a) Enzyme Multiplied Immunoassay Technique (EMIT)

1. Antibody against the target analyte and enzyme substrate are added to the patient's sample. Binding occurs between the antibody and any analyte present.
2. An enzyme-analyte conjugate (exogenous labelled analyte) is then added as a second reagent. This conjugate competes with the patient's analyte for the remaining free antibody.
3. When antibody binds to the enzyme-analyte conjugate, it physically blocks substrate access to the enzyme's active site or alters enzyme conformation - thereby inhibiting enzyme activity.
4. The resultant enzyme activity is measured spectrophotometrically.
5. The change in enzyme activity is proportional to the analyte concentration in the sample. High analyte in the sample → less antibody binds the enzyme conjugate → higher enzyme activity. Low analyte → more inhibition → lower enzyme activity.
6. Concentration is calculated from a calibration curve using known calibrators.

• No separation/washing step required (homogeneous assay)
• Easily run on automated clinical analysers
• Used for therapeutic drug monitoring, drugs of abuse screening, and hormone assays
• Limitation: can produce false positives (e.g., EMIT-based opiate screens can give false positives with naltrexone and nalmefene, as these are oxymorphone derivatives)

b) DNA Typing and Courts

• In 1980, Botstein et al. described restriction fragment length polymorphism (RFLP) analysis of DNA.
• In 1985, Sir Alec Jeffreys coined the term "DNA fingerprinting" and first proposed its use in forensic identification.
• Commercial labs began DNA-based parentage and criminal casework in 1986; government crime labs followed in 1989.

• A match at 8-16 polymorphisms is expressed as a probability (e.g., 1 in 3 million chance of a random match within an ethnic population). This requires population-specific frequency databases.
• Exclusion is far more definitive than inclusion - a non-match firmly excludes a suspect, whereas a match only gives a probability.
• Courts have challenged DNA evidence on grounds of:
  • Contamination of samples
  • Errors in sample collection or chain of custody
  • The immense sensitivity of PCR amplifying minute amounts of extraneous, unrelated DNA
  • Statistical interpretation, particularly choice of population database

c) Haptoglobins

• Conserving body iron and protein
• Preventing renal tubular damage (free Hb at ~65 kDa passes the glomerulus; the large Hp-Hb complex at ~155 kDa does not)
• Routing hemoglobin for reticuloendothelial breakdown via the CD163 monocyte/macrophage scavenger receptor

• Hp 1-1 (homozygous Hp1): single molecular species, MW ~100,000 Da
• Hp 2-2 (homozygous Hp2): a series of multimers via intermolecular disulfide bonds
• Hp 2-1 (heterozygous): Hp1-1 plus dimers, trimers (multimers)

• Free haptoglobin: ~4-5 days
• Hb-Hp complex: ~90 minutes (cleared rapidly by RES)

• Undetectable haptoglobin is virtually pathognomonic of intravascular hemolysis (sensitivity 83%, specificity 96%; LR+ = 21)
• Must be combined with LDH (usually elevated in hemolysis) for diagnosis
• Myoglobin does not bind haptoglobin, so rhabdomyolysis does not reduce haptoglobin levels - this distinction is useful when evaluating a positive urine dipstick for "blood"
• Type 2-2 haptoglobin in diabetes mellitus is associated with higher risk of vascular complications, possibly due to impaired hemoglobin clearance leading to increased oxidative load

d) Postmortem Redistribution of Drugs

1. Passive diffusion from tissues to blood: During life, active mechanisms concentrate drugs in organs and tissues. After death, cell membranes lose integrity and drugs diffuse down concentration gradients back into blood vessels - particularly from drug-rich organs (liver, lung, myocardium) into adjacent central vessels.
2. Uneven distribution in blood compartment: Central blood (e.g., heart blood, pulmonary vessels) shows much higher drug concentrations than peripheral samples (e.g., femoral artery). Femoral blood is therefore preferred as the gold-standard sampling site.
3. Postmortem synthesis: Some compounds are generated de novo after death - e.g., gamma-hydroxybutyrate (GHB) is produced endogenously, and yeasts introduced through trauma can metabolise glucose to ethanol.
4. Drug degradation: Bacteria can degrade certain drugs (e.g., clonazepam, nitrazepam); cocaine metabolism also appears to continue postmortem (or due to chemical instability of the parent compound).

• Volume of distribution (Vd): Drugs with a large Vd (i.e., extensive tissue binding) show the greatest PMR - postmortem levels can be 10x or more above in-life levels
• Time since death and storage temperature: PMR is time- and temperature-dependent
• Site of blood collection: Central > peripheral concentrations

• An isolated postmortem blood concentration cannot reliably be interpreted without in-life reference concentrations.
• High postmortem levels alone must not be taken as evidence of fatal overdose without corroborating clinical/pathological evidence.
• Expert toxicological advice is mandatory when interpreting the role of drugs in a death.
• Reference: Ketola and Kriikku, and Ketola and Ojanpera systematic reviews are cited as key resources in postmortem toxicology.

Disaster Victim Identification (DVI) in a Mass Casualty Event

(a) Interpol DVI Protocol - Primary and Secondary Identifiers

Overview of the Protocol

1. Scene - body recovery, tagging, and preservation of chain of custody
2. Mortuary (Post-Mortem, PM) - examination, documentation, sample collection from remains
3. Ante-Mortem (AM) data collection - gathering records from families, hospitals, dentists, police
4. Reconciliation (Matching) - comparing PM findings against AM data to confirm identity

PRIMARY Identifiers

• Samples collected PM: blood, tissue, bone, tooth pulp (teeth survive extremely high temperatures)
• Compared against AM reference samples: buccal swabs from close biological relatives (parents, siblings, children), or pre-existing biological material (stored blood, toothbrush, razor, hairbrush)
• STR (short tandem repeat) profiling across multiple loci is standard; mitochondrial DNA is used when only maternal lineage reference is available
• The Interpol I-Familia database facilitates kinship matching internationally
• Strength: highly discriminating (1 in billions); weakness: time-consuming (days to weeks), expensive, requires laboratory infrastructure and reference samples
• In a train crash with 200 victims, DNA is usually the final confirmatory method for fragmented or burned remains where other methods fail

• Dactyloscopy (fingerprint comparison) including plain fingerprints, rolled prints, and palm prints
• Rapid: results available within hours when AM records exist (national criminal databases, passport records, employment records)
• Survives moderate decomposition and burning if dermis is preserved
• Limitation: AM records must exist - not all 200 victims will be on file in a national fingerprint database
• Latent prints from victims' homes or workplaces can be retrieved as AM material

• Detailed PM dental charting and radiography compared against AM dental records from treating dentists
• Teeth are the hardest tissue in the body - they survive fire, water, and severe trauma
• Unique combination of teeth present/absent, restorations, implants, morphology, root patterns makes dental identification highly discriminating
• Can be completed within hours once AM records are retrieved
• Software platforms (WinID, DVI System International, UVIS/UDIM) rank-order candidate matches
• See section (b) for detailed methodology

SECONDARY Identifiers

• Height, weight, sex, age, ethnicity, body build, eye colour, hair colour and length
• Distinguishing features: tattoos, birthmarks, scars, surgical scars, piercings
• Documented systematically by the pathologist at PM examination
• Compared against AM descriptions from family or official records (passport, driving licence)
• Limitation: highly unreliable as a sole method - visual identification by grieving family members is not acceptable under Interpol guidelines and should be avoided as the sole means

• Previous surgical history: appendectomy scar, caesarean scar, colostomy site
• Radiological features: healed fractures (with specific callus patterns), bone anomalies, scoliosis
• Unique implants: orthopaedic hardware, breast implants, cardiac devices
• Medical conditions leaving anatomical traces: joint replacements, aneurysm clips
• AM records sourced from hospitals, GPs, specialist clinics

• Clothing, jewellery, watches, wallets, ID documents found on or near the body
• Useful for initial scene triage and cross-referencing
• Major limitation: effects can be displaced in a crash, belong to another person, or be destroyed
• Should always be corroborated by a primary identifier before a formal identification is issued

• Family-provided photographs and social media images may assist in narrowing candidates
• Visual identification by a witness or family member is notoriously unreliable and must never be used as the sole identification method - emotional distress severely impairs objective recognition

Closed vs Open Disaster

• The AM data pool is defined from the outset
• Interpol's reconciliation software can efficiently match PM to AM records
• All 200 victims should theoretically be identifiable if AM records are retrievable

(b) Role of Forensic Odontology in Mass Disaster Identification

Why Teeth?

• Teeth are the hardest and most durable biological tissue - enamel survives temperatures exceeding 1,000°C before fragmenting
• Each adult has up to 32 teeth, each with five surfaces (mesial, distal, buccal, lingual, occlusal), creating a theoretical matrix of 160 recording sites
• The dental state at any given time is a cumulative record of development, disease, trauma, and treatment - a unique biological signature
• Unlike DNA, dental comparison can yield results within hours, making it the fastest primary method when AM records are available

Phase 1 - Postmortem (PM) Dental Examination

1. Visual examination and photography: All teeth present, missing, erupted, or partially erupted are documented. The condition of the oral soft tissues, lips, and bony structures is noted.
2. PM dental charting: Using standardised Interpol DVI forms (or digital equivalents like DVI System International), each tooth is recorded for:
   • Presence/absence
   • Restorations: material (amalgam, composite, gold, porcelain), surface(s) involved
   • Crowns, bridges, veneers, partial/full dentures
   • Implants (with manufacturer details if visible)
   • Caries (active and treated)
   • Fractures, attrition, erosion
   • Root canal treatment
   • Orthodontic appliances
3. PM radiography: A full periapical series (ideally 14-18 films) and/or panoramic radiograph (OPG) is taken. Radiography reveals:
   • Root morphology (root length, curvature, number of canals) - these are unique anatomical features not visible externally
   • Alveolar bone patterns
   • Pulp chamber dimensions and shape
   • Periapical pathology
   • Root fillings and their patterns
   • Underlying bone anomalies or disease
   • Implant osseointegration patterns

Phase 2 - Antemortem (AM) Records Retrieval

• The victim's treating dentist (primary source): written charts, radiographs, study models, photographs
• Orthodontist, periodontist, oral surgeon records
• Hospital dental records
• Family-provided information (name of dentist, approximate date of last visit)

• Incomplete, illegible, or using non-standard charting
• From multiple dentists over many years
• Missing (patient never attended a dentist, or records were destroyed)
• In a different country (for international travel events)

Phase 3 - Comparative Analysis

• PM and AM odontograms and radiographs are compared tooth-by-tooth across all 32 positions
• The odontologist assesses: consistencies (features present in both PM and AM data that match) and inconsistencies (discrepant findings)
• Inconsistencies are then classified as:
  • Reconcilable: explainable by treatment occurring after the AM record was made (e.g., a tooth present in AM records but extracted before death)
  • Irreconcilable: incompatible with the same individual (e.g., different number of roots on the same tooth)
• An irreconcilable inconsistency = exclusion
• Sufficient reconcilable consistencies with no irreconcilable inconsistencies = positive identification

• Restorative treatment: the specific combination of materials, surfaces, and margins on restorations is extremely discriminating
• Osseointegrated implants: implant type, position, and bone integration pattern
• Prosthetic appliances: denture designs and clasp positions
• Root morphology: root length, curvature, fusion, dilaceration
• Pulp chamber: age-related secondary dentine deposition narrows pulp space in a predictable but individually variable pattern
• Bone pattern: trabecular bone pattern in the alveolus can be compared radiographically like a fingerprint

Software Platforms

• WinID3: widely used in the US; allows simultaneous entry of AM and PM data and generates ranked match lists
• DVI System International: aligned with Interpol DVI forms; used in Interpol operations since 2005; allows upload of photographs and radiographic images; updated in 2014 to simplify coding
• UVIS/UDIM (UVIS Dental Identification Module): used by the NYC Office of Chief Medical Examiner; integrates seamlessly into day-to-day practice enabling rapid activation in mass disasters
• All platforms generate rank-ordered candidate lists, but expert review of each candidate is mandatory - automated software does not replace the forensic odontologist's final opinion

Outcomes and Conclusions

1. Positive identification: the PM remains and AM records are from the same individual
2. Possible identification: insufficient data but no exclusion; requires additional investigation
3. Insufficient evidence: AM or PM data too poor to reach a conclusion
4. Exclusion: the remains and the AM records are from different individuals

(c) Psychosocial and Ethical Responsibilities of the DVI Team and Role of the Forensic Physician in Death Certification

Psychosocial Responsibilities Toward Families

• The incident scene
• The mortuary facility
• Media and press areas

• Collection of AM data (interviewing families for physical descriptions, dental and medical information, retrieving personal effects for comparison)
• Providing regular, honest updates on the identification process and timeline
• Death notification - delivered by a team (never a single individual) comprising a representative of the medical examiner or coroner, a mental health professional, clergy if appropriate, and possibly a medical professional
• Coordinating family access to remains once identification is confirmed
• Assisting with repatriation for non-local/international victims

• Families must be told the truth about the condition of remains, even when this is distressing
• False hope must not be given - identifications should only be announced when scientifically confirmed
• Families must not be subjected to visual identification as a sole method
• Regular briefings should be structured, consistent, and sensitive
• Social media monitoring can assist when family contact has been distant or when the victim's circumstances in the period before death are unclear

Ethical Responsibilities

• Dignity of the deceased: remains must be handled respectfully at all times; body parts must be reassembled where possible before release
• Accuracy over speed: while timely identification is important for family closure, premature or incorrect identification causes profound re-traumatisation. Confirmation must always precede notification
• Equity: all victims are entitled to equal effort regardless of age, nationality, social status, or the political context of the event
• Chain of custody: rigorous documentation protects both the integrity of any criminal investigation and the rights of families
• Cultural and religious sensitivity: the DVI team must be alert to cultural requirements regarding handling of remains, speed of burial, and autopsy consent

Role of the Forensic Physician in Issuing Death Certificates

1. Overseeing all aspects of the death investigation at the incident scene and the morgue
2. Performing or supervising postmortem examinations to establish cause of death
3. Issuing death certificates for all victims - this is a legal requirement and cannot be delegated to lay personnel

• Cause of death: the train crash will typically produce multiple mechanisms (blunt force polytrauma, crush injury, burns, inhalation injury, exsanguination) - the forensic pathologist must determine the immediate cause and any underlying contributing factors
• Manner of death: accident (in a non-criminal crash), or homicide (if negligence or deliberate action is established)
• Identity of the deceased: the ME/C can only issue a certificate once a positive identification has been confirmed through the DVI process; premature certification before identity is established is both legally and ethically improper
• Estimated time of death: usually the time of the incident in a closed disaster

• Where remains are fragmented or commingled (parts of multiple individuals mixed together), the ME/C must work with the DVI team to ensure each fragment is attributed to the correct individual before any certificate is issued
• Where cause of death cannot be determined from the available remains (e.g., only dental remains recovered), the certificate may record "consistent with injuries sustained in the [X] train disaster" based on contextual evidence
• Death certificates are required for families to access legal rights: probate, insurance, pension, and in some jurisdictions, travel documents for repatriation
• The ME/C also coordinates with the coroner's inquest or equivalent judicial inquiry, which may be mandatory following a mass transport accident and which may require forensic testimony

Forensic Clinical Toxicology in Emergency Settings

(a) Toxidrome Recognition and Management

What Is a Toxidrome?

• Individual agent variability within a class (e.g., meperidine is an opioid but does not cause miosis)
• Coingestants can mask or modify features (e.g., a patient on beta-blockers may not show tachycardia in a sympathomimetic overdose)
• Comorbid conditions alter baseline physiology
• Mixed overdoses produce overlapping or contradictory features

1. Anticholinergic Toxidrome

• Supportive: cooling for hyperthermia, benzodiazepines for agitation/seizures
• Antidote: physostigmine (a reversible acetylcholinesterase inhibitor that crosses the BBB) - used for severe delirium, seizures, or life-threatening dysrhythmias; contraindicated in TCA overdose (risk of asystole)
• Catheterisation for urinary retention; monitoring for rhabdomyolysis from hyperthermia

2. Cholinergic Toxidrome

• Muscarinic effects: SLUDGE - Salivation, Lacrimation, Urination, Defaecation, GI cramping, Emesis; or DUMBELS - Defaecation/Diarrhoea, Urination, Miosis, Bradycardia/Bronchospasm/Bronchorrhoea, Emesis, Lacrimation, Salivation
• Nicotinic effects (Days of the Week): Mydriasis, Tachycardia, Weakness, Fasciculations, Seizures (note that nicotinic effects may override muscarinic miosis, causing mydriasis)

• Atropine: given in large, repeated doses (2-4 mg IV boluses titrated to drying of secretions and resolution of bronchospasm - NOT to heart rate or pupil size). May require hundreds of mg in severe organophosphate poisoning.
• Pralidoxime (2-PAM): oxime that reactivates acetylcholinesterase; effective only before "ageing" (irreversible binding) occurs - must be given within hours of organophosphate exposure
• Benzodiazepines for seizures
• Airway management: bronchorrhoea and bronchospasm are the most life-threatening features

3. Opioid Toxidrome

• Naloxone: direct opioid receptor antagonist; given IV/IM/intranasal; titrated in small increments (0.04-0.4 mg IV) to restore respiratory drive without precipitating acute withdrawal
• A rapid response to naloxone confirms the diagnosis clinically (although absence of response does not exclude opioids - highly potent synthetic opioids like carfentanil may require much higher naloxone doses)
• Not all opioids are detected on standard immunoassay urine screens (fentanyl, tramadol, buprenorphine, methadone may not appear on routine panels)
• Continuous infusion of naloxone may be needed for long-acting opioids (methadone, sustained-release morphine)

4. Sedative-Hypnotic Toxidrome

• Supportive: airway protection, ventilatory support
• Flumazenil reverses benzodiazepines but is generally avoided in the ED setting due to risk of precipitating seizures in benzodiazepine-dependent patients and masking coingestant effects
• Severe alcohol/benzodiazepine withdrawal: benzodiazepines titrated to symptom relief; phenobarbital for refractory cases; early thiamine for Wernicke prophylaxis

5. Sympathomimetic Toxidrome

• Benzodiazepines are first-line for agitation, hypertension, hyperthermia, and seizures
• Aggressive cooling for hyperthermia (the leading cause of death)
• Avoid beta-blockers alone (risk of unopposed alpha stimulation worsening hypertension)
• Dysrhythmias: sodium bicarbonate for cocaine-induced QRS widening (sodium channel block)

Additional Toxidromes to Recognise in the ED

• Serotonin syndrome: hyperthermia + altered mental status + neuromuscular abnormalities (clonus, hyperreflexia, rigidity) - typically from MAOI + serotonergic drug combination; managed with cyproheptadine and benzodiazepines
• Neuroleptic malignant syndrome (NMS): hyperthermia, rigidity, autonomic instability, elevated CK - onset over days not hours; managed with dantrolene, bromocriptine
• Hyperthermic syndromes distinguish by: onset speed, neuromuscular findings, drug history, CK level, and acid-base status

Initial Management Framework (All Toxidromes)

1. Bedside glucose - hypoglycaemia mimics toxic coma and is rapidly reversible
2. Secure the airway early if gag reflex is impaired; capnography to detect CO2 narcosis
3. ECG - numerous toxins produce QT or QRS prolongation (a key diagnostic and prognostic sign)
4. IV access, continuous cardiac monitoring, urinary catheter in unstable patients
5. ABG with co-oximetry - identifies acidosis (salicylates, methanol), carboxyhaemoglobin (CO), and methaemoglobinaemia
6. Decontamination: Activated charcoal (50 g orally) within 1 hour of ingestion in alert, cooperative patients for potentially lethal agents. Gastric lavage and ipecac are no longer recommended in routine ED care.
7. Enhanced elimination: Urinary alkalinisation with sodium bicarbonate for salicylates, phenobarbital, methotrexate. Haemodialysis for methanol, ethylene glycol, lithium, salicylates (low MW, low protein binding, water-soluble).

(b) Pitfalls in Clinical Toxicological Diagnosis

1. Overreliance on the History

• Poisoned patients may be obtunded, uncooperative, or deliberately misleading (especially in intentional self-poisoning)
• A suicidal patient may name one agent while having taken several others
• Confusion between similar-sounding medications is common (ibuprofen/aspirin, paracetamol/aspirin)
• History must be supplemented with physical examination findings, medication bottles from the scene (paramedics should retrieve all bottles present, not just the alleged ingestion), collateral from family/witnesses, and laboratory testing

2. False Positives and False Negatives in Immunoassay Drug Screens

• Opiates screen: positive with dextromethorphan, quinolone antibiotics, rifampicin, poppy seeds
• EMIT opioid screens: false positives with naltrexone and nalmefene (oxymorphone derivatives)
• PCP screen: ketamine, dextromethorphan, diphenhydramine, venlafaxine
• Amphetamine screen: pseudoephedrine, phenylephrine, MDMA (may or may not cross-react), labetalol, ranitidine, bupropion
• Benzodiazepine screen: oxaprozin, sertraline
• THC (cannabis) screen: hemp products, dronabinol, NSAIDs (oxaprozin)
• TCA screen: carbamazepine, cyclobenzaprine, diphenhydramine, quetiapine

• Designer/novel psychoactive substances (NPS) and synthetic opioids (fentanyl, tramadol, buprenorphine, carfentanil) are not detected on standard immunoassay panels
• Designer synthetic cannabinoids ("spice") are not detected on standard THC screens
• A negative urine screen does not exclude poisoning with an undetectable agent
• Low sensitivity for recent exposure if urine has not yet accumulated the drug or metabolite

3. Pulse Oximetry Pitfall

• A patient with carboxyhaemoglobin (CO poisoning) or methaemoglobinaemia may show normal SpO2 on standard pulse oximetry (which cannot distinguish oxyhaemoglobin from COHb/metHb)
• This creates a false sense of security: the patient may have severe tissue hypoxia while appearing well-oxygenated
• Co-oximetry (ABG) is mandatory when CO or metHb poisoning is suspected

4. Toxidrome Masking by Coingestants or Comorbidities

• Beta-blockers mask tachycardia in sympathomimetic or anticholinergic overdose
• Prior sedative use blunts agitation in serotonin syndrome
• Hypothyroidism, head injury, stroke, hypoglycaemia, and sepsis can all mimic toxic CNS depression
• Mixed overdoses (the most common real-world scenario) produce hybrid or atypical toxidromes

5. Failure to Consider Delayed Toxicity

• Paracetamol (acetaminophen): initial presentation may be minimal symptoms; hepatotoxicity peaks at 72-96 hours; serum levels must be checked in all overdoses
• Oral anticoagulants (warfarin, superwarfarin rodenticides): bleeding occurs days later
• Sustained-release preparations (calcium channel blockers, beta-blockers, opioids): peak effects delayed by hours; patients who appear well at 6 hours may deteriorate rapidly
• Methanol and ethylene glycol: initially present like ethanol intoxication; anion-gap metabolic acidosis and organ toxicity develop as toxic metabolites (formate, oxalate) accumulate

6. Hypoglycaemia as a Masquerader

• Hypoglycaemia produces coma, seizures, agitation, and altered behaviour indistinguishable from toxic or neurological causes
• Bedside glucose must be the first test in any altered patient before toxidrome assessment is anchored

7. Anchoring Bias

• Committing to one diagnosis (e.g., "heroin overdose") without considering coingestants or alternative diagnoses leads to missed management opportunities
• The ED clinician must consider the entire differential even when a plausible toxidrome is identified

8. ECG Interpretation Errors

• TCA overdose: QRS > 100 ms and terminal R wave in aVR are the key indicators of toxicity - missing these can lead to delayed bicarbonate therapy and fatal dysrhythmias
• QT prolongation: many drugs (antipsychotics, antihistamines, macrolides, antifungals, methadone) prolong QT; failure to identify this risks torsades de pointes

(c) Role of Plasma Drug Monitoring in Medico-Legal Cases

Clinical vs Forensic Toxicology: Key Distinction

Why Plasma/Serum Levels Matter Medico-Legally

1. Correlation with clinical state: A quantitative serum paracetamol level at specific time post-ingestion (plotted on the Rumack-Matthew nomogram) determines hepatotoxicity risk and guides N-acetylcysteine therapy. In a medico-legal context, this level establishes the likely dose taken and time of ingestion.
2. Establishing therapeutic vs toxic vs lethal concentrations: Published therapeutic reference ranges and fatal concentration data allow the forensic physician/toxicologist to opine on whether a measured level is consistent with therapeutic use, misuse, or lethal overdose.
3. Drugs requiring urgent quantitative levels in the ED (with medico-legal relevance):
   • Paracetamol (acetaminophen)
   • Salicylates
   • Ethanol
   • Methanol and ethylene glycol
   • Lithium
   • Digoxin
   • Iron
   • Carbon monoxide (COHb%)
   • Phenobarbitone, phenytoin, carbamazepine
   • Theophylline
   • Methotrexate
4. Drug-facilitated assault and sexual assault: Blood and urine levels of GHB, benzodiazepines, ketamine, and ethanol taken within hours of an alleged assault are critical forensic evidence. Timing of collection matters enormously - GHB has a half-life of only ~20 minutes and is undetectable within 4-8 hours.
5. Driving under the influence (DUI) cases: Blood ethanol levels, along with quantitative levels of prescribed sedatives, opioids, or cannabis metabolites, are used in legal proceedings. Timing of blood draw relative to driving must be documented precisely.
6. Workplace and occupational poisoning: Quantitative plasma levels establish causation in cases of industrial chemical exposure, supporting or refuting workers' compensation claims.
7. Child abuse/fabricated illness: Quantitative serum levels of substances administered to a child (e.g., salt, insulin, sedatives) are often the only objective evidence in Munchausen by proxy (factitious disorder imposed on another) cases.

Interpretation Considerations

• A measured plasma level must always be interpreted in the context of time since ingestion, clinical state, renal and hepatic function, and the route of administration
• In postmortem cases, plasma levels from cardiac blood may be unreliable due to postmortem redistribution (see earlier discussion) - peripheral femoral blood is preferred
• For drugs with active metabolites (e.g., diazepam/desmethyldiazepam, codeine/morphine), the metabolite pattern itself carries diagnostic and medico-legal significance
• High plasma levels alone do not constitute evidence of overdose or lethal poisoning without clinical and pathological correlation

(d) Documentation and Chain of Custody in Emergency Toxicological Evidence

Why Chain of Custody Matters

Core Principles of Chain of Custody

1. The specimen was collected from the correct individual (verified identity)
2. The specimen was not tampered with, substituted, or contaminated at any point
3. Every person who handled the specimen is identified by signature with date, time, and purpose of action

Step-by-Step Documentation Protocol

• Verify and document patient identity (two identifiers: name + date of birth, or hospital number)
• Document the reason for collection and requesting clinician/officer
• Document date, time, and site of collection precisely (e.g., 14:37 hrs, right antecubital fossa, 23 November)
• Use tamper-evident, sealed containers - the seal must be intact when received by the laboratory
• Label the container immediately at the bedside (never prelabel or label from memory)
• Complete the Custody and Control Form (CCF) / evidence bag documentation - errors on this form (missing collector signature, absent temperature documentation for urine specimens, absent physician's name) can invalidate the specimen
• The collector must sign the CCF; the patient or police officer may countersign to confirm witnessed collection
• Temperature of urine specimen must be measured and documented immediately (acceptable range: 32-38°C within 4 minutes of voiding) to exclude substitution

• Unique specimen identifier (accession number or case number)
• Patient full name and date of birth
• Date and time of collection
• Type of specimen
• Collector's name

• Each transfer of custody must be documented: from whom, to whom, date, time
• Specimens must remain in sealed, tamper-evident packaging
• Refrigerated storage is the minimum standard; frozen storage for extended retention
• Incident-related specimens cannot be recollected - they are unique, time-critical evidence and must be treated with the highest care from the moment of collection

• All positive immunoassay screens must be confirmed by gas chromatography-mass spectrometry (GC-MS) or liquid chromatography-tandem mass spectrometry (LC-MS/MS) before any medico-legal reporting
• The laboratory must be CLIA-certified (or national equivalent); forensic testing may require additional accreditation (e.g., CAP FDT accreditation in the US)
• Chain of custody documentation must be maintained throughout: accessioning, temporary storage, analysis, long-term storage, and disposal
• Laboratories not accredited for forensic testing should nonetheless retain negative specimens for 48-72 hours and all positive and paediatric specimens for extended periods - particularly given that law enforcement or the medical examiner's office may later request them

• Refrigerated storage minimum; frozen for extended retention
• Storage duration should be guided by statute of limitations for the relevant offence and institutional policy

The Critical Distinction: Clinical vs Forensic Specimens

• The absence of chain of custody documentation may render it inadmissible
• The defence may argue contamination or substitution

Documentation by the Forensic Physician / Emergency Clinician

• Record the exact clinical state on presentation (GCS, vital signs, pupil size, skin findings, breath odour)
• Note the time of presentation and any treatment already given before assessment (pre-hospital naloxone, for example, changes the clinical picture)
• Record all suspected or known agents, route of exposure, and timing
• If specimens are collected for forensic purposes, document this explicitly including the chain of custody reference number
• In cases of suspected drug-facilitated assault: document the history of alleged events, any symptoms reported (amnesia, sedation, sexual symptoms), and ensure forensic specimens are collected with urgency given the short detection windows of many agents
• Photographic documentation of injuries (with scale marker and consent) before any treatment that alters them

Characteristic Odours as Diagnostic Clues (Documentation Aid)

a) Deepfake Technology and Forensic Challenges

Definition

How Deepfakes Are Created

Forensic and Societal Threats

Forensic Detection Methods

• Spatial and pixel-level analysis: Convolutional Neural Networks (CNNs) detect blurring at facial boundaries, unnatural skin textures, inconsistent lighting angles, and pixel-level distortions around hair, teeth, and ears
• Temporal inconsistency analysis: In videos, deepfakes often fail to maintain consistent facial movements across frames - unnatural blinking patterns, irregular lip sync, and head movement artefacts are detectable
• Biological cue analysis: Real humans exhibit subtle physiological signals (e.g., photoplethysmographic pulse visible as colour changes in skin) that deepfakes frequently fail to replicate accurately
• Frequency-domain analysis: Techniques such as Discrete Cosine Transform (DCT) and Discrete Wavelet Transform (DWT) - e.g., the High-Frequency Enhancement (HiFE) network - recover high-frequency details lost during compression that reveal manipulation signatures
• Deepfake attribution / model fingerprinting: Just as camera source identification traces a photograph to a specific camera, deepfake model recognition traces synthetic media to the specific AI model that generated it - this is an emerging forensic discipline
• Provenance tools: Content authenticity initiatives (e.g., C2PA - Coalition for Content Provenance and Authenticity) embed cryptographic metadata at the point of creation; tools like Google DeepMind's SynthID watermark AI-generated content

Key Forensic Challenges

1. Adversarial arms race: Detection tools are trained on known deepfake methods; generators continuously evolve to defeat them. Current detectors are fragile against novel generation techniques not seen in training data.
2. Compression degradation: Deepfakes shared on social media undergo lossy compression (JPEG, MPEG), which obscures the subtle artefacts that detectors rely on, dramatically reducing detection accuracy.
3. Explainability deficit: Most deep learning detectors function as "black boxes" - they flag content as fake but cannot explain why in terms a court can evaluate. This is incompatible with the legal standards for expert evidence.
4. Admissibility battles: Courts now face "battle of the experts" scenarios where both prosecution and defence retain AI forensic specialists with opposing opinions. This raises the access to justice gap - only well-resourced parties can afford high-quality forensic AI analysis.
5. Dataset scarcity: Detection models require large, diverse, high-quality deepfake training datasets, which are difficult to curate and quickly become outdated.
6. Audio-visual multimodal deepfakes: Most detection research focuses on visual-only content; combined audio-video deepfakes remain significantly harder to detect.
7. Legal framework lag: Regulation of deepfakes remains inconsistent across jurisdictions. Many countries lack specific legislation criminalising their malicious use, creating an enforcement vacuum.

Forensic Best Practices

• Treat all digital media as potentially manipulated; authenticate before admission
• Use multiple independent detection methods; no single tool is reliable alone
• Document the detection methodology fully for court scrutiny
• Preserve original metadata (EXIF, file timestamps, encoding parameters) - these are often the first line of authenticity verification
• Engage qualified expert witnesses with published, peer-reviewed detection methodologies

b) Digital Evidence Chain of Custody

Definition and Purpose

1. Authentic - it is what it purports to be
2. Integral - it has not been altered, corrupted, or tampered with
3. Traceable - every action taken upon it is accounted for

Why Digital Evidence Demands Special Care

• Invisible to the naked eye and easily altered without leaving obvious traces
• Volatile (e.g., RAM contents are destroyed when power is cut; timestamps change on access)
• Highly reproducible - perfect copies are indistinguishable from originals, but modifications may also be undetectable without hash verification
• Susceptible to remote manipulation, malware contamination, and metadata alteration
• Increasingly voluminous (terabytes of data are now routine in complex cases)

The Digital Evidence Lifecycle and CoC Obligations

• Identify and document all potential sources: computers, smartphones, tablets, cloud storage, CCTV systems, IoT devices, network logs, metadata
• Photograph the scene and device positions before touching anything
• Note the state of devices (powered on/off, open applications, network connections)

• Use write blockers (hardware or software) when imaging storage devices - these prevent any write operation to the original media, preserving its state
• Create a forensic image (bit-for-bit copy) using validated tools (e.g., FTK Imager, EnCase, dd) rather than working on original media
• Calculate a cryptographic hash value (MD5, SHA-1, or SHA-256) of the original at acquisition - this is the mathematical "fingerprint" of the data at that moment
• Document the hash value in the CoC form immediately
• For live systems (e.g., an active server), document that live collection may alter evidence and record exactly what changes occurred

• Place physical devices in tamper-evident, anti-static evidence bags signed across the seal
• Label with: unique identifier, description, case number, date/time of collection, collector's name
• Seal computers and drives - labels/seals should cross the seam so any opening is visible
• Faraday bags for mobile devices (prevent remote wipe commands via cellular/Wi-Fi signals)
• Store in a secure, locked evidence facility with restricted access and an access log

• Every transfer of the evidence - from officer to lab, from lab to analyst, from analyst to court - must be documented with: name of person receiving, name of person transferring, date, time, reason
• Continuous physical custody is preferred; where postal/courier transfer is necessary, tamper-evident packaging with tracking must be used

• Analysis must be performed on the forensic copy, never the original
• All analysis steps are documented in an examination log (what tool was used, version, settings, date, analyst)
• Re-hash the forensic image before and after analysis - if the hash matches the original acquisition hash, integrity is confirmed
• Use only validated, court-accepted forensic tools (EnCase, FTK, Autopsy, Cellebrite for mobile devices)

• Minimum documentation required at each stage:
  • Identity of all persons handling the specimen/device
  • Date and time of each action
  • Purpose of the action (collection, transfer, analysis, storage, disposal)
  • Hash values confirming integrity
• Chain of custody forms may be paper or electronic; electronic systems with audit trails are preferred for completeness and tamper-resistance

• The forensic examiner must be able to testify that the evidence they analysed is identical to what was originally seized - proven by matching hash values end-to-end
• Any deviation from protocol must be disclosed and explained; its impact on evidential integrity must be assessed

Common Failures That Break Chain of Custody

• Powering on a seized device before imaging (alters timestamps, logs, potentially overwrites data)
• Failing to use a write blocker
• Working on the original rather than a forensic copy
• Gaps in the documentation (no record of who had the evidence overnight)
• Inadequate storage (evidence left unattended, accessible to unauthorised personnel)
• Using unvalidated or unlicensed forensic tools
• Failure to calculate and document hash values

c) OSINT (Open Source Intelligence)

Definition

Sources of OSINT Data

The OSINT Process

1. Define objectives: Clearly state what intelligence is required and what legal authorities apply
2. Collection: Gather raw data from identified sources using automated tools and manual research
3. Processing: Organise, translate, and filter raw data into usable formats
4. Analysis: Cross-reference sources, identify patterns, verify authenticity, establish timelines
5. Dissemination: Produce a structured, documented intelligence report
6. Feedback: Review intelligence needs and refine the collection strategy

Key Techniques

• Social media analysis (SOCMINT): Mapping an individual's network, movements, associates, and statements from public profiles; tracking usernames across platforms
• Geolocation: Using environmental clues (architecture, vegetation, road markings, signage) in photographs or videos to pinpoint a geographic location - widely used in conflict zone verification (e.g., Bellingcat's work in Ukraine)
• Metadata analysis: Extracting EXIF data from photographs to determine when, where, and on what device an image was taken
• Reverse image search: Google Images, TinEye, and Yandex to identify the origin of an image, detect reuse, or link an unidentified person to other sources
• Link analysis: Mapping connections between individuals, organisations, telephone numbers, email addresses, and financial accounts
• Dark web monitoring: Tracking criminal marketplaces, hacking forums, and stolen data listings
• Financial intelligence (FININT): Tracing cryptocurrency transactions, identifying beneficial ownership through public corporate records
• Signals and network intelligence: WHOIS lookups, IP attribution, domain registration history

Applications in Forensic Investigation

• Crime scene corroboration: Geolocating photographs, verifying timelines, identifying vehicles from public CCTV or social media
• Suspect identification: Linking online aliases to real identities through cross-platform username analysis, image matching, and network mapping
• Human trafficking and exploitation investigations: Identifying victims and perpetrators through classified advertisement platforms, social media, and financial records
• Cybercrime: Attributing malware, ransomware groups, and phishing campaigns to specific threat actors using technical OSINT
• Counter-terrorism: Identifying radicalisation, recruiting networks, and attack planning through open online communications
• Missing persons: Tracing last known digital activity, social media connections, and location data

Legal, Ethical, and Operational Considerations

• Legality: OSINT by definition uses publicly available data, but jurisdictions vary in what constitutes "public" - accessing password-protected accounts, even if easily guessed, may constitute unauthorised access
• Admissibility: OSINT findings must be properly documented with screenshots, URL captures (archived via Wayback Machine or archive.today), and timestamps to withstand challenge; metadata proving authenticity is essential
• Anonymity (managed attribution): Investigators must protect their own identity during OSINT collection to avoid alerting suspects, compromising the investigation, or creating personal safety risks - VPNs, browser isolation, and dedicated research accounts are standard practice
• Privacy and proportionality: Even public data collection must be proportionate to the investigative need; bulk collection of personal data may engage data protection legislation (e.g., GDPR in Europe)
• Source verification: OSINT data must be critically evaluated - social media posts can be fabricated, photographs manipulated, and accounts impersonated; independent verification through multiple sources is mandatory before intelligence is acted upon
• Documentation for court: All OSINT findings must be stored securely with full provenance documentation to maintain chain of custody standards if used as evidence

Notable Real-World Applications

• Bellingcat used OSINT to identify the Russian GRU officers responsible for the 2018 Salisbury novichok attack
• OSINT investigators geolocated and identified perpetrators of the January 6, 2021 US Capitol attack from social media posts and photographs
• Europol and Interpol use OSINT extensively in cybercrime and human trafficking operations

d) Sexual Assault Nurse Examiner (SANE)

Definition and Background

• SANE-A: certified for adult and adolescent patients
• SANE-P: certified for paediatric patients

Training Requirements

• Anatomy review (including normal anatomical variants - critical to avoid over-reading normal findings as injuries)
• Taking the medical-forensic history
• Head-to-toe assessment for female and male patients
• Forensic documentation and photography
• Trauma identification and injury pattern recognition
• Evidence collection and packaging techniques
• Drug-facilitated sexual assault
• STI assessment, prophylaxis, and pregnancy evaluation and prevention
• Strangulation assessment
• Courtroom preparation and expert witness testimony
• PTSD and vicarious trauma management for the examiner
• Skills practice sessions with mock case studies

Core Roles and Responsibilities

• Immediate physical and psychological assessment
• Treatment of injuries: wound care, analgesia
• Emergency contraception: provided where indicated
• STI prophylaxis: empirical treatment and testing (HIV post-exposure prophylaxis consideration, gonorrhoea, chlamydia, hepatitis B)
• Pregnancy testing and options counselling

• Medical-forensic history: detailed account of the assault (type of contact, areas of the body involved, any post-assault hygiene or clothing changes) to guide evidence collection strategy
• Full body physical examination: documentation of injuries (abrasions, bruising, lacerations, bite marks) using anatomical diagrams and forensic photography with scale markers
• Anogenital examination: using colposcopy for magnified visualisation and photodocumentation; SANE nurses are trained to distinguish between acute injuries, healing injuries, and normal variants - a highly specialised skill
• Evidence collection: swabs from all contact sites, under fingernails, hair combings, saliva, blood samples; collection of victim's clothing; preservation of trace evidence
• All specimens collected into a Sexual Assault Evidence Kit ("rape kit") with strict chain-of-custody documentation

• Contemporaneous, detailed written records form the foundation of any subsequent prosecution
• Precise, neutral, objective language is required - findings are documented, not interpreted in the record
• Diagrams and photographs provide permanent, objective records that may be submitted to court years later
• Documentation must capture the time of examination, time since the alleged assault, and any factors affecting evidence quality (bathing, urination, clothing change)

• The examination is offered, not imposed - consent is required for every component
• The survivor controls the pace and extent of the examination
• The SANE nurse provides emotional support, crisis intervention, and referral to advocacy services throughout
• Critically, a forensic examination can be performed even if the survivor does not wish to report to law enforcement - specimens are collected and held pending the survivor's decision, respecting their autonomy

• Their examination findings and their significance
• Normal versus abnormal findings (and why the absence of injury does not equate to absence of assault)
• Proper evidence collection procedures
• The mechanism of injuries

Advantages of the SANE Model

• Higher quality forensic evidence documentation
• Better DNA evidence collection and yield
• Greater survivor satisfaction and reduced secondary trauma from the examination
• Higher rates of prosecution and conviction compared to cases examined by untrained emergency physicians
• Improved multidisciplinary team (MDT) coordination with law enforcement, advocacy services, and prosecutors

SANE in the Context of the Sexual Assault Response Team (SART)

• The SANE (medical-forensic examiner)
• Law enforcement investigators
• Victim/survivor advocates
• Prosecutors
• Crime laboratory analysts