The Failure Investigation Process

A forensic engineering failure investigation follows a disciplined sequence from scene preservation through evidence collection, laboratory analysis, and hypothesis testing to a final opinion, mirroring the scientific method while meeting legal standards for evidence integrity.

Last updated: 10 Jun 2026

A forensic engineering investigation is the scientific method wearing a hard hat and carrying a camera. The goal is to reach a technically defensible conclusion about why something failed, and to reach it in a way that can be tested, challenged, and explained to someone without an engineering degree. Those two requirements, technical defensibility and communicability, shape every step of the process from the first phone call to the final testimony.

The sequence looks simple on a flowchart: go to the scene, collect evidence, test it, form hypotheses, check them against the evidence, and write up what you found. In practice each step involves judgment calls that can make or break the investigation later. The choice of what to photograph and what to measure, which samples to take and which to leave in place, when to stop generating hypotheses and commit to a conclusion: these decisions are where experience and method diverge from guesswork.

Two ASTM standards anchor the methodology: E860 (examining and preparing items that are or may become involved in litigation) and E678 (standard practice for evaluation of technical data). Together they provide a framework that courts recognise, even in jurisdictions where ASTM is not formally adopted, because the underlying logic (document before you touch, test before you destroy, reason from evidence not assumption) is the same in every sound engineering investigation.

Key terms

Evidence preservation: The discipline of maintaining physical evidence in its post-incident condition until all parties have had the opportunity to examine it. Includes both preventing accidental damage and preventing intentional alteration.
Non-destructive examination (NDE): Inspection methods that do not alter or consume the evidence: visual inspection, photography, dimensional measurement, dye-penetrant testing, ultrasonic testing, and radiography. NDE is performed before any destructive sampling.
Destructive examination: Testing that consumes or modifies the evidence: sectioning for metallurgical mounts, chemical digestion for composition analysis, mechanical testing to failure. Requires notice to all parties and often a joint examination protocol.
ASTM E860: Standard Practice for Examining and Preparing Items That Are or May Become Involved in Criminal or Civil Litigation. Specifies documentation requirements and procedures for handling physical evidence to preserve its integrity for legal proceedings.
Hypothesis generation and testing: The step in failure analysis where possible causes are listed systematically, then each is tested against the physical evidence and engineering calculations. Hypotheses inconsistent with the evidence are eliminated; the most strongly supported surviving hypothesis becomes the conclusion.
Root cause: The fundamental, underlying deficiency from which the failure originated. Distinguished from immediate cause (the final physical event) and contributing factors. Root-cause analysis aims to go back far enough in the causal chain to identify the decision or condition that, if corrected, would prevent recurrence.

Notification and initial access

The first hours after a failure are often the most evidence-rich.

A forensic engineering investigation typically begins with a phone call: an attorney, an insurer, a plant manager, or a police officer reports a failure and asks for help. The engineer's first job before driving to the scene is to establish what access they will have, who else will be there, and what constraints apply. These questions are not procedural niceties: they determine whether the engineer sees the evidence in its post-incident condition or after it has been altered by cleanup, repair, or the examinations of other parties.

In litigation, multi-party inspection protocols are standard. All parties agree on a date for joint examination, and each party's expert attends. Nothing is moved, sampled, or tested destructively until everyone has had the opportunity to observe. Violating this protocol can result in evidence sanctions and can expose the examining party to accusations of spoilation. For the forensic engineer, arriving first and touching things first is not an advantage; it is a liability.

Documentation: before anything is touched

A photograph taken before a bolt is moved is irreplaceable; one taken after is much less useful.

Documentation begins the moment the forensic engineer arrives at the scene. The goal is to create a record detailed enough that anyone reading the investigation report later can understand exactly what was observed and in what condition, without having been there. That standard sounds obvious. It is surprisingly hard to meet in practice, especially when engineers are eager to start examining the interesting failure surfaces.

Photography: overview shots establishing context, mid-range shots locating specific features, and close-up shots of fracture surfaces, corrosion, welds, and connections. Every close-up needs a scale bar. RAW format preserves dynamic range for later analysis. Time and location metadata should be confirmed.
Dimensional measurement: critical dimensions that will be needed for calculations: section sizes, wall thicknesses, connection geometry, crack lengths, deformation magnitudes. Hand measurements backed up by a laser distance measurer or total station for larger elements.
Sketches and diagrams: hand-drawn site plans and component sketches often capture spatial relationships and conditions that photographs miss. Annotated sketches, made at the scene and later formalised into CAD drawings, are a standard exhibit in engineering reports.
Field notes: written contemporaneously, not reconstructed from memory later. Note the date, time, weather, who was present, and what was done. Field notes are discoverable in litigation and are often the first exhibit opposing counsel examines when challenging an investigation.

Documentation hierarchy for forensic engineering scene recording.

Evidence collection and laboratory analysis

From scene to laboratory without breaking the chain.

After the scene has been documented, the engineer begins collecting samples and evidence for laboratory analysis. The sequence matters: non-destructive examination first, then sampling from areas that will not compromise the integrity of features that other parties still need to examine. Destructive testing (sectioning a fracture surface for an SEM mount, for example) is the last resort, done under agreed protocols.

The laboratory toolkit for forensic engineering is broad. Optical microscopy of polished cross-sections reveals microstructure and defects. Scanning electron microscopy (SEM) with energy-dispersive X-ray spectroscopy (EDX) identifies fracture mechanisms and surface chemistry at the nanometre scale. Chemical analysis (OES, ICP-MS) confirms whether a material meets its specification. Hardness testing and tensile testing establish mechanical properties. Corrosion product analysis identifies the corrosion mechanism and can help estimate how long it has been active.

Hypothesis generation and testing

Multiple hypotheses prevent the trap of seeing only what you expected to find.

Once the physical evidence has been collected and initial laboratory results are available, the engineer generates a list of possible failure causes. The discipline here is to list all credible hypotheses, not just the one that looks most plausible from the first walk-around. Premature commitment to a single explanation is one of the most common failures in forensic investigation, and it is the mechanism behind confirmation bias.

List all physically possible causes
Before testing anything, write down every mechanism that could have produced the observed failure mode. For a fractured steel beam: overload, fatigue, brittle fracture from material defect, corrosion-assisted cracking, weld defect, fire damage, and impact. Do not eliminate any hypothesis at this stage without a reason.
Test each hypothesis against the physical evidence
Each failure mechanism has observable signatures. Fatigue shows beach marks and striations. Overload fracture shows a fibrous, ductile zone with a shear lip. Brittle fracture shows cleavage facets. Corrosion leaves characteristic products and surface morphology. Compare the observed fracture surface against what each mechanism predicts.
Use calculations to discriminate
Physical observation often narrows the list but does not always close it. Engineering calculations can. If the applied load under the design service condition was 40% of the fracture load, overload is inconsistent with the evidence unless there was a load event above design. Calculate the fatigue life under the known load spectrum and compare it with the actual service life.
State the conclusion with calibrated confidence
The surviving hypothesis is the most probable cause. Express it with appropriate uncertainty. 'The fracture originated from a fatigue crack initiated at an undercut in the fillet weld' is more defensible than 'the weld was bad'. If the evidence cannot discriminate between two hypotheses, say so: both are consistent with the observations, and here is what additional testing would be needed to resolve it.

ASTM E678, Standard Practice for Evaluation of Technical Data, formalises this logic. It requires that each candidate hypothesis be evaluated against all available data and that the stated conclusion be the one most consistent with the totality of the evidence. Courts have cited E678 as a benchmark for testing whether an engineering opinion is methodologically sound.

From cause to contributing factors and root cause

The immediate cause is where the failure started; the root cause is why it was allowed to start.

A failure investigation that stops at the immediate physical cause (the crack, the overload, the corroded pipe) gives the attorneys something to argue about, but it often does not tell the full story. Courts and regulators increasingly want to know not just what happened but why the conditions that allowed it to happen were present.

Level of cause	Example	Answers the question
Immediate cause	Fatigue fracture at weld toe	What was the last physical event before failure?
Proximate cause	Weld contained a lack-of-fusion defect at the initiation site	What deficiency made the failure occur at this location?
Contributing factor	Inspection programme did not include weld-quality NDE after fabrication	What allowed the deficiency to persist undetected?
Root cause	Design specification did not require weld quality level B for this joint	What systemic condition made the deficiency possible?

The depth of the causal chain the forensic engineer pursues depends on the instructions. A focused question (did this pipe fail from corrosion or mechanical damage?) calls for a narrow investigation. A broader question (why did this plant have three pipe failures in two years?) calls for root-cause analysis that may encompass inspection programmes, maintenance records, and design specification review. The engineer should understand what the instructing party needs before deciding how far to go.

Report writing and opinion delivery

An expert opinion is only as useful as the reasoning that supports it.

The investigation report is the final output of the process, and in litigation it is the most scrutinised document the forensic engineer produces. It must be clear enough for a judge without engineering training to follow the logic, and technically rigorous enough to survive examination by a qualified opposing expert. Those two requirements pull in opposite directions, and managing that tension is a skill developed through practice.

A standard structure for a forensic engineering report: scope and instructions; summary of evidence examined; factual findings from physical examination and laboratory testing; engineering analysis (calculations, model results, literature comparisons); opinion on cause; and a statement of what additional information, if available, could change the opinion. The last element is often omitted and always valuable. An expert who acknowledges the limits of their analysis is more credible than one who presents every conclusion as certain.

Worked example

Silver Bridge collapse, West Virginia, 1967: cause from a single weld

Stress-corrosion cracking in one eyebar link, invisible without disassembly, brought down an entire suspension bridge.

On 15 December 1967, the Silver Bridge over the Ohio River at Point Pleasant, West Virginia, collapsed in 65 seconds, killing 46 people. The investigation that followed is a textbook example of the failure investigation process: systematic evidence recovery from a river, hypothesis generation from multiple failure modes, and elimination of alternatives until one cause survived the evidence test.

The bridge was an eyebar-chain suspension bridge, an unusual design even when it was built in 1928. The chains were made of heat-treated carbon steel eyebars pinned together at their looped ends. The investigation began with recovery of the failed components from the Ohio River, a physical evidence collection problem unlike most civil failures, because the evidence was scattered across a riverbed. Divers and dredges worked for weeks.

The investigative team, led by the Bureau of Public Roads (later FHWA), examined fracture surfaces from the recovered eyebars. The critical evidence was a fracture surface in Eyebar 330, a key link in the north-side chain. The fracture surface showed a small pre-existing crack at the inner surface of the eyebar eye, with characteristics consistent with stress-corrosion cracking: a brittle, intergranular fracture zone at the origin, transitioning to a fast-fracture zone over the rest of the section.

The investigators tested the remaining eyebar material to confirm it was susceptible to stress-corrosion cracking in the presence of the paint and atmospheric conditions present at the bridge. They calculated that a crack of the estimated initial size, growing under the measured stress and corrosion rates, was consistent with the 39-year service life before the collapse. The hypothesis that the crack was a manufacturing flaw that grew to critical size by stress-corrosion cracking survived every test they applied. Alternative hypotheses (overload, fatigue, material substitution) were inconsistent with the fracture surface evidence or the service history.

The Silver Bridge investigation led directly to the National Bridge Inspection Program, requiring regular inspection of all public highway bridges in the United States. It also established that stress-corrosion cracking in steel bridge members, occurring in inaccessible locations inside pin connections, was a real and unaddressed risk; visual inspection alone would never have detected it. The lesson for failure investigation: understand what your inspection method can and cannot see before concluding that inspected means safe.

Check your understanding

Question 1 of 4· 0 answered

Which ASTM standard governs the examination and preparation of items involved in litigation?

Key Takeaways

A failure investigation follows a defined sequence: notification and access, thorough documentation, evidence collection and laboratory analysis, hypothesis generation and testing, and report preparation; the sequence maps the scientific method to a legal-evidence standard.
ASTM E860 governs how physical evidence is handled in litigation, requiring documentation before any disturbance and a multi-party inspection protocol before destructive testing; ASTM E678 requires that the conclusion be the hypothesis most consistent with the totality of the evidence.
Multiple hypotheses must be generated and tested rather than committing to the first plausible explanation; confirmation bias and hindsight bias are the chief sources of erroneous forensic opinions.
The failure analysis chain runs from immediate cause through proximate cause, contributing factors, and root cause; how far the investigation pursues this chain depends on the instructions and the legal question being answered.
The Silver Bridge collapse demonstrated that a single crack, invisible to visual inspection, could bring down an entire structure, and led directly to the mandatory National Bridge Inspection Program in the United States.

What are the steps in a forensic engineering failure investigation?

A failure investigation moves through notification and scene access, initial documentation, evidence preservation, detailed examination, laboratory analysis, hypothesis generation and testing, calculation and analysis, and finally report preparation. The sequence is not always linear; new evidence can require returning to an earlier step. What matters is that each stage is documented so the reasoning is reproducible and auditable.

What is ASTM E860 and why does it matter?

ASTM E860 is the Standard Practice for Examining and Preparing Items That Are or May Become Involved in Criminal or Civil Litigation. It sets out protocols for handling physical evidence so it is not altered or contaminated before all parties have had the opportunity to examine it. Following E860 provides a defensible record of how the evidence was treated from first contact to final report.

What is the difference between a cause and a contributing factor in failure analysis?

The cause is the specific deficiency or event that initiated the failure. Contributing factors are conditions or actions that made the failure more likely or more severe, but were not the initiating trigger. Courts and standards bodies use these terms differently, so a forensic engineer must be precise about which label they are applying and why.

What is deductive versus inductive reasoning in failure analysis?

Inductive reasoning moves from specific observations to a general hypothesis: these fracture marks look like fatigue, so fatigue is the probable cause. Deductive reasoning tests the hypothesis: if fatigue is the cause, the fracture surface should show striations at a spacing consistent with the applied load cycle. Good failure analysis uses both: observation to generate hypotheses, then calculation and testing to confirm or reject each one.

Can a forensic engineer draw conclusions from photos alone?

Sometimes, but a photo-only investigation is always weaker than one involving physical examination. Photographs lose three-dimensional information, cannot convey texture, cannot be used for dimensional measurement without scale bars, and can be ambiguous about colour and surface condition under artificial lighting. A forensic engineer who has not personally examined the evidence should say so explicitly and frame their opinion accordingly.

Test yourself on Forensic Engineering with free, timed mocks.

Practice Forensic Engineering questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

The Failure Investigation Process

Last updated: 10 Jun 2026

Level of cause

Example

Answers the question

Immediate cause

Fatigue fracture at weld toe

What was the last physical event before failure?

Proximate cause

Weld contained a lack-of-fusion defect at the initiation site

What deficiency made the failure occur at this location?

Contributing factor

Inspection programme did not include weld-quality NDE after fabrication

What allowed the deficiency to persist undetected?

Root cause

Design specification did not require weld quality level B for this joint

What systemic condition made the deficiency possible?

Key Takeaways

A failure investigation follows a defined sequence: notification and access, thorough documentation, evidence collection and laboratory analysis, hypothesis generation and testing, and report preparation; the sequence maps the scientific method to a legal-evidence standard.

ASTM E860 governs how physical evidence is handled in litigation, requiring documentation before any disturbance and a multi-party inspection protocol before destructive testing; ASTM E678 requires that the conclusion be the hypothesis most consistent with the totality of the evidence.

Multiple hypotheses must be generated and tested rather than committing to the first plausible explanation; confirmation bias and hindsight bias are the chief sources of erroneous forensic opinions.

The failure analysis chain runs from immediate cause through proximate cause, contributing factors, and root cause; how far the investigation pursues this chain depends on the instructions and the legal question being answered.

The Silver Bridge collapse demonstrated that a single crack, invisible to visual inspection, could bring down an entire structure, and led directly to the mandatory National Bridge Inspection Program in the United States.

What are the steps in a forensic engineering failure investigation?

What is ASTM E860 and why does it matter?

What is the difference between a cause and a contributing factor in failure analysis?

What is deductive versus inductive reasoning in failure analysis?

Can a forensic engineer draw conclusions from photos alone?

Your journey to becoming a forensic professional starts here.

Key Takeaways

Key Takeaways