Forensics: Trace evidence

No Trace Project > Threat Library > Techniques > Forensics > Trace evidence

Trace evidence is the small fragments of physical evidence that are transferred between objects, people, and the environment. Trace evidence can be collected and analyzed to establish links between objects, people, and places.

Trace evidence can be:

• Fragments of matter. For example, mud on the sole of a shoe or shards of glass from a broken window.
• Impressions left when two surfaces come into contact. For example, a shoeprint in the mud or a cut made by a bolt cutter in a fence.

Trace evidence can be transferred:

• With contact. For example, clothing touches a fence and fibers from the clothing transfer to the fence.
• Without contact. For example, a window is broken and shards of glass fly away and transfer to the clothing of people nearby.
• Through a chain of transfers, with and/or without contact.

An adversary can use trace evidence to:

• Analyze a trace from an action site to obtain useful information. For example, they can analyze a shoeprint found at an action site to determine the size and model of the shoe that left it, and then search for people who possess shoes of that size and model.
• Link a trace from an action site to an object. For example, they can determine whether textile fibers found on a fence at an action site likely come from clothing that they seized from your home during a house raid.
• Link a trace from an object to an action site. For example, they can determine whether shards of glass found on your clothing during your arrest likely come from a window that was recently broken nearby.
• Link traces from different action sites. For example, they can determine whether hammer marks found at different action sites were left by the same hammer, and therefore the actions were likely carried out by the same people.

Trace evidence does not include fingerprints and DNA, which are considered separate forensic disciplines.

When an object made of textile fibers — clothing, a bag, etc. — touches a surface, it can leave fibers on the surface. The likelihood that an object leaves fibers on a surface and the amount of fibers left depend on the object, the surface, and the duration and type of contact between the two.

An object made of textile fibers can leave more or less unique fibers, depending on the object and its manufacturing process. For example:

• A worn wool sweater of an uncommon color, manufactured in an uncommon way, may leave a large amount of relatively unique fibers.
• A new nylon windbreaker of a common color, manufactured in a common way, may not leave any fibers, or only very generic ones.

An adversary can:

• Analyze fibers to determine the type of object that left them and, in some cases, its make and model.
• Compare fibers to an object in their possession to determine if the object could have left the fibers.
• Compare two sets of fibers to determine if they could have been left by the same object.

See Handbook of Trace Evidence Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it., chapter “Fibers” for an overview of fibers.

When you are barefoot and your feet touch a surface, you can leave footprints on the surface. You usually leave footprints on the insoles of the shoes you wear. You can leave footprints when you are wearing socks.

A foot can leave a more or less unique print, depending on the foot and the surface. For example:

• On a hard, dusty surface, a foot may leave a very unique footprint that shows the ridges of the toes, which are as unique as fingerprints.
• On a soft surface such as sand, a foot may leave a very generic footprint that shows only a rough outline of the foot.

An adversary can:

• Analyze a footprint to obtain information about the person who left it, such as the size of their feet, an estimate of their height, and what they were doing when they left the footprint — standing, walking, running, turning around, etc.
• Compare a footprint to a foot to determine if the foot left the footprint.
• Compare two footprints to determine if they were left by the same foot.

See Examination and Interpretation of Bare Footprints in Forensic Investigations for an overview of footprints.

When you wear shoes and your feet touch a surface, you can leave shoeprints on the surface.

A shoe can leave a more or less unique print, depending on the shoe and the surface. Even mass-produced shoes of the same model vary slightly due to irregularities in the manufacturing process and to wear patterns. For example:

• On a clean wooden floor, a worn, dirty shoe may leave a very unique print.
• On a carpet, a new, clean, dry shoe may not leave a print, or only a very generic one.

An adversary can:

• Analyze a shoeprint to determine the size and model of the shoe and to obtain information about the person who left it, such as the size of their feet and an estimate of their height.
• Compare a shoeprint to a shoe in their possession to determine if the shoe left the shoeprint. To do this, they can use the shoe to make reference prints and compare them to the suspect shoeprint.
• Compare two shoeprints to determine if they were left by the same shoe.

See Footwear Impression Evidence: Detection, Recovery and Examination ?This is a link to the Surveillance Archive. Use Tor Browser to access it. for a comprehensive overview of shoeprints.

Tools — bolt cutters, scissors, hammers, screwdrivers, etc. — can leave marks on the objects they are used on.

A tool can leave a more or less unique mark, depending on the tool, how it is used, and on the surface. Even mass-produced tools of the same model vary slightly due to irregularities in the manufacturing process and to wear patterns. For example:

• A worn metal hammer used to forcefully strike a metal plate made of a softer metal may leave a very unique mark.
• A brand new bolt cutter used to cut a fence may leave a relatively generic mark.

An adversary can:

• Analyze a mark to determine the type of tool that left it.
• Compare a mark to a tool in their possession to determine if the tool left the mark. To do this, they can use the tool to create reference marks and compare them to the suspect mark.
• Compare two marks to determine if they were left by the same tool.

See also:

• PRISMA, section “Tool Traces” for a short discussion of tool marks.
• Color Atlas of Forensic Toolmark Identification ?This is a link to the Surveillance Archive. Use Tor Browser to access it. for a comprehensive overview of tool marks.

When glass breaks, it produces shards of various sizes.

A glass object (e.g. a window, a bottle) produces more or less unique shards when broken, depending on how, where and when it was manufactured. For example:

• Two glass objects of different models, or manufactured in different factories, or manufactured in the same factory several weeks apart, may produce shards that can be distinguished by analyzing their properties, including their refractive indices^[1] and chemical elements.^[2]
• Two glass objects of the same model, manufactured in the same factory during the same week, may produce shards that are indistinguishable.

An adversary can compare two shards of glass to determine the likelihood that they come from the same object.

See Handbook of Trace Evidence Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it., chapter “Interpretation of Glass Evidence” for an overview of glass evidence.

Traces of accelerant are covered in the technique Forensics: Arson.

Other types of trace evidence include:

• Human and animal hair. Hair can fall from a body at any time. Hair can reveal various information about its owner, including, in some cases, their DNA. See Handbook of Trace Evidence Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it., chapter “Forensic Hair Microscopy” for an overview of hair.
• Paint. A painted object can leave traces of paint on a surface it touches. A trace of paint can reveal information about the object that left it. See Handbook of Trace Evidence Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it., chapter “Paints and Polymers” for an overview of paint.

Used in tactics: Incrimination

Mitigations

Name	Description
Anonymous dress	An adversary can use trace evidence to link clothing to an action site. To mitigate this, you can dress anonymously, and in particular dispose of the clothing after the action.
Anonymous purchases	An adversary can use trace evidence to link objects to an action site. To mitigate this, you can anonymously purchase objects used in the action.
Careful action planning	An adversary can use trace evidence to link objects to an action site. To mitigate this, after the action, you can plan to: Dispose of the objects you used during the action. If an object is too expensive to discard after each action, store it in a stash spot or safe house. If a tool is too expensive to discard after each action, modify it so that an adversary cannot link it to traces it may have left at the action site. For example, you can dispose of the disc of a disc cutter.
Stash spot or safe house	An adversary can use trace evidence to link objects to an action site. To mitigate this, after the action, you can store in a stash spot or safe house objects used in the action that are too expensive to discard after each action.

Used in repressive operations

Name	Description
December 8 case	During the raids, several objects (a stove, pans, gloves, spatulas) were analyzed for traces of products that could be used to create explosives.[3]
Case against Jeff Luers	In the raid of the storage unit, the police found a bolt cutter matching the cuts in the fence surrounding the site of the May arson attempt.[4]