A Guide for Investigating Fire and Arson

This handbook is intended as a guide to recommended practices for the collection and
preservation of evidence at fire/arson scenes. [1]
Follow Agency Policies!
Actions taken following these guides should be performed in accordance with department policies
and procedures and federal and state laws.
Jurisdictional, logistical or legal conditions may preclude the use of particular procedures contained
herein.
Fires are destructive, spreading as they grow and consuming the evidence of their initiation.
Putting out fires and finding out how they started involves public officials and private groups
such as fire departments, emergency medical services and law enforcement. Law
enforcement and fire service departments must always determine the cause of the fire,
whether arson or accidental, in order to identify hazards and dangerous practices and
prevent future fires. Many fires can be prevented through public education for instance,
educating people on safe practices for using room heaters or other gas and electric devices.
Not every portion of this document may be applicable to all fires. It is at the discretion of
responding personnel (depending on their responsibilities, as well as the purpose and scope
of their duties) to apply the procedures recommended in this Guide to a particular incident.
Some of the procedures described in this Guide may not be performed in the sequence
described or may be performed simultaneously.
Call in Help!
For potentially devastating situations, such as biological weapons or radiological or chemical
threats, contact the appropriate agencies.
Steps in this guide include:

Arriving at the scene.

Evaluating the scene.
Documenting the scene.
Processing evidence at the scene.
Completing the investigation.

A Guide for Investigating Fire and Arson: Arriving at

the Fire and/or Arson Scene
First responders to a fire scene must assess and secure the scene and ensure that victims
receive medical attention.

Observe the fire and scene conditions.

Exercise scene safety.
Preserve the fire scene.
Establish security and control.
Coordinate interagency activities.

Observe the fire and scene conditions. First responders at a fire scene must observe
conditions and activities and provide investigators with an accurate and complete
description.

1
While approaching a fire scene, first responders should observe and mentally note the
following conditions and activities and initiate permanent documentation of the information
(e.g., written notes, voice recordings and videotapes):

The presence, location and condition of victims and witnesses.

Vehicles leaving the scene, bystanders or unusual activities near the scene.
Flame and smoke conditions (e.g., the volume of flames and smoke; the color,
height and location of the flames; the direction in which the flames and smoke are
moving).
The first public safety personnel to arrive on the scene, whether they are law
enforcement professionals, firefighters, or emergency medical services (EMS)
personnel.
The type of occupancy and use of the structure (e.g., a residential occupancy being
used as a business).
Conditions of the structure (e.g., lights turned on; fire through the roof; walls
standing; open, closed, or broken windows and doors).
Conditions surrounding the scene (e.g., blocked driveways, debris, damage to other
structures).
Weather conditions.
Unusual characteristics of the scene (e.g., the presence of containers, exterior
burning or charring on the building, the absence of normal contents, unusual odors,
fire trailers [physical trails of fuel and the burn patterns caused by those trails]).
The fire suppression techniques used.
The status of fire alarms, security alarms and sprinklers.

Exercise scene safety. Safety overrides all other concerns. First responders must make
sure that victims, bystanders, and public safety personnel are safe. This involves mitigating
safety hazards that may further threaten victims, bystanders, and public safety personnel.
They must exercise due caution to avoid injuries to themselves and others.
First responders should:

Evaluate the scene for safety hazards (e.g., structural collapse of the building;
smoke; electrical, chemical or biological hazards; other health risks).
Establish safety/hazard zones.
Communicate hazards to other personnel arriving at the scene.
Use tools and personal protective equipment appropriate to the task during all
operations.

DANGER:Beware of incendiary or explosive devices! The scene may contain devices

specifically designed to kill or maim public safety responders. Do not touch any suspected
incendiary or explosive device. Evacuate the area, and request the services of personnel
trained in the removal of such items.
Preserve the fire scene. First responders must understand how rescue, medical, fire
suppression, overhaul, and salvage efforts can adversely affect evidence and take steps to
preserve it. They should secure the fire scene and identify potential evidence, take
preliminary steps to preserve it, and notify appropriate authorities about its existence.
First responders should:

Observe and mentally note evidence at the scene, such as:

o Fire patterns (including multiple fire locations).
o Burn injuries to victims and fire patterns on clothing.

2
 o Trailers, ignitable liquids or other unusual fuel distribution (e.g., piles of
newspapers and/or furniture pushed together).
o Incendiary/ignition/explosive devices (e.g., lighters, matches and timing
devices).
o Shoe prints and tire impressions.
o Broken windows and doors.
o Distribution of broken glass and debris.
o Indications of forced entry (tools and tool marks).
o Containers.
o Discarded clothing.
o Trace evidence (e.g., hairs, fibers, fingerprints, blood and other body fluids).
o Evidence of crimes in addition to the possible arson (e.g., weapons, bodies,
drugs and/or clandestine drug laboratory equipment).
o Witnesses, bystanders and victims.
o Any other unusual items or the absence of normal contents or structural
components.
Recognize threats to evidence (i.e., its movement, removal, contamination or
destruction) from any of the following sources:
o Fire-suppression activities that may wash away or dilute potential evidence.
o Overhaul activities that destroy fire patterns.
o Salvage activities that involve moving or removing physical evidence.
o Tool use that may destroy evidence.
o Moving knobs, switches and controls on appliances and utilities.
o Weather conditions that affect transient evidence (i.e., wind, precipitation or
temperature changes).
o Personnel walking through the scene.
o Witnesses and victims leaving the scene.
o Medical intervention and treatment of victims (e.g., by damaging evidence at
the scene or destroying victims' clothing).
o Premature removal or movement of bodies.
o Vehicles at the scene (e.g., that introduce fluid to the scene through vehicle
leaks or destroy other evidence, including shoe prints and tire impressions).
o Contamination from external sources, such as fuel-powered tools or
equipment.
Protect evidence by:
o Limiting excessive fire suppression, overhaul and salvage.
o Avoiding needless destruction of property.
o Leaving bodies undisturbed.
o Flagging items of evidence with cones or markers.
o Recording observations through written notes or voice recordings.
o Covering items or areas containing evidence with objects that will not
contaminate the evidence (e.g., clean boxes or tarpaulins).
o Isolating items or areas containing evidence with rope, barrier tape,
barricades or sentries.
o Retaining and securing clothing items removed from victims and suspects.
o Obtaining information about victims and witnesses (i.e., their names,
addresses and telephone numbers).
o Preserving transient evidence (e.g., trace evidence, shoe prints and tire
impressions).
o Removing evidence if it might be destroyed by the fire or the collapse of a
damaged building.
o Telling arriving investigators about what evidence has been discovered.

3
Establish security and control. First responders should immediately establish control of
the scene and initiate documentation of the scene.
To establish security and control, first responders should:

Set up a security perimeter (e.g., using barrier tape).

Control access into the scene through the security perimeter.
Initiate documentation of the scene.

Coordinate interagency activities. First responders must coordinate emergency

operations between many different agencies and organizations.
To coordinate activities at the scene, first responders should:

Establish a command post and implement an incident command system (i.e., a point
of contact and line of communication and authority for public safety personnel).
Establish staging areas to ensure that emergency and support vehicles have access
into the area.
Request additional personnel resources, such as firefighters, EMS personnel, law
enforcement officers, investigators, and representatives of utility companies.
Inform authorities about the status of the incident, hazards, injuries, witnesses, the
location of evidence, and other pertinent facts.

Arriving at the Fire and/or Arson Scene: Evaluating

the Scene
Once a lead investigator arrives at the scene to relieve the first responders, he or she
should evaluate the scene, identify witnesses and survey what must be done. The lead
investigator must:
Note: This section of the guide is intended for the individual responsible for the investigation of a
fire incident. At the time the scene is determined to involve an arson or other crime, the
investigator must address legal requirements for scene access, search and evidence seizure.

Contact first responders and establish presence.

Define the scene's boundaries.
Identify and interview witnesses at the scene.
Assess scene security at the time of the fire.
Identify the resources required to process the scene.

Contact first responders and establish presence. The investigator should meet with the
incident commander and first responders to assess previous events and the current status
of the fire scene, make introductions, identify essential personnel, and determine scene
safety and integrity issues.
The investigator should:

Identify and contact the current incident commander and present identification.
Conduct a briefing with the incident commander to determine who has jurisdiction
and authorization (legal right of entry) and to identify other personnel at the scene
(e.g., law enforcement, firefighting, emergency medical services, hazardous
materials personnel and utility services personnel).

4
 Determine the level of assistance required and whether additional personnel are
needed.
Determine initial scene safety prior to entry through observations and discussions
with first responders. Consider environmental as well as personnel safety concerns.
Assess changes in safety conditions resulting from suppression efforts.

Define the scene's boundaries. The investigator should perform a preliminary scene
assessment, determine the area in which the site examination will be conducted and
establish the scene perimeter.
The investigator should:

Make a preliminary scene assessment (an overall tour of the fire scene to determine
the extent of the damage, proceeding from areas of least damage to areas of greater
damage) to identify areas that warrant further examination, being careful not to
disturb evidence.
Inspect and protect adjacent areas that may include nonfire evidence (e.g., bodies,
bloodstains, latent prints or tool marks) or additional fire-related evidence (e.g.,
unsuccessful ignition sources, fuel containers and ignitable liquids).
Mark or reevaluate the perimeter and establish the procedures for controlling access
to the scene.

Identify and interview witness(es) at the scene. The investigator should determine the
identities of witnesses and conduct interviews.
The investigator should:

Contact the incident commander, identify first responders and first-in firefighters,
and arrange to document their observations either in writing or through recorded
interviews.
Determine who reported the fire. Secure a tape or transcript of the report if
available.
Identify the owner of the building/scene, any occupants, and the person responsible
for property management.
Identify who was last to leave the building/scene and what occurred immediately
before they left.
Identify and interview other witnesses (e.g., neighbors and bystanders) and record
their statements.

Assess scene security at the time of the fire. The investigator should determine
whether the building or vehicle was intact and secure and if intrusion alarms or fire
detection and suppression systems were operational at the time of the fire.
The investigator should:

Ask first responders where an entry was made, what steps were taken to gain entry
to the building or vehicle, and whether any systems had been activated when they
arrived at the scene.
Observe and document the condition of doors, windows, other openings, and fire
separations (e.g., fire doors). Attempt to determine whether they were open, closed
or compromised at the time of the fire.

5
 Observe and document the position of timers, switches, valves, and control units for
utilities, detection systems, and suppression systems, as well as any alterations to
those positions by first responders.
Contact security and suppression system monitoring agencies to obtain information
and available documentation about the design and function of the systems.

Identify the resources required to process the scene. The investigator should
determine what personnel may be required to process the scene according to National Fire
Protection Association (NFPA) 921 and other recognized national guidelines.
Note:Except in the most obvious cases, the determination of a fire's origin and cause may be a
complex and difficult undertaking that requires specialized training and experience as well as
knowledge of generally accepted scientific methods of fire investigation.[1]The investigator must
either have appropriate expertise or call upon the assistance of someone with that knowledge.
The investigator should:

Identify a distinct origin (location where the fire started) and an obvious fire cause
(ignition source, first fuel ignited, and circumstances of the event that brought the
two together).
If neither the origin nor the cause is immediately obvious, or if there is clear
evidence of an incendiary cause, the investigator should
o Conduct a scene examination in accordance with NFPA 921 and other
guidelines.
o Seek someone with the expertise required.
Know when to request the assistance of specialized personnel and to obtain
specialized equipment as required to assist with the investigation. Standard
equipment should include the following:
o Barrier tape.
o Clean, unused evidence containers (e.g., cans, glass jars, nylon or polyester
bags).
o Compass.
o Decontamination equipment (e.g., buckets, pans and detergent).
o Evidence tags, labels and tape.
o Gloves (disposable gloves and work gloves).
o Handtools (e.g., hammers, screwdrivers, knives and crowbars).
o Lights (e.g., flashlights, spotlights).
o Marker cones or flags.
o Personal protective equipment.
o Photographic equipment.
o Rakes, brooms, spades, etc.
o Tape measures.
o Writing equipment (e.g., notebooks, pens, pencils and permanent markers).

Note: If the scene involves arson or other crimes, the investigator must address legal
requirements for scene access, search and evidence seizure.

Recognize the interests of parties that may be affected by the outcome of the
investigation and avoid jeopardizing those interests by taking steps to protect
evidence. These issues include spoliation[2], subrogation[3] and third-party claims.

Arriving at the Fire and/or Arson Scene: Documenting

the Scene
6
After the lead investigator has evaluated the scene, he or she must document the scene. He
or she should follow these steps:
Note: This section of the guide is intended for the individual responsible for the investigation of a
fire incident. At the time the scene is determined to involve an arson or other crime, the
investigator must address legal requirements for scene access, search and evidence seizure.

Photograph or videotape the scene.

Describe and document the scene.

Photograph or videotape the scene. The investigator should create and preserve an
accurate visual record of the scene and the evidence prior to disturbing the scene.
The investigator should:

Photograph and/or videotape the assembled crowd and the fire in progress.
Remove all nonessential personnel from the background when photographing the
scene and evidence.
Photograph the exterior and interior of the fire scene (consider walls, doors,
windows, ceilings, floors) in a systematic and consistent manner. (Videotaping may
serve as an additional record but not as a replacement for still photography.)
Photograph any points or areas of origin, ignition sources and first material ignited.
Photograph any physical reconstruction of the scene.
Maintain photo and video logs. Record the date, the name of the photographer and
the subject.
Determine whether additional photographic resources are necessary (e.g., aerial
photography, infrared photography or stereo photography).

Describe and document the scene. The investigator should create a permanent,
documented record of observations to refresh recollections, support the investigator's
opinions and conclusions, and support photographic documentation.
The investigator should:

Prepare a narrative, written descriptions and observations, including possible fire

causes.
Sketch an accurate representation of the scene and its dimensions, including
significant features such as the ceiling height, fuel packages (e.g., combustible
contents of the room), doors, windows and any areas of origin.
Prepare a detailed diagram using the scene sketch(es), preexisting diagrams,
drawings, floor plans or architectural or engineering drawings of the scene. This may
be done at a later date.
Determine whether additional documentation resources are necessary.

Arriving at the Fire and/or Arson Scene: Processing

Evidence at the Scene
After documenting the scene, the investigator or other evidence collectors must collect,
preserve and store evidence from the scene. He or she should follow these steps:
Note: This section of the guide is intended for the individual responsible for the investigation of a
fire incident. At the time the scene is determined to involve an arson or other crime, the
investigator must address legal requirements for scene access, search and evidence seizure.

7
 Identify, collect and preserve evidence.
Prevent evidence contamination.
Package and transport evidence.
Establish and maintain the chain of custody.

Identify, collect and preserve evidence. The investigator should ensure that evidence
collectors identify, document, collect and preserve evidence for laboratory analyses, further
investigations and court proceedings.
Evidence collectors should:

Take precautions to prevent contamination.

Document the location of evidence using written notes, sketches, photographs, photo
and video logs, the evidence recovery log, evidence tags and container labels.
Collect evidence in any areas where the fire originated (such as the first fuel ignited
and ignition source) in cases where the fire is not accidental.
Place evidence in labeled containers for transportation and preservation. Liquid
evidence collected for laboratory identification must be immediately placed in clean,
unused, vaportight containers (e.g., clean, unused paint cans; glass jars; laboratory-
approved nylon or polyester bags) and then sealed.
Label each container so that it is uniquely identified. Labeling may include the name
of the investigator, date and time of collection, case number, sample number,
description and location of recovery.
Collect and preserve suitable comparison samples but recognize that such samples
may be unavailable.
Package evidence in accordance with their laboratories' policies and procedures.
Recognize the presence of other physical evidence, such as bloodstains, shoe
prints, latent prints and trace evidence, and use proper preservation and collection
methods or seek qualified assistance.

Prevent evidence contamination. The investigator should control access to the fire scene
after fire suppression and see that evidence is collected, stored and transported so that it
will not be contaminated.
Evidence collectors should:

Establish and maintain strict control of access to the scene.

Recognize that fuel-powered tools and equipment present potential contamination
sources and should be avoided. When collectors must use these tools and
equipment, the investigator should document their use.
Wear clean, protective outergarments, including footwear.
Use clean disposable gloves for collecting items of evidence. (To avoid cross-
contamination, gloves should be changed between collecting unrelated items of
evidence or when visibly soiled.)
Use clean or disposable tools for collecting items of evidence from different locations
within a scene.
Place evidence in clean, unused containers and seal immediately.
Store and ship fire debris evidence containers of evidence collected from different
scenes in separate packages.
Package liquid samples to prevent leakage and ship them separately from other
evidence.
Store and ship fire debris evidence separately from other evidence.
Follow specific laboratory requests (e.g., to submit an unused sample container).

8
Note: In cases of accidental fire, evidence should not be needlessly disturbed, but the
property owner or insurer should be notified to avoid issues of spoliation.
Package and transport evidence. The investigator should ensure that packaging,
transportation and storage procedures are followed to prevent any destructive changes in
the condition of samples.
The personnel responsible for packaging and transport should:

Take precautions to prevent contamination.

Package fragile items carefully.
Freeze or immediately transport items containing soil to the laboratory.
Transport all volatile samples to the laboratory in a timely manner.
Comply with shipping regulations.

Establish and maintain the chain of custody. The investigator should ensure that the
chain of custody is maintained.
Personnel responsible for the chain of custody should:

Maintain written records documenting the sample number, description of the

evidence, date and location where it was found, collector's name and miscellaneous
comments.
Document all transfers of custody, including the name of the recipient and the date
and manner of transfer.
Document the final disposition of the evidence.

Arriving at the Fire and/or Arson Scene: Completing

the Investigation
Once evidence has been collected and processed, the investigator must complete the
investigation and release the scene. He or she should follow these steps:
Note: This section of the guide is intended for the individual responsible for the investigation of a
fire incident. At the time the scene is determined to involve an arson or other crime, the
investigator must address legal requirements for scene access, search and evidence seizure.

Release the scene.

Submit reports to the appropriate databases.

Release the scene. The investigator should release the scene after reasonable efforts have
been made to identify, collect and remove all evidence from the scene for examination and
that all physical characteristics of the scene have been documented. In addition, prior to
releasing the scene, associated legal, health and safety issues must be articulated to the
party taking over the investigation and reported to public safety agencies if necessary.
The investigator should ensure that the following tasks are completed before releasing the
scene:

Perform a final critical review:

o Ensure that all evidence is inventoried and in custody.
o Discuss preliminary scene findings with team members.
o Discuss postscene issues including forensic testing, insurance inquiries,
interview results and criminal histories.

9
 o Assign postscene responsibilities to law enforcement personnel and other
investigators.
o Address legal considerations.
Verify that all scene documentation has been completed.
Address structural, environmental, health and safety issues.
Remove all investigative equipment and materials.
o Recover and inventory equipment.
o Decontaminate equipment and personnel.
Document the following information:
o Time and date of release.
o Receiving party.
o Authority releasing the scene.
o Condition of the scene at the time of release (e.g., structural, environmental,
health and safety issues). Consider photographing and/or videotaping the
final condition of the scene.
o Cautions given to the receiving party upon release (e.g., safety concerns,
conditions, evidence, legal issues).

Submit reports to the appropriate databases. The responsible agencies must file
incident reports with the appropriate databases. Detailed fire information is collected,
integrated and disseminated through national and State databases. These data help
authorities identify fire trends and develop innovative procedures and equipment.
The investigator should collect sufficient information and report it to the following
databases:

Arson and Explosives National Repository (Bureau of Alcohol, Tobacco and Firearms).
Bomb Data Center (Federal Bureau of Investigation).
National Fire Incident Reporting System (U.S. Fire Administration).
National Incident-Based Reporting System (Federal Bureau of Investigation).
State and local fire incident reporting systems.

10