The Investigation Process Research Resource Site
A Pro Bono site with hundreds of resources for Investigation Investigators
Home Page Site Guidance FAQs Old News Site inputs Forums
. . . .. . . . . . . . last updated 3/25/07


to advance the
State-of-the-Art of
investigations, through
investigation process

Research Resources:

Search site for::

Launched Aug 26 1996.



Incident Investigation Evidence Management
Learning From Incidents


Jack Philley, CSP, Baker Engineering and Risk Consultants, Inc.


1.      Abstract

This paper presents practical lessons learned from incident investigation physical evidence gathering, management, documentation, and analysis experiences. Evidence provides the foundation for successful identification of underlying root causes of incidents. Process safety events are sometimes accompanied by severe consequences, and much of the evidence that might otherwise be available has been destroyed by the event. Evidence management is also critical in litigation and forensic concerns.  This presentation provides an overview of physical evidence issues associated with major process safety incidents, such as fires, explosions and releases of hazardous materials. Potential sources of useful evidence are addressed as well as the initial reconnoiter, chain-of-custody, photography, evidence storage, and the significance of gathering information on position evidence. There are a few simple measures that investigators can take to prevent or minimize evidence spoilage to help ensure successful identification of the underlying causes of the incident. This presentation includes a summary of evidence analysis methods and resources. Although the primary focus is on major catastrophic process related events, the majority of information is also applicable to events with less severe consequences.

2.      Intro / Overview

This paper presents an overview of physical evidence collection, management, and analysis issues associated with investigating chemical process incidents. As is the case for most investigation functions, evidence collection and analysis is an iterative activity. For optimum results, a formal system of evidence management is necessary. The validity and value of the investigation results are a direct reflection of the evidence examined by the team. 


Many chemical process incidents, (such as fires, explosions and releases of hazardous material) present significant physical evidence challenges. The facility may be significantly damaged and critical evidence may no longer exist or may not be initially available to investigators. In some instances, the starting point may be a crater. Regulatory agencies such as Occupational Safety and Health Administration, Federal Bureau of Investigation, US Coast Guard, Environmental Protection Agency, Alcohol Tobacco & Firearms, or Fire Marshal may have total control of the site, and owner representatives may be prohibited from entry. Evidence management is also critical in litigation and forensic concerns.  In the United States, the site for many chemical process incidents is declared an uncontrolled hazardous waste site under the OSHA 1910.120 subpart (q) regulation and certain access controls and actions become mandatory. In some instances, third party legal (or insurance company) representatives may file legal action prohibiting the owner from taking any action that could disturb potential evidence, thereby obstructing any evidence gathering activity.


This presentation focuses on physical evidence issues related to non-criminal incidents. While evidence from witnesses is an important aspect of investigation, it is not included in the scope of this paper.


The starting point for process safety investigations can be challenging.  In many cases the plant infrastructure is severely damaged. Normal utilities and services are unavailable, such as electrical power, telephones, and radio communication systems. In large facilities, the undamaged portions of the plant will be demanding permission to resume operations. Important witnesses who were on duty at the time of the incident may not be available to the investigation team due to injuries or may be at home recovering from extended hours spent in the initial emergency response activities.  The authority in control of the accident scene may be confusing or inconsistently understood at times.  Communications channels and information flow immediately after the emergency response phase are most often uncoordinated, fragmented and inconsistent.


Physical evidence gathering, handling, management, and analysis should follow accepted systematic scientific methods and should be reproducible where applicable. Evidence analysis calculations, tests, assumptions, and stipulations should be thoroughly documented. When determining the causes of the incident, the speculated cause scenarios should be generated based on the available evidence.   It is a recognized mistake to selectively consider only evidence that supports a preferred scenario, while ignoring evidence that may point to other causes. 


There are several recognized categories of evidence.

÷   People (eyewitness & personal knowledge)

÷   Physical evidence (parts, things, equipment)

÷   Electronic

÷   Paper documents (historical, drawings, specifications)

÷   Position / configuration

÷   Process parameters and conditions

÷   Physical properties and characteristics


In the most severe explosion cases, a substantial portion of a process unit may be completely destroyed with only a crater remaining in the location of the equipment.  Fragments and debris can be thrown considerable distances, sometimes outside facility boundaries.  In many instances, sampling will be necessary to evaluate potential exposures to investigation personnel (asbestos, volatile organic compounds, blood borne pathogens and others). The default position of many regulatory agencies is to assume the area is hazardous until it can be proven that no hazard exposures continue to exist.  The burden of proof falls on the owner to verify the incident scene is safe.


For explosions, the damage itself may function as a blast gage if the properties of the buildings and structures are known. The end use of the evidence collection may include:

÷   Calculating blast pressures and impulses at each damaged structure.

÷   Generating pressure contours.

÷   Calculating the explosion energy released.

÷   Determining the type of explosion.

÷   Determining the source of the explosion.

3.      Potential Sources Of Physical Evidence

Depending on the type and nature of the event, evidence prospecting may be required across a wide variety of potential venues. Location and relative position of physical evidence should be documented and in many instances, photographed in place before being moved. A special type of information highly useful is the "as found" position of valves, switches, control devices, or sequence indicators. Previous incident reports and reports of process hazard analysis studies can provide insight as to credibly possible failures and accident scenarios. Operating data such as logbooks, computer records, Process Flow Diagrams, and Piping and Instrumentation Diagrams are potentially very useful documents. Engineering files, inspection records, and repair files contain valuable information on the construction and features of fixed equipment. Management-of-Change records can provide information related to modifications that may not be reflected on equipment and system drawings. Score, scratch and impact marks made by moving objects can be helpful[1]. Typical sources of evidence for chemical process incidents are listed in Table 1.

Table 1. Potential Sources of Evidence

Operating data (computer log, alarms, charts)

P&ID drawings

Lab results

Instrument loop diagrams

Instrumentation Interlock drawings

Instrumentation Ladder logic diagrams

Operating Manuals

Training Manuals

Material Safety Data Sheets


Management of Change records

Inspection records

Repair records

Meteorological records

ManufacturerĂs bulletins and Original Equipment Manufacturers Manual

Retainer Samples of shipments and incoming raw materials

¦As-found" position of valves, switches, & indicators

Rupture disk condition

Anomalies in damage (or non-damage)

Residual liquids

Scorch pattern

Smoke traces

Melting pattern

Missile mapping

Layering of debris

Direction of glass pieces

Analysis of undamaged areas & equipment


Metallurgy analysis

Fracture analysis

Conductivity testing

Security camera tapes

Previous Process Hazard Analysis study reports

Material balances

Chemical reactivity data

Corrosion data      

Prior incident reports




4.      Time Sensitive Physical Evidence

Some physical evidence is extremely time-sensitive and requires top priority in the initial stages of the investigation. Physical evidence degrades with time (examples include: fracture surfaces, dust and soot samples, residual liquids, and charts, logs and other paper records that are exposed to the elements). Availability and integrity of electronic process data can be impacted by the loss of normal or back-up electrical power.  Digital evidence is fragile by nature. Perhaps the single most important issue related to collecting digital evidence is securing the media where the digital evidence exists[2].  Digital data can be irreversibly corrupted due to loss of electrical power or uncoordinated attempts to reboot a system.


Some aspects of offsite physical evidence can be extremely time sensitive, and the owner usually does not have control of these offsite activities. Temporary repairs may be needed to damaged homes. Cleanup of streets and removal of hazardous offsite debris (broken glass and metal shards for example) may need to be completed to prevent additional injury.  Access to offsite evidence and restoration of offsite damage is not in the control of the chemical process facility owner.


Documentation of the extent of damage and necessary temporary repairs are high priority evidence issues. Within the plant or facility boundaries, evidence collection requires notification and coordination of all employees to minimize loss or inadvertent alteration of the physical evidence. Evidence may be spread over a large area, and all personnel within the plant should be instructed on the proper manner to communicate the location of evidence for collection by a trained team. Collection of chemical samples from vessels that are open to the atmosphere is a high priority activity.  This will ensure the sample is as representative as possible and will minimize adverse impacts from exposure to the elements (evaporation, moisture and others). Some evidence may be located in access ways and other places that need to be cleared quickly, and these areas may need to be placed on the high priority list.

5.      Hazard Exposures To Evidence Gatherers

Field investigation activities are often conducted in less than ideal circumstances. Investigators can be exposed to a variety of hazards. One of the most common hazards is the constant potential for slips, trips, or falls created by unstable working and walking surfaces. Accident scenes are frequently populated by sharp metal edges from debris and broken glass. Investigators can be injured by debris falling from above that becomes unstable by vibration or shifting rubble piles.


Hazard exposures include radiation from nuclear instrumentation devices, and stored potential energy in the form of hydraulics, pneumatic, spring energy and elevated mass. One of the initial tasks conducted by emergency response personnel is isolation of all known sources of electrical energy and fuel. The investigation team should conduct an independent verification that all electrical power and interconnecting piping (gas pipelines for example) are isolated, deenergized where appropriate, and secured against unauthorized operation.  It is not uncommon to find energized electrical circuits that were installed during construction and are not accurately depicted on electrical power distribution documents. Airborne contaminates from uncontrolled releases of process materials represent another potential hazard exposure. The team may need to conduct sampling to assess the need for additional cleanup or use of personal protective respiratory equipment.


During the investigation, team members will often have need to access elevated or constricted space to make observations or gather evidence. Access to elevated locations may have to be made by crane basket or special scaffolding. Team members may need to be competent in the use of fall protection devices. In major accidents, the investigators may be exposed to biohazards. As mentioned earlier in Section 2, the site may be classified and an uncontrolled hazardous waste site, therefore, the team may need to implement OSHA 1910.120 Hazardous Waste and Emergency Response control measures. Regardless, the investigation team should be prepared for emergencies that could occur during the course of the investigation, such as releases of materials or injuries to team members. It is a good practice to implement emergency alarm, alert and communication capabilities and procedures for the investigation team.

6.      Evidence Collection And Management

One important activity is the initial visit to the scene. An effective technique for conducting this important event is the Initial Reconnoiter. The objective of this activity is to gain an overview of the entire incident scene before becoming overly focused on the apparent center of the event. The investigator (or in some cases the entire investigation team) conducts a slow, deliberate and systematic circuit from outside the accident scene.  During this circuit the investigator should:

÷   Look for potential safety hazard exposures to the investigation team.

÷   Look at the big picture, not just the micro (trees).

÷   Note what is not damaged.

÷   Use all senses (smell, sounds, physical sensations of pressure, heat, vibration).

÷   Make intentional pauses to observe the scene from multiple angles and elevation.


For major chemical process incidents, evidence preservation, storage, and management is required. Effective collection and analysis of physical evidence should be conducted in a systematic fashion. All potentially important fragments, debris, and other physical items should be documented in place (by photography or other means) before being moved or disturbed in any manner, noting the location and orientation. It is standard practice to assign individual evidence numbers to each piece of physical evidence collected. In most instances, small items are placed in clear plastic bags[3]. 


A formal chain-of-custody system is developed and implemented to track the status of, and access to, any evidence not retained in the custody of the incident investigation team. Disassembly of equipment should be documented with photography and annotated at each significant stage. Long-term storage of physical evidence may be required for investigations that involve potential litigation. It is important to arrange for secure storage, restricted access, and chain of custody management for items that may be retained long after the initial investigation team has concluded its work[4]. Regulatory agencies and other third parties may have need for copies of documentation as well as samples, photographs, and portions of physical evidence. It is important to manage the distribution copies of documents and other evidence in order to avoid unnecessary confusion and differences in interpretation of document evidence.



In most cases, it is necessary to handle physical evidence at some point in the investigation.  Any time physical evidence is moved or disturbed, there is opportunity for evidence spoliation. Evidence spoliation is defined as ¦Significant and meaningful alteration"[5], and this term is very broadly interpreted by some courts.  In some instances, potential spoliation can become a major litigation concern. It is a good practice to provide advance notice to all potentially interested parties whenever a major piece of evidence is scheduled to be moved or when there is a plan for sampling of remaining materials. In some instances the actual sampling is video taped and samples split among interested parties, with a retain sample kept for future reference.

7.       Evidence Photography

Investigation photography (and video) has multiple purposes. It is most often used to document the "as found" position, location, configuration arrangement, damage pattern, and layering of physical evidence. In addition, photographic evidence is often useful in presenting the results of the investigation (reports) and in distributing lessons learned (training). Photographs taken by the investigation team find application in evidence analysis and in litigation activities. Photographs can be taken of items that need to be moved or of items and conditions that might change over the course of the investigation. Promptness is important since no accident scene can be considered frozen in time. In most instances, the investigation team should generate a formal log that includes each image, indicating the date, time, identity of the photographer, and intended purpose or contents of the image. If multiple copies are distributed, there should be a record of the distribution. Some investigators have found it helpful to document the view of each significant witness by going to the location of the witness and recording what the witness was able to see from his position. A general rule used by most investigators is to consider every photograph to be discoverable in the event of a lawsuit.


Conventional 35 mm photography, digital photography, instant print, and video images all have a place in the investigation process. In some instances, the use of a professional photographer may be appropriate, however in most instances, photography will be done by investigation team members. It is important to capture a series of overall orientation views from multiple perspectives and from multiple distances. These views will significantly enhance the value of subsequent photos that are taken from a closer distance.  A sometimes-used resource for video is news media footage taken during the incident. This un-edited footage is available directly from the TV station and can provide clues related to the sequence of the event.


All photographic equipment will require perishable batteries that have, in some cases, unpredictable battery life. It is a good practice to implement a system to ensure that spare batteries are available and that periodic battery change-out and recharging occurs. Photographic film is date sensitive and in addition, can be adversely affected by airport security screening devices. It is a recognized best practice to provide special x-ray resistant film carrying bags. Storage of electronic digital images needs to be managed, with master copies or back-up copies maintained in a controlled manner. Autofocus systems have several undesirable features that can cause unintended results. The color black is invisible to most autofocus systems since they operate in the InfraRed range and therefore, black (or burnt) objects may be out of focus. When shooting through a clear surface such as a window, the camera may focus on the window itself and cause items on the far side of the window to be out of focus.


Photography can present hazards to investigators. The view through the lens is restricted and the photographer may not be aware of tripping and falling hazards. Photographic and flash equipment devices are not designed for use in potentially flammable vapor conditions and require precautions similar to those used for any potentially spark producing tool or piece of equipment. Good practices for investigation photography include:

÷   Taking multiple orientation views from different positions and distances.

÷   Placing an object of known size in the picture.

÷   Being aware of potential shadows that will be cast by the flash unit.

÷   Managing spare battery supply.

÷   Generating a detailed log of all photographs.

÷   Managing and documenting distribution of duplicate copies.

8.      Evidence Analysis

Evidence analysis can provide objective and scientific independent confirmation of the cause scenario speculated by the investigation team. Damage patterns provide information related to the origin and sequence. Investigators can also make useful determinations based on anomalies and by analyzing what remains undamaged. Experienced investigators ask the questions:

÷   ¦What is present that would not be expected to be present?" and the companion question,

÷    ¦What is absent that would be expected to be present?"

÷   ¦What was different in this instance, why did the incident happen this time and not previously?"


There are numerous publicly available resources for evidence analysis, including physical property data for melting temperatures, autoignition temperatures, and chemical incompatibilities. Some methods are non-destructive (Non Destructive Evaluation [NDE]), while others require permanent modification of the evidence.  Visual examination is the most common and one of the most powerful evidence analysis techniques. NDE Integrity testing can include leak checking, x-ray radiography, ultrasonic thickness testing, physical measurements, magnetic particle testing, and others. Two useful references are the National Fire Protection Association standards # 921 for Fire and Explosion Investigations and # 907 Determining Electrical Fire Causes[6].  Although these two references are prepared for use primarily by municipal fire protection agencies and organizations, they do contain information helpful to industrial investigators. For example, tables from NFPA 921 present autoignition (Table 3.3.4) and melting (Table 4.8) temperatures for specific commercial materials. NFPA 921 also includes an interesting section on Human Response to Fire (Chapter 8), interview techniques, and helpful information on preparing sketches and diagrams. Another useful reference in fire and explosion evidence analysis is the Materials Technology Institute Publication 30, Guidelines for Assessing Fire and Explosion Damage[7]. This publication uses a temperature profile to assist in determining fire cause and origin.


The technical disciplines of structural analysis, dynamic structural analysis, and finite element analysis are powerful tools to study complex response modes. Permanent deformation is used as a ¦blast gage".  The amount of deformation is measured and compared to the expected properties of the material and type of construction configuration. This information is then used to develop a pressure-impulse diagram to estimate the forces experienced on the structure or structural member being analyzed.


Metallurgical and failure analysis of evidence, fractured physical evidence, and failed equipment can provide valuable information regarding the nature, sequence, and cause of the incident. The mode of fracture (ductile or brittle) can indicate pressure and impulse forces. The direction and style of crack propagation is often helpful. Metallurgical analysis can help determine the age, origin, and reason for the failure. Cause and type of corrosion attack can be determined and can provide evidence of contaminants or corrosion  not expected to be present. Temperature at time of failure can be determined. The actual fracture pattern can provide an indication of the conditions at the time of failure.


There are several types of chemical analysis techniques that can be helpful in identifying the cause and sequence of the event. Chemical analysis can be conducted to confirm or refute the presence of compounds, substances, trace impurities, or gross contaminants. Retained samples of raw materials and final products are often re-analyzed to help refute a lower probability scenario. Residues remaining after a fire can still provide useful chemical evidence. Physical property testing is useful in analyzing or confirming potential fire, reactivity, stability, solubility, or contamination concerns. Gas chromatography and Scanning Electron Microscopy (SEM) are two common methodologies.


Arson is a special case and in many instances, will leave tell-tail unique evidence. Most fire departments, law enforcement agencies, and insurance companies have in-house experts available to assist if there is a suspicion of malevolent action. There are well-established char and burn patterns for most common building materials and components that can indicate the nature of the fire[8]. Arson investigators look for atypical patterns and the presence of accelerators and ignition devices.


A discussion of analysis of damage patterns is beyond the scope of this overview presentation, however, the following examples and resources are offered. NFPA 921 Standard contains significant information related to damage criteria for a variety of topics. Table lists typical damage effects caused by various overpressure conditions on typical building components. Melting, boiling, and autoignition temperatures for many substances are included in NFPA 921. By noting the melting patterns and char depth, the investigation team has an opportunity to generate temperature profiles of a fire scene. Smoke trace patterns, scorch and heat distortion patterns are very helpful to fire investigators. The size and location of fragments provides valuable clues to determining the source of an explosion. Missile mapping is one technique to evaluate explosion damage. Each fragment is plotted with distance traveled and mass of the fragment considered when estimating the amount of energy released. NFPA 907 provides a guide for determining electrical causes and includes information on examining and analyzing the end segments of wiring components to assist in identifying causes.

9.                 Closing Comments

             Since evidence provides the foundation for understanding the event scenario and discovering the underlying causes, it is necessary that evidence collection and management be conducted in a systematic fashion, with careful documentation.  For major incidents, exercising good evidence management practices can return substantial benefits and avoid unnecessary consequences.  Systematic management of physical evidence can also minimize litigation challenges to the credibility, integrity and accuracy of the investigation findings.

11.             References

[1] ¦Guidelines for Investigating Chemical Process Incidents", 2nd edition, 2003, Center for Chemical Process Safety, American Institute of Chemical Engineers, NY, NY, ISBN 0-8169-0555-X

[2] Laykin, Erik, ¦What are the first steps in securing digital evidence? Online Security Inc, International Business Law Services, Irvine CA

[3] ¦Fire and Arson Scene Evidence: A Guide for Public Safety Personnel", National Institute of Justice Report NCJ 181584, June 2000, US Department of Justice, Washington DC

[4] ¦A Guide for Explosion and Bombing Scene Investigation" National Institute of Justice Report NCJ 1818679, June 2000, US Department of Justice, Washington DC

[5] Teig, Joe ¦Preserving Evidence of Disaster", Holland and Hard, Jackson, WY

[6] National Fire Protection Association "¦Standard 921 Investigating Fires and Explosions" NFPA Batterymarch Ave, Boston MA

[7] ¦Guidelines for Assessing Fire and Explosion Damage" MTI Publication 30, 1990, Materials Technology Institute of the Chemical Process Industries, Cortest Labs, Cypress, TX 77429

[8] Redsicker, D.R. and OĂConnor J.J., ¦Practical Fire and Arson Investigation", 2nd Edition, 1997, CRC Press, New York, NY, ISBN 0-8493-8155-X