How a Real Murder Investigation Works: The First 72 Hours
Published August 14, 2026 Β· 6 min read
Detective fiction almost never shows the actual shape of a homicide investigation, and the omission is understandable β most of it is administration. But the real structure is a genuinely good piece of design, built over decades out of the specific ways investigations fail, and knowing it makes you a sharper reader, a better writer, and a much more systematic player.
What follows is the common skeleton across most modern police forces. Terminology varies β this uses mainly British terms, with American equivalents noted, because the UK vocabulary is more standardised β but the sequence is broadly shared.
Hour zero: the scene is the case
The first officer to arrive is rarely a detective, and what they do in the first ten minutes constrains everything afterwards.
Preserve life, then preserve the scene. Medical intervention comes first, which necessarily damages evidence β paramedics move things, cut clothing, contaminate surfaces. This is accepted, and a record is made of what they did so it can be distinguished from the offender's actions later.
Establish cordons. Usually two: an inner cordon around the immediate scene and an outer one covering approach routes, discarded items and vehicles. Inexperienced officers cordon too tightly; the standard instruction is to start wide, because you can always shrink a cordon and you can never recover ground that a hundred people have walked across.
Set a common approach path. A single designated route in and out, chosen deliberately to avoid the likely path of the offender.
Start a scene log. Everyone who enters and leaves, with times. This is the document that will be attacked in court, and it's the reason people are so particular about it.
Identify the "golden hour." A British policing concept: the period immediately following an incident when material is most readily available and most easily lost. CCTV overwrites itself. Witnesses disperse and start talking to each other. Fibres blow away. Phones are wiped. Suspects wash. Almost every subsequent problem in an investigation traces back to something that was available in this window and wasn't secured.
The command structure
Once it's confirmed as a suspicious death, a formal structure is stood up.
The Senior Investigating Officer (SIO) β the US equivalent is the lead detective β takes ownership. In the UK the SIO maintains a policy log, a running record of every significant decision and the reasoning behind it. This is an underrated piece of design: it forces investigators to articulate why they're pursuing one line and not another, and it makes hindsight review possible.
The Major Incident Room (MIR) processes information. In the UK this runs on HOLMES 2 (Home Office Large Major Enquiry System), a database built after the Yorkshire Ripper investigation of the 1970s, which failed in large part because the sheer volume of paper made it impossible to connect information the force already held. The system exists specifically so that a critical link buried in the twelve-thousandth statement surfaces.
That failure mode is worth dwelling on, because it's the most realistic obstacle in any large investigation and fiction almost never uses it: the information is usually already in the file. Nobody can find it.
Specialist roles are assigned: a crime scene manager, an exhibits officer (owning continuity of every item), a disclosure officer, a family liaison officer, and analysts.
Lines of enquiry
The SIO sets a strategy that typically runs several workstreams in parallel.
Victimology
Who was the victim? Not sentimentally β operationally. Their movements, finances, relationships, phone, debts, disputes, routines and recent changes in behaviour. In the large majority of homicides the offender is known to the victim, so the victim's life is usually where the answer is.
The practical rule: reconstruct the last 24 hours in full, then the last month in outline.
The TIE strategy
Trace, Interview, Eliminate. A defined category of people β everyone at the address, everyone who called that phone, every registered owner of a particular vehicle model in a given area β is identified, spoken to, and eliminated against stated criteria.
Elimination criteria are set explicitly in advance: forensic (DNA doesn't match), evidential (verified elsewhere), or descriptive. Anyone who cannot be eliminated stays on the list. This is the real-world version of the closed circle that detective fiction constructs artificially, and it's why a good SIO is as interested in the criteria as in the individuals β sloppy criteria eliminate the offender.
House-to-house
Systematic canvassing of an area, with a defined questionnaire so answers are comparable. Non-responses are logged and revisited, because the person who never answers the door is data.
Digital and communications
In most modern investigations this now produces more evidence than the physical scene:
- Phone data β call records, message content, and cell site analysis placing a handset in a coverage area at a time.
- CCTV β public and private, gathered urgently before automatic overwriting. Recovering and viewing it is enormously labour-intensive and consumes a large fraction of the investigation's hours.
- ANPR / ALPR β automatic number plate recognition, tracking vehicle movements across a road network.
- Financial records β card transactions, ATM withdrawals, transfers.
- Digital devices and cloud accounts β searches, location history, app data, doorbell cameras.
The consequence is that the modern alibi is checkable in ways that Golden Age fiction never anticipated. A twenty-first-century mystery either engages with this or has to explain its absence.
Forensic strategy
Not "test everything" β a forensic strategy is a set of prioritised questions with a submission plan, because laboratory capacity is finite and turnaround takes real time. The pathologist's post-mortem contributes cause of death and a time-of-death window, and the forensic results address specific propositions rather than fishing broadly. What those results can and can't establish is a subject of its own β see what forensic evidence actually proves.
Suspect interview
When a suspect is identified, the interview is a formal, recorded procedure with legal safeguards, and in England and Wales it follows the PEACE model β non-accusatory, structured around obtaining a full account first and testing it against evidence afterwards.
The strategic core is that evidence is usually withheld until the suspect has committed to a version of events. Presenting a contradiction early tells the suspect exactly what you hold and lets them repair the rest. We cover the research behind this, and why accusatory interrogation styles fell out of favour, in what deception research actually says.
The 72-hour rule of thumb
Investigators often say that a homicide not solved within the first 48 to 72 hours becomes markedly harder. It's a rule of thumb rather than a statistical law, and it reflects mechanism rather than magic:
- Physical evidence degrades and gets cleaned up.
- CCTV overwrites.
- Witness memory decays fastest early, and contaminates as people discuss what they saw.
- Offenders dispose of items, construct accounts and align stories with others.
- Resourcing peaks early; teams shrink as time passes and other cases arrive.
Most homicides are solved quickly because most are not mysteries β the relationship between victim and offender is obvious and the evidence is abundant. The cases that survive 72 hours are disproportionately the ones with no obvious relationship, which are exactly the cases detective fiction is about.
Why cases go cold, and how they're reopened
Cases go undetected for a small number of recurring reasons: no forensic recovery, no witnesses, a victim with no traceable network, an early misdirection that consumed the investigative window, or the linking information being present in the file but never surfaced.
Cold case review typically restarts when one of four things changes:
- Forensic capability improves β sensitivity increases, or a technique that didn't exist at the time becomes available.
- A database hit occurs β a profile loaded years ago matches a new arrest.
- Relationships change β an alibi provider separates, a witness is no longer afraid, someone dies and someone else feels released.
- A fresh pair of eyes re-reads the file β the most common and least glamorous route, and a direct descendant of the HOLMES problem: the answer was in the material all along.
What to take from this
If you write mysteries: the procedural skeleton gives you obstacles that are more interesting than the ones fiction usually invents. Not "the detective is taken off the case," but the CCTV overwrote at 31 days, the elimination criteria were set too loosely, the statement that mattered is number 4,412. These are fair, checkable, and they let a reader anticipate the failure. Our writing guide covers building a true timeline against a visible one, which is exactly what a policy log and a MIR are for.
If you play mysteries: steal the structure. Run victimology first β reconstruct the last 24 hours before you form any theory. Build an explicit TIE list with stated elimination criteria, and notice when you've eliminated someone on weak grounds. Keep a policy log of your own: what you decided to pursue and why. In a case with a dozen suspects and forty pieces of evidence, the failure mode is never a shortage of information β it's exactly the HOLMES problem, where you already have what you need and can't see it.
The Vigil and The Warren both punish unstructured investigation hard: there's enough material that a detective working from impressions will drown, and a detective working a list will not. Snowbound Pursuit is the cleanest place to practise the last-24-hours reconstruction, because four crimes in one night force you to build a proper timeline before anything makes sense.
Frequently asked questions
How do police actually investigate a murder?
In parallel workstreams, not sequentially: scene preservation and forensic recovery, victimology, a TIE list of people to trace and eliminate, house-to-house canvassing, digital and CCTV work, and suspect interviews. A senior investigating officer sets the strategy and records the reasoning for every major decision.
What is the golden hour in policing?
The period immediately after an incident when evidence is most available and most easily lost β CCTV before it overwrites, witnesses before they disperse and discuss, forensic material before it degrades. Most later problems in an investigation trace back to something that was recoverable in this window.
Is it true that most murders are solved in the first 48 hours?
Most are solved quickly, but that's because most homicides aren't mysteries β the offender is known to the victim and the evidence is plain. The 48-to-72-hour figure is an investigative rule of thumb describing how fast evidence and memory degrade, not a statistical threshold.
What does TIE mean?
Trace, Interview, Eliminate. A defined group of people is identified, spoken to, and formally eliminated against pre-set criteria. Anyone who can't be eliminated remains a subject. Setting the elimination criteria correctly is the part that determines whether the strategy works.
Why do murder cases go cold?
Usually a combination of no forensic recovery, no witnesses, and an early line of enquiry that consumed the window. A recurring and underrated cause is volume β the crucial link is in the material but was never surfaced, which is precisely why major incident room database systems were built.
How can I use real procedure in a mystery game?
Work the order police work: victim's last 24 hours first, explicit suspect list with written elimination criteria second, theory last. Most players do it backwards β form a theory, then look for support β which is how you end up eliminating the right person on bad grounds. Try it on a case and keep a written log of what you ruled out and why.
