Wouldn’t much of the evidence be destroyed by the impact of hitting the ground? I imagine they might be able to distinguish (in many cases) between actual damage caused by the impact of hitting the ground and damage caused prior to that. But if the thing is mashed to bits from ground impact anyway, how can they tell if there was prior damage?
And if it was sabatoge, how would they figure this out? Why would sabatoge be distinguishable from other causes? Suppose someone sneakily loosened the bolts on various crucial parts of the plane, causing them to fall off, would they be able to figure this out with the plane in zillions of pieces?
One of the painstaking methods employed in air crash investigation is the recovery of as much of the aircraft as is possible, no matter how many zillion pieces it is in.
Each piece may just hold the clue that teels the story of why the crash occurred. It may also be possible to determine from damage patterns on various pieces whther the were abnormal forces involved. Kinda like trying to put the jig saw back together again.
For example an engine has spinning parts that are close together, but not hitting. When the engine is crushed as it hits the ground those parts will hit each other. By measuring how far one part wiped across another, and estimating the time for the engine to crush, you can estimate how fast the engine was turning. It won’t be an accurate RPM, but it will be good enough to tell you if the engine was at full speed, idle speed, or stopped when it hit the ground.
They do gather up bolts and examine them. If the nuts [or nut and bolt head] are farther apart than is typical, and they are not stripped, you know the nut had loosened. If the nut is gone, but part of the bolt stripped, you look at where the threads stripped. Is that where the nut was supposed to be or had it loosened. If the nut is gone and the threads are not stripped, you know the nut came off before the failure.
The hard part is not determining what happened, but why it happened.
The thing is, parts do break so aircraft receive frequent inspections. And the are lots of redundant parts. Planes don’t crash very often. Sabatoge cannot be very subtle is the goal is to crash the plane. You could leave off an engine mounting bolt. Most of the time the next inspection would catch it. Occasionally an engine would brake off. You would have to do it so many times that would would likely get caught before a plane crashed. You would force the company to increase its inspection frequency.
Sometime they go beyond that. I remember seeing the 747 from TWA #800 that went down in the ocean almost completely reassembled in a hangar. There were holes and such from missing pieces they hadn’t found but it was spooky to see most of the plane sitting there. It was pooky partly to see the plane re-born (sort of) and partly because these people are nuts enough to re-build a plane piece by tiny shattered piece.
They can also tell some things fairly easily. For instance, some suggested TWA #800 had been hit by a missile. If the explosion came from the outside metal would be bent inward…if the explosion came from the inside the metal would be bent outward. That’s a more obvious thing that even a layman could see. As others have mentioned engineers can tell a lot more than you think since they have a deep understanding of how things are supposed to work and can spot where things go wrong even amidst rubble.
I read a lengthy report in the Dallas Morning News several years ago, where the reporter went to the NTSB and waited for a crash, so he could report on an investigation from the very beginning. Then a private jet crashed in East Texas, going into the ground at close to a 90-degree angle. There wasn’t much left, except the intact tail pieces found a few hundred yards away (because it broke off before impact).
They would normally do a toxicology report of the victims, looking for poisoning, food poisoning, etc., but there weren’t any pieces of the victims large enough to examine.
One thing I recall is that the investigators were careful when recovering all the pieces to the instrument panel, because they could look at a little light bulb and tell if it was on or off at the moment of impact by how the filament broke. Maybe with a commercial airliner they wouldn’t need to do this, because commercial planes have Flight Data Recorders. But it shows the small things that investigators can use as clues to figure out what happened.
I also remember watching a show on TLC/Discovery/One of those a while back on plane crashes. One of the things they did was use photo enhancement of the instrument panel to determine where the various needles were pointed on the instruments at the time of the crash. Apparently the impact was such that the needles slapped against the back of the dial and they were able to determine the location where the needles hit (and thus where they were pointing at the time of the hit).
They also used aerial IR photography of the area to determine how unburned fuel had scattered over the area, partially to determine if the fuel had leaked prior to or after the crash.
For example, the investigation seems to be focussing on the tail fin & rudder, because it was found in Jamaica Bay, a few miles from the rest of the debris. From that position alone, it’s reasonable to assume that the tail fell off first, and that might have been what started the catrosphic break-up.
So, how do you tell if the tail assembly failed, or was the target of sabotage? Well, the accounts indicate that the break line is very clean. That initial observation suggests that an explosion is unlikely: explosions don’t usually leave clean lines. The metal gets bent and twisted from the force of the explosion.
Then they start looking closely - real closely, with microscopes. Explosions leave residue - the explosive itself does not burn completely, and residue can be found, just like powder on a person’s hands after they shoot a gun. There are also other physical traces, like pitting caused by bits and pieces from the explosion being blown into the metal. The pitting can sometimes be seen by the naked eye, or only microscopically, but if it’s there, that suggests an explosion. If it’s not there, that suggests no explosion.
It’s not likely that there’s any one thing that they could point to and say: “That’s it - that’s what happened.” It’s very much of a jigsaw puzzle, leading to an assessment of probablities.