of Justice Statistics. bjs.ojp.gov
- Key terms
- National Research Council
- The operating arm of the National Academy of Sciences that published the 2009 forensic science report.
- individualization
- The claim that evidence came from one specific person or object to the exclusion of all others.
- analytically based discipline
- A forensic discipline built on laboratory measurement and chemistry, such as DNA or drug analysis.
- National Institute of Forensic Science
- The independent federal entity the 2009 report recommended; Congress never created it.
- National Commission on Forensic Science
- A federal advisory committee created by the Department of Justice and NIST in 2013; its charter expired in April 2017.
- OSAC
- The Organization of Scientific Area Committees for Forensic Science, founded by NIST in 2014 to develop and register standards.
- accreditation
- Formal recognition that a laboratory meets quality standards; about nine in ten public crime labs were accredited by 2020.
PCAST 2016 and the Argument That Followed
- Define foundational validity and validity as applied as PCAST used them, including why PCAST required black-box studies for subjective methods.
- State PCAST's verdict on each of the seven methods it examined, with the key numbers.
- Lay out the Department of Justice's and practitioners' objections, PCAST's 2017 reply, and what has changed since, and say what evidence would settle the remaining disputes.
20 September 2016: a report and a same-day rebuttal
The President's Council of Advisors on Science and Technology (PCAST) is a group of leading scientists and engineers who advise the President. On 20 September 2016 it released a unanimous report titled Forensic Science in Criminal Courts: Ensuring Scientific Validity of Feature-Comparison Methods. The same day, the Department of Justice issued a statement. It said the report did "not mention numerous published research studies which seem to meet PCAST's criteria," and that this omission "discredits the PCAST report as a thorough evaluation of scientific validity."
That exchange began an argument that is still going on, in laboratories, in journals and in courtrooms. This lesson sets out what PCAST claimed, what its critics replied, how PCAST answered, and what has happened since. As with every dispute in this course, the aim is to understand each side's evidence well enough to say what would settle it.
What PCAST asked
PCAST focused on feature-comparison methods. These decide whether a questioned sample is likely to have come from a known source by comparing features. Examples are DNA profiles, fingerprints, marks on bullets, bite marks, footwear impressions and hair. For each, it asked two questions.
Foundational validity. Has the method itself been shown, by empirical studies, to work? PCAST required a reproducible procedure and empirical estimates of the method's false positive rate and sensitivity "from appropriately designed studies from multiple groups." It listed what such studies need. They need large sets of known, representative samples, and examiners who do not know the right answers. The design must be fixed in advance, with oversight by people with no stake in the outcome. The data must be available for others to check, and several independent studies should reach similar conclusions. For subjective methods, where a human judgement makes the decision, PCAST said foundational validity "can be established only through black-box studies." And it added a sentence that angered many practitioners. Good professional practices, it said, such as certification, accreditation, standard protocols and proficiency testing, "cannot substitute for empirical evidence of scientific validity and reliability."
Validity as applied. Was a valid method applied properly in this case? That requires an examiner shown to be capable by proficiency testing, and a method used within the range it was tested on. It also requires claims in court that go no further than the evidence. Those claims must disclose the method's measured error rates, and whether the examiner knew facts of the case that might bias the conclusion.
PCAST's verdicts
| Method | PCAST's 2016 finding |
|---|---|
| DNA, single source or simple two-person mixtures | Foundationally valid: "an objective method" whose validity has been established. Human error, not coincidence, is the main risk. |
| DNA, complex mixtures | The older combined probability of inclusion approach not foundationally valid; probabilistic genotyping valid only within tested limits (up to three contributors, minor at least 20 percent). |
| Latent fingerprints | Foundationally valid as a subjective method, but with a false positive rate that is "substantial": as high as 1 in 306 in one study and 1 in 18 in another. |
| Firearms | Falls short: only one appropriately designed study, estimating 1 in 66 (upper bound 1 in 46). Admissibility "belongs to the courts." |
| Footwear (linking a print to one particular shoe) | No appropriate empirical studies; such conclusions "are not scientifically valid." Class characteristics such as size and make were not evaluated. |
| Bite marks | "Far from meeting" the standards; examiners "cannot consistently agree on whether an injury is a human bitemark." |
| Hair (reviewed, not fully evaluated) | The DOJ's supporting document relied on a handful of old studies; PCAST noted the FBI's own finding that 9 of 80 microscopic associations were different people by mitochondrial DNA. |
Set that table beside the Wrenfield evidence and you can see where each finding stands. The blood on the glass (single-source DNA) rests on a method PCAST found valid. The thumb-turn print rests on a valid method with a measured error rate that a report should state. The pry-bar marks rest on a discipline PCAST found had not yet shown foundational validity in 2016, and the boot print could support only a class conclusion.
Worth holding on to: PCAST's test was simple to state and hard to meet. For any method that depends on human judgement, measure how often examiners get the right answer on realistic problems, in several independent studies.
The objections
The criticism came from several directions, and it was not all the same.
- Completeness. The Department of Justice's first objection, in 2016, was that PCAST had overlooked relevant studies.
- Method. In January 2021 the Department issued a longer statement arguing that the report "contained several fundamentally incorrect claims": that pattern comparison disciplines belong to the science of measurement (metrology); that validation requires "strict adherence to a non-severable set of experimental design criteria"; and that error rates "can only be established through 'appropriately designed' black box studies." It argued that no single error rate applies to all laboratories, examiners and cases, and that validity can be supported by the literature as a whole even when each study has limits.
- The discipline's own responses. The 2021 statement lists critical responses from the Association of Firearm and Tool Mark Examiners, the National District Attorneys Association and others.
- Priorities. OSAC's own friction ridge subcommittee raised a subtler worry: an exclusive emphasis on black-box studies could crowd out research aimed at turning subjective methods into objective ones.
PCAST's reply
PCAST answered in an addendum approved on 6 January 2017. It invited anyone to identify appropriately designed studies it had missed and received written responses from 26 parties, citing more than 400 papers, most of which it had already reviewed. "DOJ informed PCAST in late December that it had no additional studies for PCAST to consider." No respondent identified an empirical study establishing the validity of bite mark analysis.
On the central question, PCAST did not move. Experience, judgement and good professional practice, it wrote, "can never establish the validity or degree of reliability of any particular method. Only empirical testing of the method can do so." But it agreed with the friction ridge subcommittee's point. For methods already shown to be valid, such as latent prints, further black-box studies were less valuable than investment in fully objective methods. For unvalidated methods, developing an objective method might be the better path.
What has changed since 2016
Both sides can point to change, and much of it is the kind of evidence PCAST asked for.
- More black-box studies. A second Ames Laboratory firearms study was completed in 2020 in direct response to PCAST (Lesson 17). The first large black-box study of bloodstain pattern analysis, published in 2021, found about 11 percent of conclusions erroneous (Lesson 10).
- Scientific foundation reviews by NIST. In March 2023 NIST concluded that "forensic bitemark analysis lacks a sufficient scientific foundation," because the field's three key premises (that front-tooth patterns are unique, that skin records them accurately, and that examiners can analyse them accurately) are "not supported by the data." NIST's December 2024 review of DNA mixture interpretation found probabilistic genotyping the best available tool but called for better public validation data (Lesson 12), and its November 2022 review found that digital evidence examination "rests on a firm foundation based in computer science" (Lesson 18).
- Standards and testimony rules. The OSAC Registry now lists 264 standards. The Department of Justice adopted uniform testimony language across disciplines, forbidding claims of uniqueness, zero error rates and certainty (Lesson 17), and its index of those documents notes that it reviewed the 2023 amendments to the federal rule on expert testimony and concluded no changes were required.
- Courts. In 2023 Maryland's highest court barred unqualified firearms identifications while allowing testimony that marks are consistent or inconsistent with a gun (Lesson 17).
- Hair. The FBI's review continued; a 2018 update reported by the National Registry of Exonerations found erroneous testimony in 93 percent of 484 cases (Lesson 6).
What would settle the remaining disputes
The two sides now agree on more than they did in 2016. The Department of Justice's own statement accepts that "all laboratory test and feature comparison analyses have non-zero error rates," and its testimony rules forbid the old claims of certainty. What remains in dispute is the standard of proof for validity and how to measure error. Three kinds of evidence would narrow it further. The first is more independent, published black-box studies on samples like real casework, with agreed rules for counting inconclusive answers. The second is blind proficiency tests inserted into ordinary casework, so examiners do not know they are being tested. The third is objective methods, such as algorithms built on NIST's 3D toolmark database and probabilistic genotyping, whose error rates can be measured like any other instrument's.
Common misconceptions
- "PCAST said fingerprints are invalid." PCAST found latent fingerprint analysis foundationally valid, with a substantial false positive rate that should be disclosed.
- "PCAST banned bite marks and firearms evidence." PCAST advised; courts decide admissibility. For firearms it explicitly left admissibility to the courts.
- "The Department of Justice denied that forensic methods make errors." Its 2021 statement agreed that all such methods have non-zero error rates; it disputed how those rates must be established.
- "Nothing changed after the report." New black-box studies, NIST foundation reviews, a registry of 264 standards, uniform testimony rules and court rulings all followed.
What you now know
- PCAST's 2016 report required foundational validity (empirical error rates from multiple appropriately designed studies; black-box studies for subjective methods) and validity as applied.
- Verdicts: single-source DNA valid; complex mixtures valid only within limits; latent prints valid with false positive rates up to 1 in 306 and 1 in 18; firearms short of validity (one study, 1 in 66); footwear identification and bite marks not valid; hair review critical.
- The Department of Justice objected in 2016 and in a 2021 statement rejecting PCAST's strict criteria, while accepting non-zero error rates.
- PCAST's January 2017 addendum held its position after 26 responses and 400 papers, and agreed objective methods deserve investment.
- Since then: more black-box studies, NIST foundation reviews (bite marks lack a sufficient foundation), 264 registry standards, testimony rules and court limits.
Sources
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Executive Office of the President. Chapter 4 and Chapter 10 (Findings 1-7). obamawhitehouse.archives.gov
- President's Council of Advisors on Science and Technology. (2017). An addendum to the PCAST report on forensic science in criminal courts (approved January 6, 2017). obamawhitehouse.archives.gov
- U.S. Department of Justice. (2021, January). United States Department of Justice statement on the PCAST report: Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. justice.gov
- Sauerwein, K., Butler, J. M., Reczek, K. K., & Reed, C. (2023). Bitemark analysis: A NIST scientific foundation review (NIST IR 8352). National Institute of Standards and Technology. Key takeaway 1.1. nvlpubs.nist.gov
- U.S. Department of Justice, Office of Legal Policy. (2024). Uniform language for testimony and reports (updated March 6, 2024). justice.gov
- National Institute of Standards and Technology. (2026). OSAC Registry. Accessed October 27, 2026. nist.gov
- Key terms
- PCAST
- The President's Council of Advisors on Science and Technology, whose 2016 report evaluated forensic feature-comparison methods.
- feature-comparison method
- A method that decides whether a questioned sample likely came from a known source by comparing features, such as fingerprints or DNA profiles.
- foundational validity
- Evidence from appropriately designed empirical studies by multiple groups that a method is reproducible and accurate, with measured error rates.
- validity as applied
- Evidence that a valid method was applied correctly in a given case by a proficient examiner, with claims kept within the evidence.
- black-box study
- A test measuring how often examiners reach correct conclusions on realistic problems with known answers.
- objective method
- A method whose steps can be specified and measured without relying on an examiner's judgement, such as an algorithm.
- scientific foundation review
- A NIST study of the published evidence supporting a forensic discipline, such as its 2023 review of bitemark analysis.
When Forensic Science Goes Wrong, and How Labs Guard Against It
- Use exoneration data from the Innocence Project and the National Registry of Exonerations to describe how often forensic evidence has contributed to wrongful convictions.
- Distinguish five ways forensic evidence goes wrong: invalid methods, overstated testimony, biased judgement, laboratory failure and irrelevant results.
- Explain the safeguards that address each: validation, testimony rules, information management and blind verification, accreditation and proficiency testing, and independent oversight.
The belief we start from
Imagine a juror in Wrenfield, a year from now, hearing a laboratory scientist testify. The juror thinks what most people think: the lab is science, science is objective, so if the lab says it matches, that settles it. This lesson starts from that belief and follows it to the places where it has broken down, using the records of people who were convicted and later proven innocent. Then it shows the safeguards laboratories use, and how each one maps onto a specific way things went wrong.
The people in those records are real, and each lost years of life. They are described here through numbers and documented findings, not as stories for effect.
What exonerations show
Two organisations keep the main records. The Innocence Project, which tracked every DNA exoneration in the United States until it reached 375 in 2020, reports that the first took place in 1989, that the average exoneree served 14 years, and that 21 of the 375 had served time on death row. In 43 percent of those cases, it reports, misapplication of forensic science was a contributing factor; eyewitness misidentification was involved in 69 percent. The National Registry of Exonerations, a project of the University of California Irvine, the University of Michigan Law School and Michigan State University College of Law, counts all exonerations, not only DNA cases: 3,868 since 1989 at the time of writing.
A contributing factor is not the same as the sole cause. Most wrongful convictions involve several failures at once. But the numbers rule out the juror's belief. Forensic evidence has been part of the path to a wrong verdict in a large share of the cases where the truth later came out.
Debugging the belief: five ways it fails
Failure 1: the method itself was never valid for the claim. Bite mark comparison was used to link defendants to crimes for decades. In 2009 the National Academy of Sciences found no evidence of a scientific basis for identifying a person by a bite mark, PCAST said in 2016 that examiners could not consistently agree whether an injury was a bite mark at all, and NIST concluded in 2023 that the field's key premises are not supported by the data. When a method lacks a foundation, careful practice cannot rescue it.
Failure 2: a usable method, overstated. Microscopic hair comparison can exclude and can say a hair is similar, but it cannot identify a person. The FBI's 2015 review found erroneous statements in 257 of 268 trials where examiners' testimony was used to incriminate a defendant, and the National Registry's 2023 study counted at least 129 people falsely convicted based partly on hair comparison. The failure was in the claims made in court, not only in the microscope.
Failure 3: a sound method, biased judgement. In the Mayfield case (Lesson 5), skilled examiners reasoned backward from a known print. In an experiment described by PCAST, five fingerprint examiners re-examining prints they had matched years earlier, told falsely that the pair was a famous error, mostly changed their conclusions. In another, 17 DNA analysts given a complex mixture without the case context, which the original analysts had known, mostly disagreed with the original result: only 1 of 17 agreed, and 12 excluded the suspect.
Failure 4: a sound method, a broken laboratory. PCAST listed examples of whole laboratories in trouble: a two-year independent investigation of the Houston Police Department's crime laboratory that led to the review of 3,500 cases; the closure of the Detroit police crime laboratory's firearms unit in 2008 after an audit found contamination and poorly maintained equipment; a 2010 review of North Carolina's state crime laboratory that found agents had withheld or distorted evidence in more than 230 cases over 16 years; and a 2013 review of DNA evidence handling in more than 800 rape cases at New York City's medical examiner's office. One analysis PCAST cited estimated that at least fifty major laboratories reported fraud, evidence destruction, failed proficiency tests or misrepresented findings between 2005 and 2011, and that 28 of them were nationally accredited.
Failure 5: a correct result that answers the wrong question. A DNA match tells whose DNA is present. As NIST's 2024 review warns, it does not say how or when the DNA arrived, and sensitive tests detect DNA unconnected to any crime (Lesson 12). A true result, presented as if it answered a different question, can mislead as badly as a false one.
So what? "The lab says it matches" can fail at five different points: the method, the claim, the examiner's judgement, the laboratory, or the question. Each failure has happened in documented cases, and each needs a different safeguard.
The safeguards, matched to the failures
| Failure | Safeguard | Where you have seen it |
|---|---|---|
| Invalid method | Empirical validation: black-box studies, foundation reviews, published error rates | PCAST, NIST reviews, Ames II, the 2021 bloodstain study |
| Overstated claims | Testimony rules forbidding uniqueness, certainty and zero error rates; reports that state limits and error rates | Department of Justice ULTRs (Lesson 17) |
| Biased judgement | Information management (case managers withhold irrelevant facts); linear analysis before seeing reference samples; blind verification with mixed conclusion types | Linear ACE-V after Mayfield; the Wrenfield case manager (Lesson 5) |
| Broken laboratory | Accreditation to international standards; proficiency testing, ideally blind and within ordinary casework; independent oversight | About 9 in 10 public labs accredited by 2020; Houston's independent forensic science center |
| Wrong question | Reports that separate whose DNA it is from how it got there; context-aware interpretation | NIST DNA mixture review (Lesson 12) |
A few of these deserve a closer look.
Sequential unmasking. PCAST described a family of strategies for cognitive bias: managing the flow of information so analysts are not exposed to irrelevant context, "such as confessions or eyewitness identification," and making them document their findings from the evidence before comparing it with a suspect's sample. For DNA, the approach is called sequential unmasking: the analyst interprets the crime scene profile first, then sees the reference profiles one at a time.
Accreditation and its limits. The National Academy recommended mandatory accreditation, referring to international standards such as ISO/IEC 17025, and by 2020 about nine in ten publicly funded labs were accredited. Accreditation checks that a laboratory follows documented procedures with quality control. It does not validate a method that has never been tested, and PCAST's figure of 28 accredited labs among those reporting serious problems shows it is not a guarantee.
Independent oversight. When the FBI announced the hair review in 2015, it noted that the Texas Forensic Science Commission had already begun reviewing hair cases handled by state and local analysts. Commissions like Texas's, independent laboratories like Houston's, and conviction review after new evidence emerges are the system's way of checking itself after the fact.
Wrenfield, run badly and run well
Debug the Wrenfield case by imagining it run badly. The detective phones the fingerprint examiner and says Pruitt has a burglary record and fits the case. The examiner compares the thumb-turn latent with Pruitt's prints first, marks features with Pruitt's card beside her, and a verifier who knows her conclusion agrees. The hair examiner reports that the hair is "consistent with" a suspect, without saying how many other people's hair would be too. The DNA analyst reports a match statistic for the drawer swab's minor contributor without saying it is too weak to interpret. The camera's 23:40 timestamp goes into the timeline unchecked. Every one of those errors has a real-world precedent in this course.
Now the version you followed. A case manager kept Pruitt's record from the examiner, who analysed the latent first and was checked by a blind verifier; Pruitt was excluded. Elimination samples identified Dana's print and probably her hair. The glass, fibre and soil reports said "class evidence" in plain words. The drawer mixture was reported as uninterpretable for the minor contributor. The camera clock was checked and photographed. Walter's death was not blamed on the burglar because evidence about time was combined honestly. None of this required genius. It required procedures designed by people who studied how things go wrong.
Common misconceptions
- "Wrongful convictions come from a few corrupt analysts." Some cases involved misconduct, but the hair review found erroneous testimony from 26 of 28 FBI examiners: a systemic problem of training and culture. The National Academy called the problems structural.
- "An accredited lab cannot get it wrong." Accreditation checks procedures and quality control. It cannot validate an untested method, and accredited labs have had serious failures.
- "Bias means dishonesty." Cognitive bias affects honest, skilled experts without their awareness, which is why procedural safeguards work better than good intentions.
- "Forensic science mostly convicts the innocent." Most forensic results are accurate, and DNA has freed hundreds of people. The point of studying failures is to make every result trustworthy, not to dismiss the science.
The takeaway
- The Innocence Project counted 375 DNA exonerations by 2020; misapplication of forensic science contributed to 43 percent. The National Registry of Exonerations counts 3,868 exonerations of all kinds since 1989.
- Forensic evidence fails through invalid methods, overstated testimony, biased judgement, laboratory failure, or results that answer the wrong question.
- Safeguards: validation studies and published error rates; testimony rules; information management, linear analysis and blind verification; accreditation and proficiency testing; independent laboratories and commissions.
- Accreditation is necessary but not sufficient; bias is a property of human judgement, not a sign of dishonesty.
- The Wrenfield case shows each safeguard in use, and what the same case would have looked like without them.
Sources
- Innocence Project. (n.d.). DNA exonerations in the United States. Accessed October 27, 2026. innocenceproject.org
- National Registry of Exonerations. (2026). The National Registry of Exonerations [Home page with running totals]. Accessed October 27, 2026. exonerationregistry.org
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Chapter 2 (laboratory failures, footnote 60; cognitive bias) and section 5.4 (bias studies and mitigation strategies). obamawhitehouse.archives.gov
- Federal Bureau of Investigation. (2015, April 20). FBI testimony on microscopic hair analysis contained errors in at least 90 percent of cases in ongoing review [Press release]. fbi.gov
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Recommendations 5, 7 and 8. ojp.gov
- Butler, J. M., Iyer, H., Press, R., Taylor, M. K., Vallone, P. M., & Willis, S. (2024). DNA mixture interpretation: A NIST scientific foundation review (NIST IR 8351). Key takeaways 5.1-5.4. doi.org
- Key terms
- exoneration
- Official clearing of a person convicted of a crime after new evidence shows they did not commit it.
- contributing factor
- One of the failures that helped produce a wrongful conviction; most cases involve several.
- cognitive bias
- Unconscious influence of expectations or context on judgement, affecting honest experts.
- information management
- Controlling what case information reaches an examiner so irrelevant facts cannot sway the analysis.
- sequential unmasking
- Interpreting crime scene evidence before seeing reference samples, revealing them one at a time.
- proficiency test
- A test of an examiner's or lab's performance on samples with known answers, ideally blind and within casework.
- ISO/IEC 17025
- The international standard for testing laboratories that accreditation of forensic labs commonly uses.
Module 8: Closing the Case
The Wrenfield case comes together: every finding weighed for what it supports and what it does not, written up in honest report language, and tested against the questions a court will ask. The course ends with the careers behind each method and how to prepare for them.
Closing the Mock Case: The Report and the Witness Stand
- Build an evidence table that states, for each finding, what it supports, how strongly, and its limits.
- Explain why evidence items cannot simply be multiplied together when they are not independent, and write conclusions in language that avoids overstatement.
- Describe what Rule 702 and the Daubert decision require of expert testimony, and prepare honest answers to likely cross-examination questions.
A stack of reports on one desk
Some weeks after Dana Whitcomb found the back door open, Detective Sergeant Reyes had a stack of laboratory reports and a medical examiner's certificate on her desk. A prosecutor was asking one question: what does it all add up to? This lesson is the procedure for answering that question honestly. It builds the Wrenfield evidence into one table, combines it carefully, writes the conclusions in language a court can rely on, and then puts a scientist on the witness stand. At the end, it changes two findings to show how differently an honest report would read.
Step 1: separate the two cases
First, the death. Dr. Hartigan certified that Walter Penhallow died of heart disease, manner natural, between Friday night and Saturday midday (Lessons 13 to 15). The burglary happened on Sunday night. Those are two events at one address, and the forensic evidence keeps them apart. The autopsy found no injuries, and toxicology found nothing that contributed. The stair door was found locked. And the time window from body changes and insects closed more than a day before the camera shows anyone in the alley. Whatever the court decides about the burglary, it has no scientific basis for connecting the intruder to Walter's death. That is a finding too, and an important one.
Step 2: the evidence table
For each item, the table records the finding, which hypothesis it bears on (H1: Corey Vance was the intruder; H2: someone else was), how strongly, and what limits it. Notice how different the rows are.
| Item | Finding | Strength for H1 over H2 | Limits to state |
|---|---|---|---|
| 2A: blood on broken glass edge | Single-source profile matching Vance at all 20 core loci | Very strong; likelihood ratio is 1 divided by a minute random match probability | Statistic assumes an unrelated person; possible lab error; says whose blood, not how it got there (though a fresh broken edge narrows innocent routes) |
| 3A: thumb-turn latent print | Identified to Vance's right thumb; blind verification agreed | Strong | Black-box false positive rates up to about 1 in 306 and 1 in 18 in the two studies PCAST relied on |
| 7: pry marks on drawer lip | Class features agree; chipped-corner step reproduced by Vance's bar | Moderate | Subjective comparison; large error-rate studies concern firearms, not pry bars |
| 4: navy fibres on glass | Consistent in type, colour and cross-section with Vance's hoodie | Weak to moderate | Class evidence; frequency of that fibre and dye unknown |
| 1: glass on hoodie cuffs | Three fragments within the door glass's refractive index and elemental range | Weak to moderate | Class evidence; common float glass |
| 6: clay and boot print | Clay consistent with Millrace site and Vance's boots; tread class matches | Weak | Same clay under much of east Wrenfield; about 180 matching boots locally (Lesson 3) |
| Phone records | Phone in the Dock Street sector 22:41 to 23:07 | Neutral | Alibi house is in the same sector |
| 8: camera | Intruder in alley 22:49 to 23:04, corrected time | Neutral on identity | Hooded figure not identifiable |
| 3B, 5, 9: drawer print, hair, handle swab | Dana's print; hair probably Dana's; handle mixture with Dana major, minor uninterpretable | None | Explained by her lawful presence |
The core of it: An honest evidence table puts strong and weak findings side by side, states every limit, and records the findings that do not help either side.
Step 3: combine carefully
Lesson 3 showed that a likelihood ratio multiplies the odds you held before the evidence. Lesson 16 showed the Richard III team combining two of them. A genetic likelihood ratio of 79 and a non-genetic one of 85,000 combined to 6.7 million, roughly 79 times 85,000, and the team chose deliberately conservative assumptions. So why not multiply every row of the Wrenfield table?
Because multiplication is only valid when the items are independent, meaning each would be just as likely to occur whatever the others showed. Several Wrenfield items are not. The fibres and the glass fragments both concern the same hoodie. If the intruder wore it, both are expected together; if someone else did, they are not independent coincidences either. The clay and the boot print come from the same boot. Multiplying them as separate pieces of evidence would count the same fact twice. NIST's 2024 review of DNA mixture interpretation makes a related point about assumptions. A likelihood ratio about whose DNA it is says nothing about how or when the DNA arrived. So reporting it as a standalone number "can be misleading without sharing the assumptions" made in calculating it.
In practice, the honest summary is qualitative. The DNA and the fingerprint provide strong, largely independent support for H1, and the tool mark adds moderate support. The trace evidence is consistent with H1 but adds little that is independent of it. The phone records and camera are neutral on identity. No single number for the whole case is scientifically justified.
Step 4: write the conclusions
The wording matters as much as the analysis. Lesson 6 showed that even careful-sounding phrases misled juries. The Department of Justice's uniform testimony rules forbid claims of uniqueness, of zero error, of exclusion of all other sources, and of "100% certainty." PCAST also quoted the National Commission on Forensic Science's view that phrases such as "a reasonable degree of scientific certainty" have "no scientific meaning and may mislead factfinders." Compare:
| Do not write | Write instead |
|---|---|
| "The blood on the glass is Corey Vance's, to a reasonable degree of scientific certainty." | "Corey Vance cannot be excluded as the source of the DNA profile from Item 2A. The probability that an unrelated person chosen at random would have this profile is [statistic]. This does not address how or when the blood was deposited." |
| "The print is Vance's and no one else's." | "Source identification: in the examiner's opinion, the probability that the latent print on Item 3A came from a different source is so small as to be negligible. Published black-box studies of latent print examination have found false positive rates whose upper bounds were about 1 in 306 and 1 in 18." |
| "The fibres match his hoodie." | "The fibres from Item 4 are consistent in type, colour and cross-section with fibres from the hoodie. Fibres from other garments of the same type and dye cannot be excluded; the frequency of such garments is not known." |
Step 5: the witness stand
Before an expert testifies in a federal court, the judge acts as a gatekeeper under Federal Rule of Evidence 702. As amended in 2023, the rule admits expert testimony only if "the proponent demonstrates to the court that it is more likely than not" that four conditions hold. The expert's knowledge must help the jury, and the testimony must be "based on sufficient facts or data." It must be "the product of reliable principles and methods." Finally, the proponent must show that "the expert's opinion reflects a reliable application of the principles and methods to the facts of the case." The committee that drafted the amendment noted that many courts had got this wrong. They had treated the basis and application of an expert's method as questions of weight for the jury, rather than of admissibility.
The rule builds on the Supreme Court's 1993 decision in Daubert v. Merrell Dow Pharmaceuticals, which replaced the older test of "general acceptance" in federal courts. The Court listed factors a judge may consider. One is whether the technique "can be (and has been) tested." Others are whether it "has been subjected to peer review and publication," and its "known or potential rate of error." The last are the "existence and maintenance of standards controlling its operation," and whether it has wide acceptance in the relevant scientific community. It added that cross-examination and contrary evidence, not wholesale exclusion, are the usual tools for testing shaky but admissible evidence.
So prepare for cross-examination by asking the questions yourself. Each one has an honest answer in this course.
- "Did you know Mr. Vance was a suspect when you compared the print?" (The examiner analysed the latent first, was shielded from case information, and was checked by a blind verifier.)
- "What is the error rate of fingerprint comparison?" (Give the black-box figures and their upper bounds; do not claim zero.)
- "Could Mr. Vance's DNA have reached the glass innocently?" (The blood is on the freshly broken edge; transfer cannot be excluded in principle, but no innocent route has been identified in the evidence.)
- "How many other hoodies have fibres like these?" (Unknown; the fibres are class evidence.)
- "Was the camera clock accurate?" (No: it was 47 minutes fast, measured, photographed and corrected.)
Change two findings
Suppose the thumb-turn print had been excluded as Vance's, and the only DNA linking him to the scene had been a weak minor component on the drawer handle. The table would then hold no strong, independent evidence: a transfer-prone trace, a tool mark of uncertain error rate, and class evidence that hundreds of people share. An honest report would say the findings are consistent with Vance's presence but would not single him out, and it would say so even if the investigators were sure. The same procedure, applied to different findings, produces a very different case. That is what it means for science to test a theory rather than decorate one.
In the real version of Wrenfield, Corey Vance was charged with burglary. The course ends where the scientists' work ends: with reports that say what the evidence shows and what it does not, and with witnesses prepared to defend every sentence. The verdict belongs to the court.
Common misconceptions
- "More evidence items always mean a stronger case." Items that depend on each other, such as fibres and glass from the same garment, do not add independent weight; counting them separately overstates the case.
- "A good expert sounds certain." Department of Justice rules forbid claims of certainty or zero error, and the National Commission on Forensic Science called "reasonable scientific certainty" a phrase with no scientific meaning.
- "If evidence is admitted, it must be reliable." Admission means the judge found it more likely than not to meet Rule 702. Its weight is still for the jury, tested by cross-examination.
- "Forensic scientists decide guilt." They report what the evidence shows and its limits. The court decides the verdict.
Recap
- Keep separate events separate: Walter's natural death and the Sunday burglary.
- Build an evidence table: finding, strength for each hypothesis, and stated limits, including neutral and irrelevant items.
- Multiply likelihood ratios only for independent items; dependent items such as fibres and glass from one garment must not be double-counted.
- Write conclusions in calibrated language: no uniqueness, no certainty, error rates stated, class evidence called class evidence.
- Rule 702 (amended 2023) requires the proponent to show, more likely than not, sufficient basis, reliable methods and reliable application; Daubert (1993) lists testing, peer review, error rate, standards and acceptance.
- Different findings would have produced a much weaker case, and an honest report would have said so.
Sources
- Legal Information Institute. (n.d.). Rule 702. Testimony by expert witnesses, with Committee Notes on the 2023 amendment. Federal Rules of Evidence. Cornell Law School. law.cornell.edu
- Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Legal Information Institute. law.cornell.edu
- U.S. Department of Justice, Office of Legal Policy. (2024). Uniform language for testimony and reports. justice.gov
- President's Council of Advisors on Science and Technology. (2016). Forensic science in criminal courts: Ensuring scientific validity of feature-comparison methods. Footnote 43 (National Commission on Forensic Science on "reasonable scientific certainty") and Finding 5. obamawhitehouse.archives.gov
- King, T. E., et al. (2014). Identification of the remains of King Richard III. Nature Communications, 5, 5631. Results, combining likelihood ratios. nature.com
- Butler, J. M., Iyer, H., Press, R., Taylor, M. K., Vallone, P. M., & Willis, S. (2024). DNA mixture interpretation: A NIST scientific foundation review (NIST IR 8351). Key takeaway 5.4. doi.org
- Key terms
- evidence table
- A summary listing each finding, which hypothesis it supports, how strongly, and its limits.
- independence
- When one item of evidence would be equally likely whatever the others show; only independent items' likelihood ratios may be multiplied.
- Rule 702
- The Federal Rule of Evidence governing expert testimony; amended in 2023 to stress that the proponent must show admissibility is more likely than not.
- Daubert standard
- The 1993 Supreme Court test asking whether a method has been tested, peer reviewed, has a known error rate, maintained standards and acceptance.
- gatekeeper
- The judge's role in deciding whether expert testimony is reliable enough to reach the jury.
- reasonable scientific certainty
- A courtroom phrase the National Commission on Forensic Science said has no scientific meaning and may mislead.
- cross-examination
- Questioning of a witness by the opposing side, the main tool for testing admitted expert evidence.
Careers in Forensic Science
- Compare the main forensic science careers by what the work involves, the usual education, and the boards that certify practitioners.
- Use Bureau of Labor Statistics data to describe the forensic science technician occupation, with every figure tied to its date.
- Plan high school and college preparation for a forensic career, including the science, mathematics and communication skills the field relies on.
Everyone who worked on Wrenfield
Count the people behind the Wrenfield reports. Officer Ruiz secured the scene. Sam Ostrowski, the crime scene investigator, photographed, sketched and packaged it. A latent print examiner compared the thumb-turn print, and a second examiner verified it blind. A DNA analyst built the profile from the glass, and trace examiners compared the fibres, the glass fragments and the clay. A toxicologist tested Walter's samples, Dr. Hartigan certified his death, Dr. Iversen read the insects, an anthropologist identified the deer bones, a tool mark examiner compared the pry bar, and a digital examiner verified the camera export by its hash value. That is more than ten specialists for one burglary and one natural death.
This lesson compares those careers side by side: what each one does, the training it usually takes, and who certifies the people who do it. It uses the same rule as the rest of the course. Every number comes from a named source with a date, because job figures change every year.
The occupation BLS counts: forensic science technicians
The Bureau of Labor Statistics (BLS) groups most crime scene and crime laboratory workers into one occupation, forensic science technicians. Its Occupational Outlook Handbook page, last modified on August 27, 2026, describes two kinds of work. At scenes, technicians decide what evidence to collect and how, take photographs, make sketches, record observations, collect and preserve evidence, and keep the chain of custody. In laboratories, they perform chemical, biological and microscopic analyses, examine DNA results, consult specialists such as toxicologists, and write technical reports that can include statistical analyses. On either side, they may be called to testify in court about their findings and methods.
The numbers on that page, each with its date:
- Jobs: about 20,100 in 2025. Local governments employed 64 percent of them and state governments 27 percent, which fits Lesson 1's picture of a mostly public system of crime laboratories.
- Pay: a median annual wage of $72,060 in May 2025. A median is the middle value: half of the workers earned more and half earned less. Pay varies with place, employer and experience.
- Outlook: employment projected to grow 13 percent from 2025 to 2035, which BLS calls much faster than average, with about 2,800 openings a year on average. BLS expects many of those openings to replace workers who retire or move to other occupations.
BLS says technicians typically need a bachelor's degree to enter the occupation, in a field such as physical science, biology or forensic science. An associate's degree may be enough for some positions. Laboratory specialties are learned on the job, usually in less than a year. Some crime scene investigators are sworn police officers who met the requirements for a police academy. Certifications are typically not required to enter the occupation. But before doing casework on their own, technicians may need to pass a proficiency exam or be approved by their laboratory or an accrediting body. Schedules differ by role. Laboratory technicians usually work a standard week, though they may be on call. Crime scene technicians may work day, evening or night shifts and overtime, because someone must always be available.
Careers compared
The BLS occupation is only part of the field. The American Academy of Forensic Sciences is a professional body of more than 6,000 scientists. It organises its members into 12 sections, from anthropology, criminalistics, pathology and toxicology to engineering, odontology, questioned documents, and digital and multimedia sciences. The table compares the careers you met in this course. The education column draws on BLS and on each certifying board's own site. It also uses a table of educational pathways that the 2009 National Academy of Sciences report reproduced from a 2003 article.
| Career | In Wrenfield | Usual education | Who certifies |
|---|---|---|---|
| Crime scene investigator | Securing, photographing and packaging the scene (Lesson 2) | Police academy for sworn officers; a bachelor's degree for many civilian technician roles | International Association for Identification (IAI): crime scene certifications at three levels |
| Latent print examiner | The thumb-turn and drawer prints (Lessons 4 and 5) | An associate or bachelor's degree, then supervised training on the job | IAI: latent print and tenprint certifications |
| DNA analyst | The profile from the glass edge (Lessons 11 and 12) | A bachelor's degree in a natural science or forensic science, meeting the FBI Quality Assurance Standards' education and training requirements | American Board of Criminalistics (ABC): Forensic DNA examination |
| Trace and drug chemist | Fibres, glass and clay (Lessons 7 to 9) | A bachelor's degree in chemistry or a related science | ABC: drug analysis and other examinations |
| Firearms and tool mark examiner | The pry marks on the drawer (Lesson 17) | An associate or bachelor's degree, then supervised training | Association of Firearm and Tool Mark Examiners (AFTE): certification testing |
| Forensic toxicologist | Walter's samples (Lesson 13) | A degree in chemistry or a related science | American Board of Forensic Toxicology (ABFT): education, experience and a written exam |
| Medical examiner (forensic pathologist) | Dr. Hartigan's examination (Lesson 14) | Four years of medical school, three to four years of pathology training, then a fellowship year in forensic pathology | American Board of Pathology, plus a state medical license |
| Forensic anthropologist | The deer bones (Lesson 16) | A graduate degree; board certification requires a doctorate | American Board of Forensic Anthropology (ABFA) |
| Forensic entomologist | Dr. Iversen's insect evidence (Lesson 15) | Typically a doctorate in entomology | American Board of Forensic Entomology (ABFE): written and practical exam; a technician certification for collecting insect evidence |
| Digital forensic examiner | The camera export and its hash value (Lesson 18) | Often a degree in computer science or computer engineering | International Association of Computer Investigative Specialists (IACIS): Certified Forensic Computer Examiner |
A few details from the boards' own descriptions show what certification means in practice. The ABFE's certification is a peer review process with a written and a practical examination, and its Diplomates and Members must recertify every five years. The ABFA confers Diplomate status on forensic anthropologists who hold a doctorate and pass a rigorous examination. The ABFT bases certification on education, training, experience and a formal written examination, and applicants must already practise forensic toxicology. The ABC designs its DNA examination for analysts who meet the FBI's Quality Assurance Standards and already work in a laboratory. IACIS candidates solve four practical problems with a coach, then complete a practical exercise and a written examination, and recertify every three years. Several boards are themselves checked: the ABFT and the ABFA are accredited by the Forensic Specialties Accreditation Board, and the IAI's certification programs gained international accreditation in late 2024.
Notice one difference that Lesson 14 raised. Medical examiners, the NAS report found, are almost always physicians and are often pathologists or forensic pathologists. Coroners are mostly elected officials, 82 percent in its figures, and may or may not be physicians or have medical training.
Key idea: Forensic science is many careers, not one. Most begin with a strong degree in a natural science. Each discipline adds its own training and standards, and usually a certifying board that tests people once they are working in the field.
What the work is really like
The NAS report noted that television crime shows drove a surge of student interest in forensic science. Many students, it said, arrive with expectations shaped by those shows and find the real work different. The work this course has shown is careful and often repetitive. It means documenting, measuring, comparing questioned items with known ones, and running controls. It means writing reports in calibrated language and defending them under cross-examination. Technicians often concentrate on scene work or laboratory work, and some specialise further in particular techniques.
The honest-science habits in this course are job skills, not extras. Blind verification (Lesson 5), sequential unmasking and proficiency tests (Lesson 21), and report language that states error rates and avoids certainty (Lesson 22) are how good laboratories protect their results. An examiner who reports "inconclusive" or "excluded" when that is what the evidence shows is doing the job well. Some roles also involve distressing cases. The American Academy of Forensic Sciences lists resources on vicarious trauma, the strain that can come from repeated exposure to other people's suffering, alongside its career pages.
Preparing in high school
- Chemistry and biology, with labs. The NAS report found that most crime laboratory hires have degrees in chemistry or biology, and a survey it cites found laboratory managers ranked chemical knowledge the most important ability. Take the most demanding laboratory sciences your school offers.
- Mathematics, especially statistics. BLS lists math skills, including a solid understanding of statistics, among the important qualities for technicians. Lessons 3, 11 and 20 showed why: match probabilities, likelihood ratios and error rates are statistics.
- Writing and speaking. BLS lists communication skills, because technicians write reports and testify. Practise explaining a technical result clearly to someone who is not a scientist.
- Choosing a college program. Degrees in chemistry, biology or forensic science can all lead into a laboratory. If you choose forensic science, the American Academy of Forensic Sciences' program search can filter for programs accredited by the Forensic Science Education Programs Accreditation Commission (FEPAC). The NAS report cited a 1988 survey in which practitioners complained that some programs called forensic science contained little hard science, so check the chemistry and biology in any program you consider.
- Certification comes later. Boards generally certify people who are already trained and working in a discipline, so there is nothing to sign up for yet. What you can build now is the science, the statistics and the habit of saying exactly what your evidence shows.
Common misconceptions
- "A forensic scientist does everything, from the scene to the lab to the courtroom." BLS notes that technicians often specialise in either scene or laboratory work, and some specialise further. The Wrenfield case needed more than ten different specialists.
- "You need a forensic science degree." BLS lists physical science, biology or forensic science, and the NAS report found most laboratory hires hold chemistry or biology degrees.
- "Medical examiners and coroners are the same job." Medical examiners are almost always physicians; most coroners are elected and may or may not be physicians.
- "You must be certified before your first job." BLS says certifications typically are not required to enter the occupation, though technicians may need to pass proficiency exams before independent casework. Forensic pathologists, by contrast, need a medical license and board certification.
Where this leaves us
- BLS counted about 20,100 forensic science technician jobs in 2025, mostly in local and state government, with a median wage of $72,060 in May 2025 and 13 percent projected growth from 2025 to 2035 (page last modified August 27, 2026).
- Most laboratory careers begin with a bachelor's degree in a natural science or forensic science; medical examiners are physicians with pathology training; anthropologists and entomologists usually hold graduate degrees.
- Boards such as the IAI, ABC, AFTE, ABFT, ABFA, ABFE and IACIS certify practitioners, usually after they have trained and worked in the discipline.
- The honest-science habits in this course, including blind checks, stated error rates and calibrated reports, are the core of the job.
- In high school: rigorous chemistry and biology with labs, statistics, and practice writing and explaining technical results.
Sources
- Bureau of Labor Statistics, U.S. Department of Labor. (2026, August 27). Forensic science technicians. In Occupational outlook handbook. Summary, What They Do, Work Environment, How to Become One, Pay and Job Outlook tabs. bls.gov
- American Academy of Forensic Sciences. (n.d.). Careers in forensic science. aafs.org
- National Research Council. (2009). Strengthening forensic science in the United States: A path forward. National Academies Press. Chapter 8, Table 8-1 and pp. 220-222; Chapter 9, pp. 247-248 and 256. ojp.gov
- International Association for Identification. (n.d.). Certifications. theiai.org
- American Board of Criminalistics. (n.d.). Certification and Forensic DNA. criminalistics.com
- American Board of Forensic Toxicology. (n.d.). American Board of Forensic Toxicology (home page). abft.org
- American Board of Forensic Anthropology. (n.d.). American Board of Forensic Anthropology (home page). theabfa.org
- American Board of Forensic Entomology. (n.d.). American Board of Forensic Entomology (home page). forensicentomologist.org
- International Association of Computer Investigative Specialists. (n.d.). CFCE certification. iacis.com
- Association of Firearm and Tool Mark Examiners. (n.d.). Certification. afte.org
- Key terms
- Occupational Outlook Handbook
- The Bureau of Labor Statistics guide to occupations, giving duties, education, pay and projected growth, each tied to a date.
- forensic science technician
- The BLS occupation covering crime scene and crime laboratory workers who collect and analyse evidence.
- median wage
- The middle value of a set of wages: half of workers earn more and half earn less.
- certification
- Recognition by a professional board that a practitioner has met its standards of education, training, experience and examination.
- forensic pathologist
- A physician with pathology training and a fellowship in forensic pathology who investigates sudden, unexpected or violent deaths.
- Diplomate
- A practitioner certified by a professional board; the ABFA requires a doctorate and a rigorous examination for this status.
- FEPAC
- The Forensic Science Education Programs Accreditation Commission, which accredits college forensic science programs.
- proficiency test
- A test on samples with known answers that technicians may need to pass before doing casework on their own.