Appendix H: Toxicology and Instrumentation — A Quick Reference

This appendix is a field card for the chemical half of forensic science — the toxicology of Chapter 20 and the instruments of Chapter 23, distilled into tables and short rules you can find fast and trust under pressure. It is not a substitute for those chapters; it is the thing you keep open beside them. Two ideas from the main text govern everything here, and they are worth restating before any table, because the tables are dangerous without them.

First, the certainty of a chemical result drains from identification to interpretation. Naming a substance and measuring how much of it is present are near the top of the validity spectrum, in the company of DNA — analytical chemistry, grounded in physics, with measurable error rates. Saying what that substance meant — impaired, incapacitated, poisoned, killed — is a judgment, and judgment is where overstatement creeps in and where a good cross-examiner takes a confident expert apart. Keep the instrument sentence ("X was confirmed at this concentration") visibly separate from the interpretation sentence ("that level was incapacitating for this person"), and never let the first vouch for the second.

Second, garbage in, garbage out. A flawless instrument run on a contaminated, mislabeled, or poorly collected sample produces a flawless, confident, wrong answer. Every table below assumes clean collection, a documented chain of custody, a clean blank, and a same-day reference standard. Without those, the rest is theater.

Part 1 — Toxicology

H.1 The three questions (and where the certainty goes)

Every toxicology result answers, or fails to answer, three questions in sequence. They get harder as you go, and a great deal of bad testimony comes from answering the third with the confidence that belongs only to the first.

The instrument answers Q1 and Q2. A human being, reasoning under uncertainty about tolerance, timing, drug combinations, and postmortem chemistry, answers Q3. That is the fault line every defense attorney aims at.

H.2 Specimens — match the specimen to the question

The specimen constrains the question you are entitled to answer. "Was the drug ever in the body?" and "Was this person impaired at 9 p.m.?" are answered by different specimens. Detection windows below are illustrative, not fixed.

Rules of thumb:

• Blood speaks to the present — what was circulating and active when it was drawn. The specimen of choice for impairment and for cause-of-death work. After death, where it was drawn is part of the result.
• Urine speaks to recent exposure, not effect. A positive urine screen can reflect use days earlier, long after any impairment has passed. Treating a positive urine result as proof of impairment at a moment is one of the most common errors in the field.
• Vitreous humor (the fluid inside the eye) is the body's protected archive — anatomically isolated, slower to decompose, especially valuable for the alcohol question because it helps separate genuine antemortem drinking from postmortem alcohol production.
• Hair is the long memory and the most overstated. It can suggest exposure over a long window; it answers "how much, and exactly when?" poorly and "impaired at a moment?" not at all. External contamination — drug residue deposited from the environment or smoke rather than absorbed from within — can produce positives unrelated to ingestion, and is genuinely hard to distinguish from true incorporation.

H.3 Screening vs. confirmation — the two-stage rule

No competent laboratory reports a toxicology result on a single test. The architecture is always two stages, and reading a report starts with finding out which stage produced the number.

The single non-negotiable rule: a confirmatory test must rest on a different chemical principle than the screen it confirms. Confirming an immunoassay with a second immunoassay is worthless, because a cross-reacting substance would fool both. The mental model from Chapter 20: the screen is the airport metal detector — deliberately over-sensitive, beeps at belt buckles — and no one is arrested on the beep. The confirmation is the hand search, and only the hand search goes in the report as an identification.

The reporting rule. If a result was screened but never confirmed, that absence is the finding. An unconfirmed presumptive positive is a lead, not proof — people have been arrested, jailed, and even induced to plead guilty on cheap presumptive results that confirmatory analysis later showed were wrong (the substance was soap, candy, or an over-the-counter medication). The presence of a positive screen is not the presence of a drug. The confirmation is.

H.4 BAC — interpreting blood alcohol honestly

Alcohol is the most measured and most litigated substance in toxicology, and the perfect case study in "measurement is easy, interpretation is hard." The BAC (blood alcohol concentration) — in the U.S., grams of ethanol per 100 mL of blood, written as a percentage (the "0.08" driving limit is 0.08 g/100 mL) — is reliable as a measurement. What it meant at an earlier moment is a chain of attackable assumptions.

The three pharmacological phases:

• Absorption — after drinking, alcohol enters the bloodstream and the BAC rises; food markedly slows it. On the rising limb, the peak has not yet been reached.
• Distribution — alcohol spreads through the body's water; because people differ in body water, the same amount produces different peaks. (A "standard drink" does not produce a standard BAC.)
• Elimination — the body clears alcohol at a roughly constant amount per hour (zero-order kinetics), so past the peak the BAC declines along a roughly linear slope. The rate varies between individuals.

The trap, in one line: the same measured BAC can sit on the rising limb or the falling limb. What matters is where the person was on the curve at the time of the event, not the time of the test — and a single sample cannot tell you which limb it came from without more information (the drinking history).

• Retrograde extrapolation (back-calculation) estimates the earlier BAC by assuming elimination and adding back the alcohol presumed cleared in the interval. It is defensible only with explicit assumptions stated, ideally as a range, and it fails if the person was still absorbing at the time of the event (back-calculating then overstates the relevant BAC).
• BAC and impairment are related but not rigid — higher means more impaired on average, but tolerance varies. This is why many jurisdictions set a per se limit (illegal at or above a number regardless of demonstrated impairment): a legal admission that "present at a level" and "impaired" are related, not identical.
• In a dead body, alcohol is a special minefield. Microbial fermentation can produce ethanol after death (postmortem alcohol formation / neoformation). A BAC from a decomposing body may reflect drinking before death, microbial production after death, or both. The vitreous-vs-blood comparison helps distinguish them — which is why a "modest BAC" in a body recovered from a fire (as in the cold case) must be interpreted with care, not read at face value.

H.5 Drug classes and "the dose makes the poison"

Paracelsus's founding maxim — the dose alone makes a thing a poison — is the most important sentence in pharmacology. There is no substance that is poisonous or safe in itself; there is only a quantity that is one or the other. It is operationalized through concentration ranges:

Three cautions keep the ranges honest:

1. Present ≠ impairing ≠ fatal. These are three different claims at three different concentrations. Sliding from one to the next without the numbers is the commonest overstatement in the field.
2. The bands overlap and are blurry — drawn from population data with wide individual variation. A single number near a boundary rarely settles the question alone.
3. Tolerance can move the entire scale. A chronic user may function at a concentration in the textbook "lethal range"; a naive person, a child, or someone whose tolerance has lapsed can die well below it. The number means nothing without the person.

Common drug-class groupings you will meet (a orienting sketch, not a pharmacology text):

• CNS depressants — alcohol, opioids (e.g., morphine-class analgesics), benzodiazepines and other sedative-hypnotics. The central danger is combination: in a combined drug toxicity death, no single substance is in its own lethal range, but several depressants together produce a fatal synergistic effect. Reading each drug in isolation would miss the cause of death.
• CNS stimulants — e.g., the amphetamine class, cocaine.
• Hallucinogens and cannabinoids — note that a urine cannabis metabolite indicates past exposure, not current impairment.
• Classic poisons and toxic agents — e.g., toxic metals and certain plant- or chemically-derived toxins, the historical heart of toxicology.

The interpretive discipline: ask not "is this drug above its lethal threshold?" but "what is the most defensible interpretation of these concentrations of these substances in this person, given everything known about them?" — and state the residual uncertainty out loud.

H.6 Postmortem traps

Postmortem toxicology is its own treacherous specialty because the body does not hold still after death. A concentration in a corpse is not a frozen snapshot of the moment of death.

• Postmortem redistribution (PMR). After death, drugs concentrated in organs (liver, lung, heart muscle) — especially fat-loving drugs with a large volume of distribution — leak back into nearby blood. Blood from a central site (heart, great vessels) can read substantially higher than what was actually circulating at death, sometimes several-fold. This is not an instrument error; the central number is simply no longer representative. Fix: draw from a peripheral site (femoral/leg vein), cross-check multiple specimens, and interpret with the specific drug's known redistribution behavior.
• Postmortem alcohol formation (neoformation). Microbes can generate ethanol after death (see H.4); use the vitreous-vs-blood comparison and markers of microbial activity.
• Drug instability. Some substances degrade after death (a falling concentration that understates the antemortem level); others are generated from precursors. Know which.
• The tolerance problem (carried from H.5) — even a perfectly representative postmortem concentration means nothing without the decedent's history of use.

Where toxicology sits on the validity spectrum: in two places at once. The identification and quantitation of a substance by confirmed instrumental analysis is near the top, with DNA. The interpretation of what a concentration means descends the spectrum the further it reaches from the instrument. The same expert, in the same report, may make a top-of-spectrum statement ("the sedative was confirmed at this concentration in peripheral blood") and a much-lower one ("this level was incapacitating for this person") — and the discipline is to present each at its true, different strength.

Part 2 — Instrumentation

H.7 What makes a result confirmatory

A confirmatory result is not just a more expensive presumptive test. Three properties earn the word confirmed (Chapter 23):

1. Specificity — the method responds to the target in a way other substances do not reproduce; ideally it interrogates molecular structure, not a single bulk property like color.
2. Two orthogonal dimensions of information — at least two independent measurements that could each fail differently. (GC-MS is canonical because it combines how fast a molecule travels through a column and how it shatters into fragments.)
3. Comparison to a known standard — a reference standard of the suspected substance run the same day on the same instrument, plus a blank proving the glassware and instrument were clean.

The machine does not "identify" anything; the analyst identifies it, using the machine, and stands behind the identification under oath. An instrument switched on for theater — its output never truly examined — is worse than no instrument, because it lends the authority of confirmation to work that was never confirmed (the lesson of the Chapter 4 lab scandals).

H.8 The instruments — what each separates or identifies, and what it confirms

H.9 Reading the two central graphs

• A chromatogram is the GC's record of what came off the column, and when. Flat baseline where nothing elutes; each peak is one separated compound; horizontal axis is time (retention time); peak height/area ≈ relative amount. For fire debris, the analyst recognizes the whole pattern (the aromatic "signature ridge" of weathered gasoline) against a same-day reference standard, following a published ignitable-liquid classification scheme. What it does not do: retention time alone does not prove any single peak's identity (it is a class characteristic), and it says nothing about who, how, or when.
• A mass spectrum is the molecular fingerprint of one peak pulled from the chromatogram. Each bar is a charged fragment; horizontal axis is mass-to-charge ratio (m/z); height is fragment abundance. The base peak (tallest, set to 100%) is the fragment the molecule most readily forms; the molecular ion (the heaviest major peak) gives the molecular weight. Identification is made from the whole pattern at once, matched bar-by-bar against a reference standard and a spectral library (such as the NIST database). Whole-pattern match plus matching retention time = the two orthogonal agreements that make GC-MS confirmatory.

H.10 The honesty rules for instrumental results

Even at the high-validity end, the boundaries hold — say them plainly:

• Confirmation upgrades the certainty of identity, not the reach of the inference. "Gasoline is present, confirmed by GC-MS" is a strong, defensible fact. "Therefore the defendant set the fire" is an enormous, unearned leap the chemistry never makes. The instrument answers what, with authority; it is silent on who and why, and the silence is the boundary of the evidence, not a gap to fill with inference.
• A library match score is a hypothesis, not a verdict. A high percentage "match" can come from the wrong library, a dominant component masking a mixture, or a contaminated sample. Interrogate it (Is the whole spectrum explained? Any unexplained peak? Was the blank clean? Does it fit the context?) — do not read the percentage aloud as a conclusion.
• Elemental composition is class evidence. SEM-EDX can say a particle is lead/barium/antimony in proportions characteristic of primer residue; it cannot say which gun, which cartridge, or which person — and it cannot say how a particle reached a surface (residue transfers and contaminates easily). Class evidence places and narrows; it does not individualize.
• The instrument is objective; the analysis is not. Which marginal library match to accept, whether a minor peak is "noise" or a real component, where to draw the line on a "characteristic" GSR particle — these are human judgment calls that expectation can tilt (Chapter 31). Keep domain-irrelevant information away from the bench until the result is fixed. The objectivity of the instrument is not a substitute for the independence of the analyst.

The one-line summary of this whole appendix. Chemistry is the part of forensic science that most deserves the public's trust — and that trust is a property of the method and the practice together: clean collection, a documented chain of custody, a clean blank, a same-day standard, an independent analyst, and a witness who confines every claim to what the evidence can bear. The instrument tells you what. Everything else is up to the people.