Welcome back. Last lesson established a crucial discipline for forensic reasoning: separate observations from inferences. You recorded what is actually seen, measured, or documented before proposing what it might mean.
This lesson takes the next step. An observation can raise a forensic question, but a question alone does not tell an examiner what evidence to seek. You will learn to formulate a testable hypothesis: a focused, evidence-based possible answer that makes clear what result would support it and what result could challenge it. This is a core habit in laboratory work, scene interpretation, and digital investigation alike. Plan for about 35–40 minutes.
From observation to question to hypothesis
Suppose a scene note records:
A reddish-brown stain, approximately 2.5 cm wide, is visible on the cuff of a blue shirt.
That is an observation. It does not yet establish what the stain is.
A sensible next step is a question:
Does stain S1 on the shirt contain blood?
A hypothesis is a proposed answer to that question:
Hypothesis: Stain S1 contains blood.
The hypothesis is neither a fact nor a random guess. It is a provisional explanation or claim that directs evidence collection and examination. It must remain open to being challenged by results.
The full reasoning structure looks like this:
| Stage | Purpose | Example |
|---|---|---|
| Observation | Records what was documented | “A reddish-brown stain is visible on the shirt cuff.” |
| Question | Identifies an answerable uncertainty | “Does the stain contain blood?” |
| Hypothesis | Gives one possible answer | “Stain S1 contains blood.” |
| Prediction | States an expected result if the hypothesis is correct | “If S1 contains blood, appropriate validated examinations should produce results consistent with blood.” |
| Test and interpretation | Compares the actual result with the prediction | Results may support the hypothesis, fail to support it, or require a revised explanation. |
The important distinction is between a hypothesis and a prediction:
- A hypothesis is the proposed explanation: “The stain contains blood.”
- A prediction states what should be observed if that explanation is correct: “If the stain contains blood, then testing should produce specified results.”
The familiar if...then... format is therefore often most precise when used for the prediction. It forces you to state what evidence would be expected, rather than merely asserting a conclusion.
1.2 The Process of Science - Concepts of Biology | OpenStax
Read OpenStax’s explanation of how observations generate questions, hypotheses, predictions, and tests. Its everyday example makes the logical distinction between a hypothesis and an if–then prediction especially clear.
On the webpage, find the subsection “Hypothesis Testing.” Begin at the sentence “Biologists study the living world by posing questions about it and seeking science-based responses.” Read the classroom example, following the progression from an observed warm classroom to alternative hypotheses and a prediction. Then read the next paragraph, beginning “A hypothesis must be testable to ensure that it is valid,” through testability and falsifiability. Focus on the fact that scientific results can support an explanation without proving it permanently.
What makes a forensic hypothesis testable?
A forensic hypothesis must be more than a plausible story. It must identify a claim that evidence could reasonably support, weaken, or rule out.
A useful testable hypothesis has five features.
1. It answers a focused question
Compare these questions:
- Too broad: “What happened at the scene?”
- More focused: “Does the reddish-brown material on shirt cuff S1 contain blood?”
- Too broad: “Was this computer used for something illegal?”
- More focused: “Were the files in folder F1 acquired through a web browser?”
The broad questions may matter to an investigation, but they combine many separate uncertainties. A testable hypothesis should address one manageable uncertainty at a time.
2. It names the relevant item, condition, or claim
“Something on the shirt is blood” is vague. Which item? Which area? Which substance?
Better:
The material sampled from stain S1 on the blue shirt cuff contains blood.
Specificity makes the hypothesis traceable to a particular exhibit and allows another examiner to understand exactly what was investigated.
3. It is based on observations and background knowledge
A hypothesis should have a reason behind it. In the shirt example, the visible colour and location of the stain justify asking whether it could be blood. They do not justify claiming that it is blood before appropriate testing.
This is why the wording “educated guess” is useful, provided educated is taken seriously. The proposal should arise from documented observations, established scientific knowledge, and the particular forensic question—not from a preferred narrative about a suspect or victim.
4. It makes a checkable prediction
A hypothesis becomes practically useful when it tells the examiner what evidence to look for.
For the stain example:
Hypothesis: Stain S1 contains blood.
Prediction: If S1 contains blood, then a suitable validated examination should produce results meeting the established criteria for blood.
The exact testing sequence will be studied later in the course. At this stage, notice the logic: the prediction connects the claim to a result that can be recorded.
5. It is falsifiable
A claim is falsifiable when there is some possible finding that would conflict with it.
For example, the hypothesis “Stain S1 contains blood” could be challenged if validated examinations do not produce results consistent with blood. That makes it scientific.
By contrast, consider:
“The stain is definitely blood because it looks like blood.”
This statement is problematic for several reasons. It treats visual appearance as final proof, gives no clear test, and uses “definitely” before evidence has been evaluated. The word does not make the claim stronger; it merely conceals its uncertainty.
A scientific examiner should be able to finish this sentence:
“I would reconsider this hypothesis if…”
If no imaginable result could make a person reconsider, the statement is not functioning as a scientific hypothesis.
Hypotheses are not accusations
Forensic science often examines evidence connected to serious allegations. That makes it especially important to formulate hypotheses about specific evidential claims, not vague claims about a person’s guilt or character.
Consider the question:
How were particular files acquired on a computer?
Several hypotheses may be possible:
- The files were downloaded through a web browser.
- The files were acquired through peer-to-peer software.
- The files were placed on the computer by another person or process, such as malware or an external device.
Each hypothesis predicts different kinds of digital traces. Browser acquisition might predict relevant browsing, download, or cache records. Peer-to-peer acquisition might predict application records and associated file data. A malware explanation might predict indicators of unwanted software activity.
The point is not to assume that one explanation must be correct. The point is to identify competing explanations and seek evidence that can distinguish among them.
DFS101: 5.2 Scientific Method in Digital Investigations
In “DFS101: 5.2 Scientific Method in Digital Investigations,” DFIRScience applies scientific reasoning to digital forensic work. Although the evidence is digital rather than biological, the method is directly relevant: narrow the question, state testable possibilities, and examine both incriminating and non-incriminating explanations.
Watch the workflow for the role of a structured scientific process in reducing bias. Then skip to competing hypotheses. Notice how different explanations for the same files require the examiner to seek different artifacts, and why an alternative innocent explanation must also be tested.
The same principle applies to physical evidence. Suppose an examiner asks:
Did a particular shoe make the partial footwear impression near the doorway?
A narrowly phrased hypothesis could be:
The questioned shoe could have produced the documented features observed in impression I1.
A corresponding prediction might be:
If the shoe could have produced I1, then the features that can be compared—such as size, tread design, wear patterns, and accidental marks—should be consistent to the extent permitted by the quality of the impression.
This is more disciplined than writing, “The suspect was at the scene.” Even a strong association between an item and an impression does not automatically establish when the impression was made, who was wearing the shoe, or what that person did. A hypothesis should match the actual evidential question and preserve those limits.
A practical formulation method
When faced with a forensic question, use the following short protocol.
-
Start with the documented observation.
Use neutral wording and identify the item. For example: “A clear liquid was recovered from vial V1.” -
Write one focused question.
For example: “Does the liquid in V1 contain ethanol?” -
State a narrow hypothesis.
For example: “The liquid in V1 contains ethanol.” -
Write an if–then prediction.
For example: “If V1 contains ethanol, then an appropriate validated analysis should show results consistent with ethanol.” -
State at least one alternative hypothesis.
For example: “V1 contains a different clear liquid, such as water or another solvent.” -
Identify what would count against your hypothesis.
For example: “A result inconsistent with ethanol would fail to support the hypothesis.”
This process is deliberately modest. It breaks a large mystery into claims that evidence can address.
A worked forensic example
Imagine the following simulated case note:
Exhibit B3 is a drinking glass recovered from a kitchen table. A visible mark is present on its rim.
The forensic question is:
Is the visible mark on glass B3 a fingerprint suitable for comparison?
A weak response would be:
“The person who used the glass left a fingerprint.”
That statement assumes several facts that have not been established: that the mark is a fingerprint, that it is suitable for comparison, and that the person who left it used the glass during the relevant event.
A more defensible hypothesis is:
Hypothesis: The visible mark on the rim of glass B3 is a friction-ridge impression with sufficient detail for comparison.
Its prediction is:
Prediction: If the mark is a suitable friction-ridge impression, then examination and documentation should reveal a reproducible pattern of ridge detail of adequate quality.
An alternative hypothesis is:
The mark is a smudge, handling residue, or an incomplete impression that lacks enough ridge detail for comparison.
Notice what this wording accomplishes:
- It refers to one item, B3.
- It describes an evidence question rather than a person’s alleged actions.
- It tells the examiner what to look for.
- It permits a result that does not support the hypothesis.
- It does not overstate what a later comparison could establish.
Support is not proof
The scientific method is sometimes described as if it produces certainty after one test. In real forensic work, evidence is usually more conditional.
A test result can have several meanings:
| Result | Appropriate conclusion |
|---|---|
| Consistent with the prediction | The result supports the hypothesis, subject to the method’s limitations and controls. |
| Inconsistent with the prediction | The result fails to support the hypothesis and may justify rejecting or revising it. |
| Unclear, limited, or compromised | The result may be inconclusive; it does not reliably choose between the hypotheses. |
For example, if a stain examination yields results consistent with blood, that supports the hypothesis that the stain contains blood. It does not by itself answer whose blood it is, when it was deposited, or how it arrived there. Each of those is a separate question requiring its own evidence and carefully framed hypotheses.
Similarly, a result that does not support one hypothesis does not automatically prove a preferred alternative. If the stain is not blood, it might be food colouring, paint, rust, or another material. Good reasoning does not replace one unsupported certainty with another.
This willingness to revise is a strength. The infographic’s final stage, refining ideas based on evidence, is not an admission of failure. It is how an investigation becomes more accurate.
A final quality check
Before treating a statement as a forensic hypothesis, check it against this list:
- Focused: Does it answer one specific question?
- Grounded: Is it connected to documented observations and relevant knowledge?
- Specific: Does it identify the relevant item, sample, or condition?
- Testable: Can a feasible examination, observation, or comparison address it?
- Falsifiable: What result would count against it?
- Neutral: Does it avoid assuming guilt, intent, identity, or a complete story before the evidence supports those claims?
- Limited: Does it avoid claiming more than the proposed test can establish?
A concise template is:
Question: Does [identified item or condition] have [specific feature or property]?
Hypothesis: [Identified item or condition] has [specific feature or property].
Prediction: If the hypothesis is correct, then [observable or measurable result] should occur.
Alternative: A different explanation is [plausible alternative].
Possible challenge: The hypothesis would be weakened if [contrary result].
Key takeaways
A testable hypothesis is a clear, provisional, evidence-based answer to a focused forensic question. It is not a statement of certainty and not an accusation. It should identify the precise item or condition under examination, predict what evidence would be expected, and allow for a result that could challenge it.
The most useful forensic habit is to keep the reasoning visible:
- observations record what was found;
- questions identify what remains unknown;
- hypotheses propose possible answers;
- predictions state what evidence should be seen;
- results support, fail to support, or leave the hypothesis inconclusive.
Next, you will make hypotheses more operational by identifying the independent variable, dependent variable, and controlled variables in a simple experiment.
Can't find a good explanation? Sign up and we'll make it for you
Sign up