Post-Blast Residue Sampling and the IMS, GC-ECD, LC-MS/MS Workflow

Blast scene management in most jurisdictions follows a concentric-zone model derived from the US ATF/FBI joint post-blast investigation protocol (the ATF Post Blast Investigation guide), the UK's Association of Chief Police Officers (ACPO, now the National Police Chiefs' Council) Major Incident guidelines, and the INTERPOL Forensic Sciences Sub-Directorate's guide on post-blast investigation. The zones are defined relative to the estimated seat of explosion.

The outer cordon (the exclusion perimeter) is established by uniformed police or military EOD personnel to exclude all non-essential personnel, prevent secondary device detonation risk, and preserve evidence beyond the known debris field. Minimum radius: 1.5 times the debris-throw radius, which for vehicle-borne IEDs in the 50-500 kg TNT-equivalent range may extend to hundreds of metres.

The inner cordon defines the working crime scene within which the forensic investigation operates. Access is controlled; every person entering logs in and logs out with a scene coordinator. Protective equipment (PPE: minimum nitrile or vinyl gloves, face mask, Tyvek suit, boot covers) is mandatory to prevent contamination by the investigator.

Seat of explosion identification is the first analytical judgement. Indicators include the deepest crater or lowest point of structural damage, the point of convergence of debris throw vectors (fragments travel outward from the seat), the greatest damage density (maximum number of impacts per unit area of surrounding surfaces), and the focus of the blast wave pattern (spalling on inward-facing walls). In most VBIED (vehicle-borne IED) incidents, the vehicle wreckage itself defines the seat; in person-borne IED incidents, the body remains of the bomber, if recoverable, are proximal to the seat.

Background (control) swabs are collected from surfaces outside the outer cordon, at a distance that precludes explosive residue contamination from the blast. These swabs go through the identical analytical workflow as scene swabs and establish the baseline chemical signature of the environment: local ammonium nitrate from fertiliser use, fuel-oil hydrocarbons from diesel traffic, and other organic compounds that could create false-positive matrix interference.

The zonal sampling protocol divides the scene into concentric rings centred on the seat of explosion. The nomenclature and zone boundaries vary by jurisdiction and agency, but the most widely used framework (drawn from the US ATF post-blast manual and adopted by the UK National Explosives Training Centre and Australia's AFP) defines three sampling zones.

Zone 1 (seat zone): the immediate area at and around the seat of explosion, typically within 1-2 metres of the crater centre. This zone yields the highest concentration residue from the main charge, initiator, and device components. It also suffers the most physical disruption. Sampling in Zone 1: swabbing the crater floor and walls if accessible; collecting soil from the crater bottom (5-10 g in separate sealed containers); collecting all solid debris (metal, circuit components, container fragments) for later laboratory swabbing and particle examination.

Zone 2 (intermediate zone): the area from approximately 1-2 metres to 10-20 metres from the seat, depending on device size. This zone contains fragments projected by the blast, residue-bearing surfaces from the blast wave, and, in indoor incidents, the surfaces that received the reflected blast wave. Sampling: systematic swabbing of surfaces (floor, wall, vehicle panels) at defined intervals; collection of embedded fragments; swabbing of any patterned deposits (soot, residue rings) visible on surfaces.

Zone 3 (outer zone): the far-field area beyond Zone 2 to the outer cordon. This zone yields the lowest concentration residue but may contain intact device components, packaging fragments, or electronic components (timer circuits, mobile phone triggers) that were projected intact rather than destroyed. Large structural fragments bearing residue may be found here.

Swabbing protocol: cotton (Whatman no. 1 or equivalent) or nylon swabs pre-moistened with acetonitrile or methanol are used for dry surfaces; dry swabs for wet or water-contaminated surfaces. Each swab covers a defined area (typically 100 cm2), is labelled with a unique exhibit number, zone, location, time, and swabber's identity, and placed in a sealed glass vial (not plastic, which can adsorb trace explosive residue) or a foil-lined pouch.

Fragment packaging uses individual paper or cotton bags (not polyethylene, which traps acetone and interferes with TATP analysis) with individual exhibit numbers. Metal fragment packaging uses sealed metal cans or glass jars. All exhibits are refrigerated at 4°C for transport (low temperature slows sublimation loss from TATP residue) and processed within 24-48 hours of collection.

Human remains: body parts and clothing recovered from a blast scene are sources of residue when the device was body-worn (suicide vest) or when the victim was proximate to the seat. Forensic pathologists and forensic chemists work jointly; swabs from wounds, hands, and clothing are collected under human-remains protocols with separate exhibit series to maintain the identification chain. In India, the Code of Criminal Procedure (BNSS 2023) and the Forensic Science guidelines issued by the Ministry of Home Affairs govern body-worn-device evidence collection, mirroring UK and US protocols.

Ion mobility spectrometry separates ions by their drift velocity through a buffer gas (typically nitrogen or air) under the influence of an electric field. Different ions have different cross-sectional areas (collision cross-sections) and therefore different drift times through the drift tube, typically 5-25 milliseconds. The output is an ion mobility spectrum: a plot of signal intensity versus drift time, with peaks at characteristic drift times for each compound.

The Smiths Detection IONSCAN 500DT and 600 are the most widely deployed airport and border screening IMS instruments. The IONSCAN 600 uses a dual-column configuration with negative-ion and positive-ion drift tubes operating simultaneously, allowing detection of nitro-group explosives (negative-ion mode) and TATP/HMTD (positive-ion mode) in the same analysis. Sample introduction uses a swab that is thermally desorbed onto the drift tube inlet at approximately 150-200°C; the thermally desorbed vapour is ionised by a radioactive source (63Ni or 241Am). Analysis time per sample: approximately 5-8 seconds. Detection limit: sub-nanogram for nitro-group explosives in negative-ion mode; approximately 10-50 nanograms for TATP in positive-ion mode.

The Bruker E2M (previously the Bruker RAID series) uses a similar drift-tube principle with a heated desorber assembly. Deployed by German federal police (BKA), Austrian national police, and Nordic border agencies. The Rapiscan Itemiser 4DX uses drift-tube IMS and is deployed at many US TSA checkpoints and UK Border Force points of entry.

Thermal desorption protocol for TATP: because TATP sublimes at room temperature, swab temperature during thermal desorption must be controlled. Desorption at the standard 200°C setting decomposes TATP to acetone, which is detected as the acetone ion in positive-ion mode rather than as the intact TATP ion. Some instruments therefore operate a lower-temperature TATP-specific desorption at approximately 120-150°C to preserve the intact molecular ion or ammonium adduct. Manufacturers publish validated protocols for each explosive class; field operators must use the correct protocol.

IMS presumptive result limitations: (1) false positives occur from nitroglycerin in pharmaceutical products (Nitro-Dur cardiac patches, GTN spray), from TATP alarms triggered by acetone from solvents or nail polish remover, and from nitrate ions from fertiliser residue on skin. (2) IMS cannot distinguish between structural isomers (cannot differentiate 2,4-DNT from 2,6-DNT, or RDX from HMX, without additional drift-time resolution). (3) The drift-time database for each instrument must be regularly calibrated against certified reference standards. (4) No jurisdiction in the world accepts an IMS result alone as proof of the presence of an explosive in criminal prosecution; laboratory confirmation by GC-ECD or LC-MS/MS is required.

Gas chromatography with electron capture detection (GC-ECD) operates by separating analytes on a capillary column (stationary phase tailored to the analyte class) under a controlled temperature program, then detecting eluting analytes by their ability to capture thermal electrons from a 63Ni radioactive source in the detector cell. Compounds with high electron affinity, including nitroaromatic compounds, nitramines, nitrate esters, and halogenated compounds, produce very large electron-capture signals relative to their mass, achieving detection limits in the 1-10 picogram range injected on-column.

For explosives analysis, the standard columns are DB-17 (50% phenyl, 50% methyl polysiloxane, 30 m, 0.25 mm ID) or the application-specific Rtx-TNT2 (Restek, a column optimised for the TNT/RDX/PETN/HMX family). A typical temperature program: hold 60°C for 1 minute, ramp 10°C/min to 200°C, ramp 20°C/min to 280°C, hold 5 minutes. Injector temperature: 200°C (lower than standard to prevent PETN thermal decomposition). Detector temperature: 300°C.

Retention time order under standard conditions (approximate, column-dependent):

• Nitrobenzene (solvent marker): 5 min
• 2-Nitrotoluene: 7 min
• 2,4-DNT: 11 min
• 2,6-DNT: 12 min
• TNT: 14 min
• PETN: 16 min
• RDX: 18 min
• HMX: 21 min
• Tetryl: 22 min

Retention time confirmation requires analysis of a certified reference standard (NIST SRM 2905 (Trace Particulate Explosive Simulants) or SRM 2907 for explosive residue, or primary standards from Sigma-Aldrich, Cerilliant, or AccuStandard with traceable purity certificates) on the same day, on the same instrument, under the identical method. A match within ±0.1 minutes is required for presumptive identification; confirmation requires a second analytical method.

GC-ECD quantification: the detector response is linear over two to three orders of magnitude for most explosive analytes. Response factors are calculated from the ratio of peak area to mass injected for each calibration standard. A six-point calibration curve (0.05, 0.1, 0.5, 1, 5, 10 ng/mL in acetonitrile) is prepared fresh daily with a minimum r2 of 0.999. The concentration of the analyte in the original swab extract is back-calculated to a per-swab or per-unit-area basis.

GC-ECD cannot detect TATP (no electron-withdrawing groups), urea nitrate (non-volatile at GC conditions), or the organic components of black powder (charcoal is essentially non-volatile). For these analytes, IC and LC-MS/MS are required.

Liquid chromatography with tandem mass spectrometry (LC-MS/MS) in negative-ion electrospray ionisation (ESI-) mode is the primary confirmatory method for all conventional secondary explosives (TNT, RDX, PETN, HMX) and is the only published validated method for TATP and HMTD that meets criminal justice admissibility standards. Key instrument platforms: Waters Xevo TQ-S (triple quadrupole, deployed at UK DSTL and many US state forensic labs), Sciex 6500+ (triple quadrupole, deployed at the FBI Laboratory and commercial forensic labs), and Agilent 6495 (triple quadrupole, deployed at Australian AFP and European NFI).

Multiple reaction monitoring (MRM) acquisition mode monitors two precursor-to-product ion transitions per analyte, allowing both quantification (the stronger transition) and confirmation (the qualifier transition). The ion ratio between the two transitions must match within 20% of the ratio observed for the calibration standard, in addition to retention time match and precursor mass match.

Key MRM transitions for the main explosive classes:

• TNT: [M-H]- 226 to 196 (loss of NO2), 226 to 180 (loss of NO + H2O); retention approximately 8 min on C18, 5 mM ammonium acetate/methanol gradient.
• RDX: [M+NO3]- 285 to 120 (ring opening), 285 to 46 (NO2-); or [M+Cl]- 257 to 120; retention approximately 6 min.
• PETN: [M-H]- 315 to 241 (loss of NO2 + O), 315 to 212; retention approximately 10 min.
• HMX: [M+NO3]- 358 to 120, 358 to 46; retention approximately 7 min.
• TATP: [M+NH4]+ 240 to 89, 240 to 43 (acetyl cation); positive-ion mode, retention approximately 4 min.
• HMTD: [M+NH4]+ 226 to 79, 226 to 44; positive-ion mode, retention approximately 3 min.
• DMDNB (taggant): [M-H]- 163 to 131, 163 to 115; negative-ion mode, retention approximately 12 min.

Ion chromatography (IC) is the method for inorganic anions and cations in post-blast residue. The instrument platform of choice: Thermo Dionex ICS-6000 dual-channel (simultaneous anion and cation IC), with conductivity detection using suppressed conductivity to reduce background. Suppressed conductivity converts the eluent ions to low-conductivity water while the analyte ions are converted to high-conductivity acid or base forms.

Anion IC method: hydroxide eluent gradient on an IonPac AS18 column (Thermo Dionex) separates fluoride, chloride, nitrite, sulphate, nitrate, and perchlorate in 20 minutes. Detection limit: approximately 50 micrograms per litre (50 ppb) for nitrate and sulphate; approximately 5 ppb for perchlorate (which has higher response).

Cation IC method: methanesulphonate eluent on an IonPac CS12A column separates lithium, sodium, ammonium, potassium, magnesium, and calcium. Ammonium and potassium are the key explosive cations (ANFO and black powder, respectively).

The following inorganic ion cluster is diagnostic for each major low-explosive and inorganic-oxidiser class:

• Black powder: K+, NO3-, SO4(2-), CO3(2-)
• ANFO: NH4+, NO3- at approximately 1:1 molar ratio
• Urea nitrate: NO3-, urea (confirmed by LC-MS/MS m/z 61)
• Ammonium perchlorate (composite solid rocket propellant): NH4+, ClO4-
• Potassium chlorate mixture (older fireworks): K+, ClO3- (also ClO4- as decomposition product)

SEM-EDX (scanning electron microscopy with energy-dispersive X-ray analysis) is applied to solid residue particles from Zone 1 swabs and debris surfaces. It identifies the elemental composition of residue particles at the microgram to nanogram scale. Lead, antimony, and barium particles indicate detonator primer or GSR. Lead and azide (from FTIR or Raman on individual particles) indicate lead azide initiator. Potassium, sulphur, and carbon together indicate black powder particles.

The forensic chain in an explosives prosecution typically has four links. The first link is the chemical identification: what explosive was used, in what formulation, with what taggant or impurity profile, and at what mass. The second link is device attribution: what delivery mechanism (IED type, vehicle, person-borne, postal), what initiation system (timer, mobile phone trigger, pressure plate, pull switch), and what container or housing. The third link is source attribution: where did the precursor chemicals, commercial explosives, or device components come from, and what commercial, regulatory, or purchase records document that source. The fourth link is the connection to a person: whose fingerprints, DNA, or other individual identifiers are on the device components, and what mobile phone, financial, or travel records link them to the scene.

The forensic chemist owns the first link entirely and contributes to the third. The chain cannot be broken without undermining the entire prosecution, which is why the chain-of-custody documentation from swab number to analytical report must be complete, contemporaneous, and independently reviewable.

The international reference network for explosives attribution includes: the FBI Laboratory's Explosives Reference Collection at Quantico (containing over 5,000 commercial explosive formulations); the UK DSTL Post-Blast database; the Dutch NFI Explosives Database; the ATF's National Repository of Explosive Evidence (NREE); and the INTERPOL Explosives Intelligence Management System (EIMS) for cross-border attribution. India's NSG (National Security Guard) NBC (Nuclear, Biological, Chemical) Wing at Manesar, Haryana, maintains an operational explosives intelligence function; the CFSL Hyderabad explosives wing is the designated court-certifying laboratory for explosives examination under Indian forensic science procedures.

The United Kingdom's Forensic Science Regulator has issued Codes of Practice for explosives examinations (within the Chemistry and Explosives Codes) requiring that all explosives analyses used in criminal proceedings be conducted by UKAS-accredited laboratories (ISO 17025:2017) with validated methods, certified reference standards, and blind quality control samples on every analytical batch. The FBI's Quality Assurance Standards for forensic chemistry impose equivalent requirements. India's NABL (National Accreditation Board for Testing and Calibration Laboratories) has issued criteria for forensic chemistry testing that reference the same international standard for laboratories seeking court-certification status under the Bharatiya Nyaya Sanhita (BNS) 2023 and the Bharatiya Nagarik Suraksha Sanhita (BNSS) 2023.

1. Establish cordon and identify seat of explosion
   Outer cordon: EOD clearance before forensic entry. Inner cordon: document access log. Photograph scene in 360-degree panorama before any sampling. Identify seat of explosion from crater geometry, fragment-throw convergence, and damage pattern. Mark seat with a surveyor's pin and GPS coordinate.
2. Background control swabbing
   Collect 5-10 control swabs from surfaces outside the outer cordon (asphalt, concrete, vegetation) using the same swab type as scene swabs. Label and package identically. These run through the full analytical workflow as matrix controls.
3. Zonal sampling
   Zone 1: swab crater floor and walls, collect soil (5-10 g in glass vial), collect all solid debris and device component fragments. Zone 2: systematic surface swabbing on a 2-metre grid; document swab locations on site plan. Zone 3: collect intact components, circuit fragments, wire, packaging. Human remains: separate exhibit series with forensic pathologist.
4. Field IMS screening
   Thermally desorb swabs on IONSCAN 600 or Bruker E2M in the field screening tent. Run negative-ion mode for TNT/RDX/PETN/DMDNB; positive-ion mode for TATP/HMTD. Document all readings, alarm thresholds, and instrument calibration log. Presumptive results only. Confirm identity is never established at this stage.
5. Laboratory extraction and GC-ECD/LC-MS/MS
   Elute swabs with acetonitrile. Split extract: one aliquot for GC-ECD (DB-17 or Rtx-TNT2 column, 63Ni ECD, 1-200 ng/mL calibration range). One aliquot for LC-MS/MS negative-ion (C18, ammonium acetate/methanol, TNT/RDX/PETN/HMX/DMDNB MRM panel). One aliquot for LC-MS/MS positive-ion (TATP/HMTD MRM panel). IC analysis on separate aqueous extract aliquot.
6. IC, SEM-EDX and Raman follow-up
   IC on aqueous extract for NO3-, SO4(2-), NH4+, K+ (and ClO4- if indicated). SEM-EDX on solid particle residue from Zone 1 debris for elemental particle identification. Raman on solid crystalline residue if any intact unexploded material is identified (after EOD render-safe). Compile analytical results from all methods.
7. Report and expert testimony preparation
   Compile the analytical report: each exhibit number, swab location, IMS result, GC-ECD result (retention time, response factor, concentration, LOD, LOQ), LC-MS/MS result (precursor ion, two MRM transitions, ion ratio, retention time, calibration curve), IC result (anion and cation concentrations, inorganic explosive class inference). State the identification conclusion, the supporting analytical basis, and the limitations.