An introduction to forensic sciences

I have always been interested in forensic sciences (this explains why I pursued a career in DFIR). I remember spending weekend nights watching CSI... It was fascinating! Of course, real casework is much slower and less glamorous than TV. There is even a name for the (often unrealistic) expectations these shows created about forensic work: the "CSI effect".

Some time ago, I started to study forensic sciences more broadly (outside of IT). In this post, I introduce the main areas of forensic sciences and criminal investigation.

Types of forensics and forensic investigators

The word forensic comes from the Latin forensis, "of the forum", the place where Roman courts were held. So "forensic" is not a science by itself: any field of knowledge becomes forensic when it is used to answer questions of interest to the justice system. That is why we have forensic chemistry, forensic medicine, forensic engineering, forensic accounting and, of course, digital forensics.

There is a discussion in the IT security industry about computer forensics versus digital forensics. In the past, there were no cellphones, IoT devices, smartwatches, and other devices that make our lives easier. So, I believe that nowadays the correct term for a person who works broadly with all kinds of devices is a "digital forensics specialist", instead of the classical "computer forensics specialist".

A non-exhaustive list of what you find in a forensic science service:

Two distinctions are worth knowing early. First, criminalistics (next section) studies the physical evidence that is external to the body (objects, traces and the scene itself), while the examination of the human body, living or dead, belongs to forensic medicine. Second, criminalistics is not criminology: criminology studies the crime, the offender, the victim and social control, while criminalistics deals with physical evidence.

Who does the work depends on the legal system. In civil-law countries (most of continental Europe and Latin America), examinations are performed by official forensic experts, usually civil servants with a university degree working for the police or for an independent forensic institute, and the parties may appoint their own technical consultants to review the official report. In common-law countries (the United States, the United Kingdom, Australia), each side can bring its own expert witnesses, and the court decides what weight to give to their testimony. The roles, however, are similar everywhere: crime scene investigators, forensic scientists in the lab, medical examiners and forensic pathologists, latent print examiners, firearms examiners, forensic document examiners, toxicologists, collision reconstructionists and digital forensic examiners.

Whatever the discipline, the final product is the expert report. It is often decisive, but it does not bind the court: the judge or jury may accept or reject it, in whole or in part.

Criminalistics

Criminalistics was born out of forensic medicine. In the 19th century, physicians were the ones consulted about the material aspects of a crime, but as chemistry, physics and biology advanced, other specialists became necessary. The term was coined by the Austrian examining magistrate Hans Gross, considered the father of the discipline, in his Handbuch für Untersuchungsrichter als System der Kriminalistik (1893). He defined it as "the study of the phenomenology of crime and of the practical methods of its investigation". In short, criminalistics is the recognition, collection, analysis and interpretation of physical evidence.

In practice, criminalistics tries to answer three questions: did a crime happen (corpus delicti)? How did it happen (reconstruction)? And, when possible, who did it (identification)? Its best-known principles are:

Some courses also teach three postulates: the content of a report should not depend on the expert who wrote it; the conclusions should not depend on the (validated) methods used to reach them; and the truth does not change with time, even though it gets harder to find.

The exchange principle is also why preserving the scene is so important. The first responders must make sure nothing is altered until the forensic team arrives. Everyone who walks into a poorly isolated scene adds their own traces and destroys others.

The chain of custody is the set of procedures used to maintain and document the chronological history of the evidence, tracking its possession and handling from the moment it is recognized as evidence until its disposal. A typical chain covers recognition, isolation, documentation, collection, packaging, transport, receipt, analysis, storage and disposal. If you work in DFIR, this list should look very familiar: replace "packaging" with "imaging and hashing" and you basically have our evidence handling procedure.

Blood is a good example of scene work. Suspected stains first go through presumptive tests, such as Kastle-Meyer (reduced phenolphthalein, which is colorless, is oxidized by hydrogen peroxide with hemoglobin acting as a catalyst and turns pink) or luminol, which glows in contact with tiny amounts of blood, even on surfaces that have been washed. They are called presumptive because other substances, such as bleach, can also react, so positive results must be confirmed in the lab. Then, bloodstain pattern analysis uses physics to reconstruct what happened. A drop that falls at 90° leaves a round stain, and the more oblique the impact, the more elongated the stain, with a "tail" pointing to the direction of travel. The impact angle can be estimated as arcsin(width / length): a stain 2 mm wide and 4 mm long hit the surface at about 30°. Combining the angles and directions of several stains reveals the area where the blood source was.

Forensic ballistics

Forensic ballistics studies firearms, ammunition and the effects of shots whenever they are related to an offense. It is usually divided into internal ballistics (what happens inside the weapon), external ballistics (the trajectory of the projectile) and terminal ballistics (the effects on the target, including wounds).

The key concept is the difference between class and individual characteristics. Most handguns and rifles have a rifled barrel: helical grooves that make the projectile spin around its axis to stabilize its flight. The number, width and twist direction (right or left) of the lands and grooves are class characteristics: they narrow down the possible makes and models. Individual characteristics come from the microscopic imperfections of each barrel, which engrave fine striations on every bullet fired through it. Cartridge cases carry their own marks: the firing pin impression on the primer, breech face marks, and extractor and ejector marks.

To link a bullet to a weapon, the examiner performs test shots with the suspect firearm (usually into a water tank, so the projectile is recovered undeformed) and compares the striations side by side using a comparison microscope. Philip Gravelle developed this instrument for firearms identification in the 1920s with the support of Calvin Goddard, who used it in the investigation of the 1929 St. Valentine's Day Massacre in Chicago. Today, automated systems such as IBIS (Integrated Ballistic Identification System) digitize these marks and search them against databases, so that cartridge cases from different scenes can be linked to the same gun. The United States has run such a network (NIBIN) since the late 1990s, and several countries have built their own, Brazil included (SINAB, since 2021).

The wounds also tell a story. The entrance hole is usually small, with inverted edges and surrounded by an abrasion ring, while the exit is usually larger and irregular. The range of fire is estimated from the secondary effects of the gases and powder that leave the barrel with the projectile:

Finally, there is gunshot residue (GSR), collected from the hands and clothes of suspects. Particles containing lead, barium and antimony (mostly from the primer) are characteristic, and they are commonly analyzed with scanning electron microscopy coupled with energy-dispersive X-ray spectroscopy (SEM-EDS). Revolvers usually release more residue toward the shooter's hand than pistols, and the grip and type of weapon matter, so a negative result does not exclude that a person fired a gun. Lead-free ammunition makes things even harder.

Fingerprints (friction ridge analysis)

Friction ridge analysis is the science of human identification through the ridges of the skin on our fingers, palms and soles. Poroscopy studies the sweat pores along the ridges and is useful when a fragment has too few ridge details.

Fingerprints work as an identification method because of a set of properties: persistence (they form during fetal life and last until the skin decomposes; the pattern does not change, it only grows), uniqueness (no two prints have ever been found to be identical, not even from identical twins), practicability (collecting them is cheap and easy) and classifiability (they can be organized into searchable files).

Before fingerprints, police relied on Alphonse Bertillon's anthropometry, a system of body measurements adopted in Paris in the 1880s. Francis Galton laid the scientific bases of fingerprint identification in his book Finger Prints (1892), and in Argentina, Juan Vucetich started the first fingerprint files in 1891, with his own classification system. In 1892, a bloody print identified Francisca Rojas as the murderer of her two children, the first criminal case solved by a fingerprint. Vucetich's system spread through Latin America, while Edward Henry's system (1900) was adopted by Scotland Yard and most of the English-speaking world. You may also have heard the story of Will and William West, two Leavenworth inmates (1903) with nearly identical names, faces and Bertillon measurements that only their fingerprints could tell apart.

Both systems classify fingerprints by their overall pattern, based on the deltas (the triangular areas where ridge systems meet) and the core (the center of the pattern):

Loops are by far the most common (roughly 60-65% of fingers), followed by whorls (30-35%) and arches (about 5%).

At a crime scene, prints can be patent (visible, deposited with blood, ink or paint), plastic (molded in soft materials such as wax or clay) or latent (invisible deposits of sweat and oils). Latent prints must be developed, and the technique depends on the surface: powders on smooth, non-porous surfaces; iodine fuming, which stains the print yellowish-brown without a chemical reaction; and, on porous surfaces such as paper, DFO (fluorescent) and ninhydrin (purple), which react with amino acids, followed by silver nitrate, which reacts with chlorides. The order matters, because some techniques destroy what others need. This is the same reasoning behind collecting the most volatile data first in incident response.

The comparison is based on the minutiae (also known as Galton points): ridge endings, bifurcations, dots, islands, enclosures and so on. Many countries traditionally require a minimum number of matching minutiae, often 12, in the same positions and with no unexplained discrepancy. Fingerprints are powerful, but not infallible: in 2004, the FBI wrongly identified the American lawyer Brandon Mayfield as the source of a print related to the Madrid train bombings, and it was the Spanish National Police who identified the real source.

Besides crime scenes, fingerprint examiners work on civil and criminal identification, postmortem fingerprinting (identifying unknown bodies) and, in some agencies, facial composites. And one important caveat: a latent print shows that a person was at the scene (or touched an object); by itself, it does not prove that the person committed the crime.

Forensic toxicology

Paracelsus said that "the dose makes the poison", and forensic toxicology is about finding out which substances were present, in which amounts, and whether they explain what happened. Mathieu Orfila, author of the Traité des poisons (1814), is considered the father of modern toxicology. In the famous Lafarge trial (1840), he showed that the initial analyses had been performed incorrectly and, using the Marsh test (1836), found arsenic in the body of Marie Lafarge's husband.

Today, forensic toxicologists work on postmortem cases (did a substance cause or contribute to the death?), cases involving living people (driving under the influence, drug-facilitated crimes, workplace testing) and, together with forensic chemistry, on seized drugs. The choice of specimen depends on the case:

Each matrix has its own detection window. Body fluids usually reveal use within the last few days (cannabis in chronic users being a notable exception), while hair, which grows roughly one centimeter per month, can tell a story of several months.

The analysis has two steps: a screening test, usually an immunoassay, quickly flags the samples, followed by a confirmation with a more specific technique, such as gas or liquid chromatography coupled with mass spectrometry (GC-MS and LC-MS/MS).

Postmortem samples have their own pitfalls:

Drugs of abuse are often classified by their effect on the central nervous system: depressants (such as alcohol), stimulants (such as cocaine) and hallucinogens (such as cannabis and LSD). Labs are also in an arms race against new psychoactive substances (NPS): synthetic drugs whose molecules are slightly modified to stay out of the lists of controlled substances.

Toxicology also meets traffic: most countries define a legal blood alcohol concentration for drivers, typically between 0.05 and 0.08 g/dL (some adopt zero tolerance), measured in blood or estimated from breath with an evidential breathalyzer.

Forensic handwriting examination

Handwriting examination is the branch of questioned document examination that compares handwriting and signatures to determine whether they are authentic and, when possible, who wrote them. Albert S. Osborn's Questioned Documents (1910) is a landmark of the field, and the French expert Solange Pellat summarized, in Les lois de l'écriture (1927), the "laws of writing" that still underpin the discipline:

  1. The graphic gesture is under the immediate influence of the brain. If you write with your other hand, your individual characteristics are still there.
  2. While writing, the "self" is in action, but its intensity varies: it is at its maximum where there is an effort to make (the beginnings) and at its minimum where the movement goes on by momentum (the endings).
  3. You cannot voluntarily change your natural handwriting without leaving in it the marks of the effort made to change it.
  4. When writing is particularly difficult, the writer instinctively uses the letter forms that are most habitual or simplest.

Examiners look at two groups of characteristics. Form (or pictorial) characteristics include size, spacing, alignment with the baseline, slant, proportions and the predominance of angles or curves. Movement characteristics are the dynamic ones, produced by the writer's motor habits: pen pressure, speed, how strokes start (initial strokes) and end (terminal strokes), the connections between letters and small details such as i-dots, accents and punctuation. A skilled forger can copy shapes, but movement is much harder to reproduce. That is why it carries the conclusion, while form only reinforces it. Line quality matters too: a natural stroke is fluent, with a natural variation in thickness, while a simulated one shows tremors, slowness, hesitation, unusual pen lifts and retouching.

The examination compares the questioned document with exemplars (known writing). Good exemplars must be authentic, comparable (similar instrument and conditions), contemporaneous with the questioned document (ideally within about two years) and plentiful (at least three, the more the better). Collected exemplars are documents written in the normal course of life; when they are not enough, the examiner may take request exemplars, having the person write a dictated text.

The main types of forgery are:

There are also frauds involving authentic signatures: auto-forgery (signing in a disguised way to deny it later), simulated forgery of one's own signature (adding tremors and retouches to it), transplants (reusing part of a genuine signature on another document) and the plain denial of authenticity.

Traffic crash investigation

A crash results from the combination of three factors: the human (training, attention, alcohol or drugs), the vehicle (pre-existing defects) and the environment (weather, road layout, signage and maintenance). The expert's job is to find objective evidence of how each of them contributed. Crashes are classified into types such as collisions between moving vehicles (head-on, rear-end, sideswipe and angle collisions), collisions with fixed objects or parked vehicles, rollovers (onto the side or onto the roof), pedestrian and animal strikes, falls from height and chain-reaction collisions.

The scene is extremely fragile. Traffic, onlookers and rescue teams move fragments and add new tire marks. On top of that, in many jurisdictions the law allows the first officer at the scene to have the injured and the vehicles removed from the road, before the scene examination, if they are blocking traffic. Rescuing victims is obviously the priority, but for vehicles this exception tends to become the rule. The main traces are:

More important than listing the traces is correlating them: which vehicle left that skid mark, which headlight that fragment came from. This must be done at the scene, not from photos or memory. Experts also prefer to talk about an area of impact instead of a "point of impact", because it is a region inferred from other traces (abrupt changes in skid marks, concentrated gouges), not a precise point. And, once again, Locard: the vehicle that touches is also touched.

The scene survey is usually done in three phases. First, the road and the final rest positions of the vehicles and traces, measured from two perpendicular fixed references and recorded in a scene diagram, together with the weather, grade, pavement type and road conditions. Second, the vehicles: identification, brakes, tires, lights and damage. Third, the people involved. Statements may guide the analysis when traces are scarce, but the reconstruction must be based on the physical evidence. A related area is vehicle examination, which inspects cars, boats and aircraft to assess their condition, damage and value, and to detect tampering, such as altered chassis and engine numbers.

Finally, an important lesson: speeding or a positive breathalyzer test, by themselves, do not make someone the cause of a crash. They matter if they were determining factors in its dynamics, and that is exactly what the expert report must establish. The same crash may also have administrative (fines), civil (compensation) and criminal consequences, which are independent of each other.

Conclusion

Digital forensics may look very different from a bloodstain on a wall, but the mindset is the same: preserve, document, analyze with a sound method and only conclude what the evidence supports.