Skip to content

Seeing past the scene

A crime scene investigation turns a place, a body of traces and a stream of statements into an account that can be tested in court. This analysis reviews how scene investigation and the major investigation around it are organised, which visual tools investigators, forensic scientists and analysts use along the way, which information and elements matter, and why teams struggle to distil insight from what they collect. It then reads that practice for the diagrams, designers and editors it calls for.

Part 1

Scene investigation is one stage in a longer chain. Its outputs are only as good as the procedures that keep them traceable from the first officer on the scene to the evidence presented at trial.

  • A defined process

    The European best practice manual for scene of crime examination describes the forensic process from the arrival of the first officer to the written scene report: initial actions, a scene examination strategy, the examination itself, interpretation of the findings with requests for further examination, and reporting. The manual frames each step in terms of quality principles, training and equipment rather than leaving them to individual judgement.

    ENFSI Best Practice Manual for Scene of Crime Examination

  • Distinct roles

    In major cases the work is split. Crime scene investigators examine and recover; a crime scene manager leads them at a complex scene and advises the senior investigating officer on a forensic strategy; a crime scene co-ordinator aligns the strategies of several scenes with the investigation as a whole. Each scene therefore carries its own plan, and the plans have to be reconciled.

    College of Policing, Crime Scene Manager · College of Policing, Crime Scene Co-ordinator · UK National Occupational Standard SFJCN101

  • Chain of custody

    From the moment an item is recovered, every transfer, analysis and disposition is recorded with a signature, date and time. An unexplained gap can lead a court to exclude the item or give it little weight, so the custody record is as much a part of the evidence as the item itself.

    Massachusetts State Police, chain of custody report · Keiser University 2024

  • The incident room

    Around the scenes sits a major incident room that gathers statements, messages, actions and their results. The UK’s standardised administrative procedures and the national major-enquiry system were introduced after the Yorkshire Ripper inquiry, so that the senior investigating officer can see at any moment what is known, what has been asked and what remains outstanding.

    College of Policing, MIRSAP · HOLMES 2

Part 2

The elements a scene investigation records fall into a small number of kinds, and the relations between them carry as much meaning as the elements themselves.

  • Places and geometry

    Scenes, sub-scenes, rooms, entry and exit points, cordons and common approach paths, with the positions of every item measured against fixed reference points. Geometry is what later allows trajectories, lines of sight and distances to be checked.

    Kentucky Law Enforcement 2019, Mapping the scene

  • Traces and items

    Biological traces, fingermarks, footwear and tool marks, fibres, weapons, documents and devices, each recovered as an exhibit with a reference, a location, a time of recovery and a custody trail. Bloodstain patterns are recorded as patterns, not only as samples, because their shape and distribution encode events.

    White paper on point clouds and bloodstain pattern analysis, 2020

  • People and statements

    Victims, witnesses, suspects and first responders, with what each said, when and to whom. In the incident room these become nominals, statements and actions that cross-reference one another.

    College of Policing, MIRSAP

  • Time

    The order of events at the scene, the times of calls, sightings and device activity, and the times at which the investigation itself acted. Digital devices add dense, machine-generated time series that must be merged with sparse human accounts.

    SoK: timeline based event reconstruction for digital forensics, 2025

  • Levels of a question

    Forensic interpretation separates what a trace is evidence of. A finding can bear on its sub-source (whose DNA this is), its source (which body fluid it came from), the activity that deposited it, or the offence. Moving from source to activity requires knowledge of transfer, persistence and background levels, and the offence level is normally left to the court.

    Gill et al. 2022, A logical framework for forensic DNA interpretation · NIST, assigning propositions for likelihood ratios

Part 3

Scene documentation has moved from photographs and hand-measured sketches to dense three-dimensional capture, but the purpose is unchanged: freeze the scene so that questions not yet asked can be answered later.

Part 4

Once the scene is recorded, the work moves to analysts and investigators who must connect people, places, objects and events across thousands of documents.

  • Link charts

    Link-analysis notebooks let analysts enter entities from statements and records and draw the relations between them: association charts, networks, commodity flows and activity charts. They have been standard in intelligence-led policing for three decades, and training still centres on charting technique.

    OSCE, link analysis training for Moldovan law enforcement · College of Policing, analysis references

  • Timelines and sequence charts

    Events from statements, call records and devices are placed on a timeline, often one lane per person, to show who was where and when, and where accounts conflict. In digital forensics, super-timeline tools merge hundreds of artefact types into a single normalised chronology, which analysts then filter, frequently in a spreadsheet.

    SANS, super timeline creation · Forensics Wiki, timeline analysis · SoK: timeline based event reconstruction, 2025

  • Maps and geographic profiles

    Crime mapping places events on a map; geographic profiling goes further for linked series, turning the locations of offences into a probability surface over the offender’s likely base. The output is a search priority, not an answer, and it is combined with other geographic information to rank suspects and areas.

    Rossmo, geographic profiling, NCJRS · ICIAF, geographic profiling

  • The action and document trail

    The major incident room itself is a visual system: indexes of nominals, vehicles and locations, a register of actions raised and closed, and a view of outstanding work. Its purpose is to make sure that related pieces of information are connected and that no line of enquiry is silently dropped.

    Metropolitan Police, HOLMES policy statement · College of Policing, MIRSAP

Part 5

Recording and connecting facts is not the same as explaining them. A growing body of work offers explicit, often graphical, structures for reasoning about competing explanations.

  • Scenario reconstruction

    Dutch policing teaches investigators to reconstruct the offence as scenarios answering the classic questions of who, what, where, with what, why, how and when, and to keep several scenarios alive. A 2026 experiment with 293 German police officers found that focusing on reconstructing what happened from the evidence, rather than on the suspect, led to more evidence-based next steps, and that a falsification instruction led to more falsifying steps, although neither changed guilt ratings.

    What happened and what proves you wrong?, 2026 · Politieacademie, reconstruct the narrative · Benefits of scenario reconstruction in cold case investigations

  • Analysis of competing hypotheses

    Borrowed from intelligence analysis, the method lays hypotheses out as columns and items of evidence as rows, and asks for each cell whether the item is consistent or inconsistent with the hypothesis. The emphasis falls on disconfirming evidence. It has been proposed for crime analysis as an auditable, transparent method, and applied to a homicide first misclassified as a natural death and to lead prioritisation in no-body homicide reviews.

    Townsley, Mann & Garrett 2011 · Keatley 2025 · Mapping the hypothetical, 2026

  • Wigmore charts and argument diagrams

    Wigmore’s evidence charts use a symbol syntax for propositions, evidence and inferential links, and remain the classic way to chart how items of evidence bear on the facts in issue. Wigmore charts and Bayesian networks are often presented as alternatives, but they answer different questions: the first shows the structure of an argument, the second the strength of belief.

    Dawid et al. 2024

  • Bayesian networks

    A Bayesian network draws hypotheses and items of evidence as nodes and their dependencies as arrows, and computes how belief in each should change when new evidence arrives. Forensic scientists use such networks to reason about activity-level propositions, where transfer and persistence matter. A comparison on a single well-known case applied Wigmore charts, Bayesian networks and chain event graphs to the same evidence to show what each makes visible.

    Fenton, Neil & Lagnado 2013 · Taroni et al. 2014 · Dawid et al. 2024

  • Likelihood ratios in reporting

    European guidance asks forensic scientists to report findings as the probability of the findings under each of a pair of propositions, not as the probability that a proposition is true. The pair, and its level in the hierarchy, must therefore be stated explicitly.

    Netherlands Forensic Institute 2015, European guideline for evaluative reporting

Part 6

The final audience is a judge or jury who never saw the scene. Visual reconstruction helps them understand it and also introduces new risks.

Part 7

The recurring difficulty is not a lack of data but turning data into a tested understanding without closing on one explanation too early. The literature names several causes.

  • Volume without connection

    The Yorkshire Ripper inquiry gathered tens of thousands of statements and hundreds of thousands of vehicle checks on card indexes. Cards were misfiled or never cross-referenced, the offender was interviewed nine times without being identified, and the official review concluded that the incident room’s backlog failed to connect vital, related information. Today the volume comes from devices: in England and Wales more than twelve thousand devices have awaited examination, and most investigators say device analysis takes more than two weeks.

    Byford report 1981 · Guernsey Press 2020 · ITV News 2020 · Industry trends survey 2024

  • Tunnel vision

    An analysis of fifty wrongful convictions and other investigative failures found confirmation bias, reinforced by groupthink and pressure to identify a perpetrator quickly, at the centre of most. Once a suspect is chosen, the investigation shifts from evidence-based to suspect-based: contrary evidence is minimised and ambiguous evidence read as support. In the Netherlands, the Schiedam park murder led to the Posthumus report and to institutionalised counter-argument in serious investigations.

    Rossmo & Pollock 2019 · Rossmo 2008, Criminal Investigative Failures · Rechtspraak, tunnelvisie

  • Counter-argument is not enough on its own

    A 2026 study compared investigators who regularly work with devil’s advocacy, investigators who do not, and laypeople. Experience with devil’s advocacy was not associated with more falsifying questions, stronger weight on exonerating evidence or larger revisions of guilt estimates, though experienced investigators asked fewer confirmatory questions. Evaluations of the Dutch reforms also report side effects: rigid structures, slow decisions and investigations kept too broad to avoid the wrong tunnel.

    Nieuwkamp, Maegherman & Bogaard 2026 · WODC evaluation

  • Context contaminates expert judgement

    Studies across fingerprints, DNA mixtures, bloodstain patterns, handwriting and pathology show that knowing a confession or the investigators’ theory changes what experts see. Linear sequential unmasking responds by giving analysts task-relevant information as late as possible, documenting the trace before seeing the reference, and limiting what may change afterwards. Self-awareness alone does not remove the effect.

    Kassin, Dror & Kukucka 2013 · JAAPL 2025 · Innocence Project, cognitive factors in forensic science

  • Sensemaking is collective

    Investigators construct an understanding of an incident from partial information, and in major cases a whole team does so together. A 2024 review of organised-crime investigations treats evidence as the product of collective sensemaking and identifies factors that shape its quality; detectives from different organisations hunting one serial offender struggled precisely to organise their data into a shared picture.

    Ormerod, Barrett & Taylor, investigative sense-making · Visser, Markus, Kop & Weggeman 2024

  • Uncertainty is flattened

    Pattern disciplines often lack known error rates, findings are reported at one level of the hierarchy and heard at another, and a scanned scene or a chart looks equally certain in every part. What is measured, what is inferred and what is assumed are rarely distinguished in the visual record.

    National Research Council 2009 · Gill et al. 2022

Across the parts

Read together, the sources describe what a tool for investigative reasoning has to respect:

  1. Geometry is not meaning. Capturing the scene precisely is necessary, but the meaning lies in typed relations between traces, events and propositions laid over it.
  2. One model, several projections. Link charts, timelines, maps and the scene itself are views of the same facts and should stay in step.
  3. Alternatives are first-class. Several scenarios or hypotheses should be held side by side, each with the evidence for and against it, until the evidence closes them.
  4. Disconfirmation is the useful question. The structure should ask what would prove a scenario wrong, not only what supports it.
  5. Levels must be explicit. Every finding should carry the level of proposition it addresses and whether it is observed, inferred or assumed.
  6. Exposure is part of the record. Who saw which information, and when, matters for the weight of a judgement, so sequencing and provenance belong in the model.
  7. The picture shown to others carries its assumptions. A reconstruction for a court, a briefing or a review should travel with its viewpoint, its scenario and its alternatives.

From practice to tools

Most artefacts in this practice are spatial or relational structures (diagrams), structured registers and matrices (designers), or structured narratives (editors). The candidates below are named by their kind and by the elements and relations a tool engineer would specify.

Candidate tool Kind Elements Relations and attributes
Annotated scene plan Diagram Scenes, areas, exhibits, reference points, approach paths Located at, recovered from; coordinates, recovery time
Exhibit and custody register Designer Exhibit, description, location, recovered by, transfers Custody trail; analysis requested, result
Link chart Diagram People, places, vehicles, devices, organisations Associates with, owns, called, was at; source per link
Multi-lane timeline Diagram Events, accounts, device records Precedes, conflicts with; lane per person, certainty
Scenario board Diagram Scenarios, events, branching points Branches, explains; evidence for and against each
Competing hypotheses matrix Designer Hypotheses by items of evidence Consistent or inconsistent, weight, diagnosticity
Evidence chart Diagram Facts in issue, propositions, evidence Supports, undermines; Wigmore-style inference chain
Proposition register Designer Proposition pairs, hierarchy level, findings Likelihood ratio, assumptions, reported to
Exposure log Designer Analyst, task, information released, time Released before or after the examination
Case narrative Editor Scenario text, citations of exhibits and statements Each claim linked to the element it rests on

Method: literature and practice searches on 3 October 2026 across four strands: how scene examination and major investigations are organised, the visual tools used at the scene and in the incident room, structured and graphical methods for reasoning about hypotheses and evidence, and the documented causes of investigative failure. Every source listed was found in live search results with matching authors, title and venue, but the research environment could not open most publisher pages and repositories, so the descriptions rest on abstracts, index summaries and practitioner summaries rather than on a full reading of each text. Commercial products are described by category rather than by name. Where author lists or volume details could not be confirmed, the reference gives the title and year only. The analysis covers practice in the United Kingdom, the Netherlands, the United States and European guidance; other jurisdictions organise scene work differently.