How a plane crash is investigated
- Published
Egyptian investigators were among the first on the scene after Metrojet Airbus A321 crashed over the Sinai peninsula
When faced with the aftermath of a plane crash, how do investigators try to piece together the facts?
Immediate aftermath
The first priority is, of course, for local police or military to secure the crash site while investigators make their way there.
Sometimes the location and nature of the crash will make this very challenging - such as when Germanwings Flight 9525 crashed in March 2015 in a remote, snow-covered mountainous region of France inaccessible by road. Debris from the aircraft had been spread across an area of about four hectares (10 acres), about 1,550m up the mountainside in a sloping rocky ravine.
As well as gathering evidence, requests will also be made for copies of documentation - maintenance records and passenger lists - that will be held by the airline.
Communications with air traffic control will be sought as well as information about weather conditions at the time of the crash.
According to rules, external set out under the Convention on International Civil Aviation, the primary role in the probe goes to the state where the crash happened, but the states where the aircraft was registered, where the airline is based and where the plane was designed can all have a role.
This process is complicated where the crash happens over water, as with Air France flight 447, which crashed over the Atlantic en route from Rio de Janeiro to Paris in June 2009.
It took almost two years for the flight's "black box" data recorders to be recovered from the ocean and another year for the final report to be issued by the French aviation authority.
Sinai plane crash: Four theories
Air France 447 went down as a result of "pilot and technical failings", investigators found
Clues from the wreckage
Once the investigators are in a position to assess the physical evidence, they have to keep an open mind and not narrow down the focus of their efforts too early.
Before long, the wreckage is normally re-assembled in the nearest suitable building. In the case of the Lockerbie crash in Scotland in 1988, that was initially done in an ex-military base where the wreckage was pieced together "in 2D" on the floor before being moved to the English town of Farnborough, where it could be re-constructed in 3D.
It is that physical evidence, even if it is initially hidden or distorted by the impact of hitting the ground or other factors, that can start to suggest lines of inquiry, along with the "black box" and cockpit voice recorder.
The results of autopsies performed on passengers and crew can also help narrow down what happened on board.
For example, the Dutch report into the downing of Malaysian Airlines Flight MH17 over Ukraine in July 2014 said it was able to determine the nature of the impact that brought it down partially because of the sorts of injuries sustained by the crew in the cockpit.
After the initial phase of gathering physical intelligence, it is normally possible to form a view of the physical process that brought the aircraft down - for example, an explosion.
Dutch investigators drew some conclusions from autopsies on the bodies of the crew in the cockpit of Malaysian Airlines Flight MH17
Curled pieces of metal from the fuselage can suggest this, for example, but this would have to be evident on more than one piece of debris in order to support the theory.
"In most cases, the evidence will be there from the wreckage as to what happened. But then it's about why," says Frank Taylor, a former air accident investigator who worked on the Lockerbie crash.
In UK law, accident investigators have control over the probe for as long as they deem it necessary, but trying to get to the bottom of why the accident happened can be where other agencies start to intervene.
"The accident investigation process is very strictly a no-blame process," Mr Taylor says.
If investigators believe they have found a design or maintenance fault, they can issue recommendations immediately in order to try to prevent the problem happening to other aircraft, long before any final report is published.
Sometimes, as on 9/11, it is immediately apparent that a crime has occurred, at which point police and prosecutors will normally start conducting their own investigations in parallel, combing intelligence to look for clues as to who might be responsible.