Forensic knowledge

Key principles

• ▸Scene cordoning, spiral and grid search patterns
• ▸Photography triad: overall, mid-range, close-up with scale
• ▸Packaging: paper for biologicals, never polythene
• ▸Chain of custody begins at first responder, not at the lab

Investigative workflow

1. 01Secure the perimeter and establish a single common approach path
2. 02Record the initial scene: notes, photographs, video, sketch with measurements
3. 03Systematic search — spiral, strip, grid or zone depending on terrain
4. 04Collect from most fragile to most durable, each item packaged separately
5. 05Seal, label, sign and log every exhibit into the chain-of-custody register

Common pitfalls

• ✕Entering before photographing creates contamination that cannot be undone
• ✕Wet biological evidence sealed in plastic grows mould and destroys DNA
• ✕Unlogged personnel on scene become defence arguments at trial

Terms to know

Locard's exchange principle

Every contact leaves a trace — transfer runs both ways.

Primary vs secondary scene

Where the offence occurred vs where evidence later travelled.

Chain of custody

Unbroken documented possession from recovery to court.

Key principles

• ▸Patterns: loops (~60–65%), whorls (~30–35%), arches (~5%)
• ▸Level 2 minutiae — bifurcations, ridge endings, islands
• ▸Development: powder, ninhydrin (porous), cyanoacrylate (non-porous)
• ▸ACE-V methodology: Analysis, Comparison, Evaluation, Verification

Investigative workflow

1. 01Assess the substrate — porous, non-porous or semi-porous decides the technique
2. 02Develop: powder or cyanoacrylate fuming on non-porous, ninhydrin or DFO on porous
3. 03Photograph in situ with a scale before lifting
4. 04Compare against known exemplars or an AFIS database search
5. 05Independent verification by a second examiner before any conclusion is reported

Common pitfalls

• ✕Over-powdering fills ridge valleys and destroys usable detail
• ✕Confirmation bias when the examiner already knows the suspect's identity
• ✕Treating an AFIS hit as an identification rather than as a candidate list

Terms to know

Latent print

Invisible deposit of sweat and oils needing development.

Minutiae

Ridge endings, bifurcations and dots used for comparison.

ACE-V

Analysis, Comparison, Evaluation, Verification.

Key principles

• ▸Order of volatility: registers → RAM → disk → archives
• ▸Write blockers and hash verification (SHA-256) before analysis
• ▸Artefacts: registry hives, prefetch, browser cache, log timelines
• ▸Mobile: logical vs physical vs file-system extraction

Investigative workflow

1. 01Isolate the device — airplane mode or a Faraday bag to stop remote wipes
2. 02Capture volatile memory first if the system is running
3. 03Image the storage through a write blocker; hash before and after
4. 04Analyse the working copy only, never the original evidence drive
5. 05Build a timeline correlating file system, registry, log and network artefacts

Common pitfalls

• ✕Booting the suspect machine alters timestamps and can trigger anti-forensics
• ✕Missing hash values leave the acquisition open to a tampering challenge
• ✕Ignoring cloud-synced data that lives outside the seized device

Terms to know

Write blocker

Hardware or software preventing any write to source media.

Hash value

SHA-256 fingerprint proving image integrity.

Slack space

Unused area of a cluster that can retain deleted data.

Key principles

• ▸Screening by immunoassay, confirmation by GC-MS / LC-MS/MS
• ▸Specimens: blood, urine, vitreous humour, hair for chronic exposure
• ▸Post-mortem redistribution can inflate drug concentrations
• ▸Preservatives: sodium fluoride to arrest alcohol fermentation

Investigative workflow

1. 01Collect specimens with the correct preservative and record collection time
2. 02Presumptive screening across broad drug classes
3. 03Confirmatory analysis by a second, chemically independent technique
4. 04Quantify against calibrated standards with quality-control samples
5. 05Interpret against pharmacokinetics, tolerance and scene circumstances

Common pitfalls

• ✕Reporting a screening result as a confirmed finding
• ✕Ignoring post-mortem redistribution in heart-blood samples
• ✕Cross-reactivity in immunoassays producing false positives

Terms to know

Half-life

Time for blood concentration to fall by half.

Vitreous humour

Eye fluid resistant to putrefaction, useful post-mortem.

LC-MS/MS

Confirmatory technique separating and identifying by mass.

Key principles

• ▸Class characteristics: calibre, rifling count, twist direction
• ▸Individual marks: striations, breech-face, extractor, ejector
• ▸GSR analysis by SEM-EDX for lead-antimony-barium particles
• ▸Range estimation from powder tattooing and soot patterns

Investigative workflow

1. 01Render the weapon safe and document its condition before handling
2. 02Record class characteristics of recovered bullets and cases
3. 03Test-fire into a recovery tank to produce known standards
4. 04Compare under a comparison microscope for individual toolmarks
5. 05Reconstruct trajectory and range from wound and scene evidence

Common pitfalls

• ✕Handling GSR-bearing hands or clothing without protection destroys particles
• ✕Assuming calibre alone identifies a weapon
• ✕Confusing soot deposit (close range) with dispersed powder tattooing

Terms to know

Rifling

Spiral grooves imparting spin, leaving lands and grooves on bullets.

GSR

Gunshot residue — characteristic lead, antimony and barium particles.

Stippling

Punctate skin marks from unburnt powder at close range.

Key principles

• ▸Compare natural variation, not superficial similarity
• ▸VSC examination for erasures, obliterations and indented writing
• ▸ESDA lifts impressions from underlying sheets
• ▸Ink dating by TLC and solvent-loss ratio

Investigative workflow

1. 01Obtain adequate contemporaneous known standards, requested and collected
2. 02Examine the questioned document non-destructively first — magnification, oblique light, VSC
3. 03Compare individual habits: letter design, connections, spacing, pen lifts
4. 04Recover indented writing with ESDA before any chemical treatment
5. 05Report a conclusion on a defined opinion scale, not a bare yes/no

Common pitfalls

• ✕Too few or non-contemporaneous exemplars
• ✕Mistaking natural variation for evidence of forgery
• ✕Destructive ink testing before all non-destructive work is complete

Terms to know

Line quality

Smoothness and pressure pattern revealing writing fluency.

ESDA

Electrostatic device revealing indentations from a removed sheet.

VSC

Video spectral comparator using IR and UV to expose alterations.

Key principles

• ▸Organised vs disorganised offender typologies
• ▸Victimology as the entry point of any profile
• ▸Cognitive interview over accusatorial interrogation
• ▸Competency and insanity evaluations in the legal frame

Investigative workflow

1. 01Establish the referral question — competency, risk, profile or credibility
2. 02Build victimology: routine, relationships, vulnerability, last known movements
3. 03Analyse scene behaviour: modus operandi versus signature
4. 04Use structured instruments rather than clinical impression alone
5. 05Write an opinion that states its limits and the data it rests on

Common pitfalls

• ✕Presenting a profile as identification of a specific individual
• ✕Accusatorial interviewing producing false confessions
• ✕Ignoring cultural and language factors in assessment

Terms to know

Modus operandi

Learned behaviour needed to commit the offence; it evolves.

Signature

Psychological need expressed at the scene; it stays stable.

Staging

Deliberate alteration of a scene to mislead investigators.

Key principles

• ▸Fraud triangle: pressure, opportunity, rationalisation
• ▸Placement → layering → integration in laundering
• ▸Benford's Law as a first-pass anomaly screen
• ▸Digital trails: UPI velocity, mule accounts, crypto mixers

Investigative workflow

1. 01Map entities, accounts and beneficial ownership before touching transactions
2. 02Reconcile ledgers against bank statements and source documents
3. 03Run anomaly screens: duplicate vendors, round-sum entries, off-hours postings
4. 04Trace fund flow across accounts and jurisdictions into a single timeline
5. 05Quantify loss and preserve the digital and documentary evidence trail

Common pitfalls

• ✕Analysing summary reports instead of source-level transaction data
• ✕Missing related-party transactions hidden behind shell entities
• ✕Alerting the subject early and enabling record destruction

Terms to know

Layering

Rapid transfers designed to break the audit trail.

Round-tripping

Funds returning to origin through intermediaries to fake turnover.

Mule account

Third-party account used to receive and forward criminal proceeds.

Key principles

• ▸Admissibility, relevancy and expert opinion of examiners
• ▸Search, seizure and mandatory documentation requirements
• ▸Rights of the accused during investigation and trial
• ▸Certification requirements for electronic records

Investigative workflow

1. 01Confirm lawful authority for search, seizure or interception
2. 02Document seizure with independent witnesses and a signed memo
3. 03Authenticate electronic records with the required certificate
4. 04Disclose methodology, limitations and error rates in the expert report
5. 05Prepare testimony that survives cross-examination on procedure, not just science

Common pitfalls

• ✕Gaps in custody documentation that invite an adverse inference
• ✕Expert opinions stated beyond the witness's demonstrated expertise
• ✕Electronic evidence tendered without the statutory certificate

Terms to know

Admissibility

Whether the court may consider the evidence at all.

Expert opinion

Opinion evidence permitted on specialised subject matter.

Panchnama / seizure memo

Contemporaneous witnessed record of what was seized and how.