The Market Leaves Residue
In 1910, the French criminalist Edmond Locard proposed a deceptively simple law of physical contact: every meeting of two surfaces leaves a trace on each. A century later, Locard's exchange principle remains the philosophical foundation of forensic science. This paper argues that the same principle governs financial market behavior at the microstructure level.
Institutional accumulation and distribution cannot occur without leaving observable residue — in volume, in float dynamics, in repeated alert convergence, in the shape of price relative to its anchors. These traces are not predictions. They are not advice. They are forensic findings about events that have already occurred or are presently unfolding in the order book — observable, measurable, time-stamped, and amenable to chain-of-custody preservation.
“Every action of a man, and a fortiori the violent action which constitutes a crime, cannot occur without leaving some mark.”
— EDMOND LOCARD · 1910
Locard's Exchange Principle
Edmond Locard was born in 1877 in the village of Saint-Chamond, in the Loire region of France. By 1910 he had founded the world's first police forensic laboratory, a two-room facility in the attic of the Lyon courthouse, equipped with little more than a microscope, a spectroscope, and a folding camera. His resources were primitive. His thesis was extraordinary.
The corollary to Locard's principle, made famous by his student Paul Kirk and refined by generations of criminalists, is what we now call the exchange principle: when any two objects come into contact, each transfers material to the other. The criminal carries something away from the scene and leaves something behind. The contact itself is the proof.
Locard's first famous case demonstrated the principle. In 1912, a young woman named Marie Latelle was found strangled in her parents' home in Lyon. Her boyfriend, Émile Gourbin, had a seemingly airtight alibi — he had been playing cards with friends thirty kilometers away, and his friends would swear to it. Locard was not interested in the alibi. He examined Gourbin's fingernails under his microscope and found small flakes of skin and a residue of pink powder. The powder turned out to be a custom-blended cosmetic — a cream of bismuth, magnesium stearate, and a particular shade of rose pigment that matched, exactly, the makeup Marie Latelle had purchased from a particular pharmacist in Lyon two weeks earlier. Confronted with the analysis, Gourbin confessed.
The case is famous not because the science was complex — by modern standards, the analysis was crude — but because of what Locard had proven about the structure of evidence itself. Gourbin's alibi was constructed. His witnesses were paid. The card game was real but the timing was a lie. None of these reconstructed details survived contact with the trace evidence, because the trace evidence was not the product of any actor's intention. It was a physical consequence of contact that no amount of preparation could have anticipated or eliminated.
This is the property that makes trace evidence epistemologically distinctive. A confession can be coerced. A witness can be mistaken. A document can be forged. A weapon can be planted. But the residue of contact, when it can be observed and measured, is involuntary. It records what happened, not what anyone wishes to claim happened.
The forensic discipline that emerged from Locard's work is, at its core, a structured method for reading evidence that no participant intended to leave. The questions a criminalist asks are not metaphysical. They are mechanical. What touched what? In what direction? With what force? Over what duration? These are the questions trace evidence is built to answer. They are the same questions, this paper argues, that should be asked of the order book.
The Anatomy of Trace Evidence
Trace evidence behaves according to characteristic properties that distinguish it from other categories of forensic information. Understanding these properties is a prerequisite to recognizing the same patterns in domains other than physical crime scenes.
Residue of contact rather than the product of intention. A perpetrator can wear gloves, but cannot choose what fibers their jacket sheds onto a victim's collar. Unlike testimony, it cannot be retracted. Unlike a document, it cannot be forged.
Contact has geometry. A fiber transferred from a coat to a hand tells the analyst not just that two surfaces touched, but which yielded material and which received it, and the relative force. Trace evidence is a vector, not a yes-or-no signal.
Trace evidence has a half-life. The forensic clock matters in every case. Evidence is loudest immediately after the event and quieter every hour afterward. The investigator who arrives quickly recovers a richer record than one who arrives a week later.
A single brown wool fiber on a victim's coat is evidentiary noise. It becomes meaningful only when paired with a second fiber on the suspect's seat, a third on the doorframe, a fourth in the trunk. Strength emerges from convergence.
Unlike a fingerprint match, trace evidence requires interpretation by a trained analyst. The persuasive force of the evidence is inseparable from the discipline of the methodology. Trace evidence is as much an epistemological practice as a physical science.
These five properties — involuntary, directional, time-decaying, convergence-dependent, and expert-mediated — together describe what makes trace evidence powerful and what bounds its use. They also describe, this paper now argues, the structure of a particular kind of information available in financial markets.
From Crime Scene to Order Book
Markets are not crime scenes. The participants are not, with rare exceptions, criminals. But markets are venues of contact, in the strict Locardian sense. Every transaction is a meeting of two surfaces — a buyer and a seller — and that meeting deposits residue on both sides. The residue accumulates in the public tape, in the order book, in the option chain, in the volume profile, and in the time stamps that record when each contact occurred.
The professional participants in modern markets — institutional desks, market makers, algorithmic execution engines, hedged liquidity providers — operate under the same constraint that bound Émile Gourbin in his card game in Lyon. They cannot conduct their business without leaving residue. The residue is not the trade itself, which may be private, but the structural footprint of the trade in the public record: the volume that printed at a particular price, the breadth of the book that absorbed the order, the rate at which inventory was rebuilt afterward. Each of these is a trace. None is the institution's intention to communicate. All are involuntary consequences of size and speed meeting public infrastructure.
The question for any forensic discipline applied to markets is whether these residues can be measured, classified, and interpreted with the same care that a criminalist applies to physical trace material. The thesis of this paper, and of the forensic methodology underlying the platform that publishes it, is that they can — provided the discipline is held to the same epistemological standards. That means observable phenomena rather than inferences about intent. Documented methodology rather than proprietary black boxes. Time-stamped findings preserved with chain of custody. Convergence requirements rather than single-trait dispositive claims. And — crucially — explicit refusal to cross the line from forensic finding to predictive advice.
Market Trace Evidence — Seven Categories
The traces left by institutional activity in public market data fall into several categories, each loosely analogous to a physical-forensics category and each carrying its own evidentiary properties.
Volume is the residue of size. A stock printing five times its average daily volume in the first hour of trading has been touched by something larger than its retail order flow. The volume confirms that contact has occurred. In trace-evidence terms, volume is the broadest and least specific signature — comparable to the soil residue on a shoe — it confirms passage, without yet identifying the passenger.
Float is to a security what tire compound is to a vehicle: it determines how the asset behaves under load. Small float plus parabolic price movement plus high relative volume is a structural signature of a particular kind of activity — generally one in which a coordinated buyer or narrative has overwhelmed the natural absorption capacity of the security. The analyst does not know who. The analyst knows whoever did this used a particular kind of vehicle.
Markets have a clock. Activity that appears in the wrong place — a vertical move at 04:30 ET, a volume spike fifteen minutes after a press-release embargo lifts, a sudden book-thinning thirty seconds before an economic release — leaves a temporal trace. Time-of-event signatures are the market's equivalent of the deposition pattern that tells a criminalist whether a body was moved post-mortem.
A single alert from a screening tool is noise. Forty alerts on the same ticker over a single morning, fired by independently-configured studies measuring different aspects of activity — momentum, volume, percent change, breakout — is signal. Each alert is an independent witness reporting the same scene from a different angle. The convergence does not prove what happened. It does establish that something measurable, observed by multiple independent instruments, was under way.
The book is not symmetric in interesting moments. Bids being aggressively lifted while offers are replenishing slowly is the residue of buying pressure that exceeds market-making inventory capacity. The opposite — offers crashing into bids while bid-side replenishment slows — is the residue of distribution. Like blood-spatter analysis, the signature can be read directionally: not just “something happened” but “something happened in this direction, with this much force.”
Form 4 filings are the public record of insider transactions in U.S. equities. The patterns within them — clustering of cluster buys across multiple officers, accelerated 10b5-1 filings, departures from established pattern — have many of the same evidentiary properties as physical trace evidence. A single Form 4 buy of a thousand shares is unremarkable. Three independent insider buys at the same price level over forty-eight hours, against a market that is otherwise bearish, is a different kind of finding.
Public regulatory events — a Complete Response Letter from the FDA, a delayed K filing, an SEC subpoena disclosure, a halted listing — generate measurable shifts in price and volume that constitute their own category of evidence. The event itself is public. The market's reaction to the event, the rate at which liquidity rebuilds afterward, the pattern of which buyers step in at which price levels — these are the traces of how the event was absorbed, and by whom.
The Convergence Requirement
The single most important methodological principle inherited from physical forensics is that trace evidence is rarely dispositive in isolation. A single brown wool fiber proves nothing. A single high-volume bar on a single chart on a single day proves nothing. A single insider purchase, a single FDA filing, a single bullish news headline, a single oversized option print — none of these, taken alone, supports a forensic conclusion.
The discipline of forensic analysis is in part a discipline of refusing to draw conclusions from individual data points. It requires the analyst to wait for convergence: multiple independent signatures, captured by different instruments, describing the same underlying event from different angles, before any conclusion is offered. In physical forensics this convergence requirement is embedded in evidentiary standards — no responsible analyst will take a single fiber to court as the sole basis for a charge. The same standard, this paper argues, should govern any forensic methodology applied to market data.
The methodology underlying the platform that publishes this paper enforces convergence as a prerequisite for elevating any signal to public visibility. A momentum reading alone is not enough. A news catalyst alone is not enough. A volume anomaly alone is not enough. The standard for surfacing a forensic finding is the alignment of independent signatures — momentum, volume, news, regulatory context, insider activity, market regime — across multiple domains, each computed by separate machinery, each carrying its own confidence score. Only when several of these align, on the same ticker, within a tight time window, does the methodology classify the event as a finding worth publishing.
The cost of this conservatism is fewer findings.
The benefit is that the findings published carry the same evidentiary weight as a forensic report.
This Is Not Forecasting
A persistent confusion in the discussion of market analysis is the conflation of forensic finding with predictive forecasting. The two are categorically different activities, and the distinction matters legally as well as methodologically.
A forecast is a statement about the future. It says: this stock will rise, that index will fall, this sector will outperform. Forecasts are by their nature unfalsifiable until the future arrives, and even then they are evaluated only in aggregate, because any individual forecast can be defended as bad luck. Forecasting is the dominant idiom of financial advice, of investment management, and of the regulatory framework that governs personalized financial advisement under the Investment Advisers Act of 1940.
A forensic finding is a statement about the present and the recent past. It says: these traces, observed in this time window, exhibit this convergence pattern. The finding is verifiable at the moment of publication — the underlying data is timestamped and preserved. It does not assert what will happen next. It does not recommend an action. It does not address any individual reader's circumstances. It documents an observable state of the market and discloses the methodology by which that state was characterized.
- No entry prices, exit prices, position sizes, or stop-loss levels are specified for any individual user.
- No signal is described as a recommendation — every output is a forensic finding about observable market state.
- No suitability judgment is offered to any reader's individual circumstances.
- The publisher exclusion of the Investment Advisers Act §202(a)(11)(D) and the disclosure framework of CFTC Rule 4.41 govern the regulatory posture, and that posture is maintained at every customer-facing surface.
Locard, presenting his fiber analysis of Émile Gourbin's fingernails to the magistrate in 1912, did not predict that Gourbin would confess. He documented what the residue showed. The confession was not Locard's product. It was the consequence of Gourbin being confronted with evidence that no constructed alibi could explain. The forensic posture takes the same form: present the evidence, disclose the methodology, document the convergence, and let the reader form their own conclusions about what to do with the finding.
The Forensic Posture
The forensic posture in market analysis is not a metaphor. It is a transferable discipline, with its own epistemology, its own evidentiary categories, and its own methodological commitments. Locard's exchange principle is the foundational law of physical contact, and it has analogues in any domain where contact between participants leaves measurable residue. Markets are such a domain.
The volume on the tape, the asymmetries in the book, the convergence of independent alerts, the residue of insider transactions and regulatory events — these are traces of activity by participants who, like Locard's perpetrators, cannot conduct their business without leaving observable marks.
Reading these traces with the discipline of a criminalist, rather than the bravado of a forecaster, is a different kind of analytical practice than the one that dominates retail finance. It produces fewer claims. The claims it does produce are tied to documented evidence. Each one is preserved with timestamp and methodology disclosure. Each one is governed by convergence rather than inspiration. And each one stays, deliberately, on the impersonal, descriptive, declassified-archive side of the line that separates a publisher from an adviser.
Locard would, perhaps, have appreciated the application. The principle he derived from a microscope in an attic in Lyon proved general enough to remake an entire discipline. There is no obvious reason it should stop at the boundary of the trading floor.
- Document ID
- SCIF-003 / Intelligence Brief No. 003
- Authored
- Forensics.us LLC · Research Division
- Published
- April 2026 · Public Release
- MD5
- 722f2a9abb4474e12afe82895143c915
- SHA-256
- 6d213a0499ecf8ab45112189e36013653f5acb39844f8359b486d0f28bfb9759
- Custody
- Original record maintained at forensics.us/scif/paper-003
- Last Verified
- 2026-05-15 11:55 EDT
METHODOLOGY DISCLOSURE: This paper describes methodological principles applied at Forensics.us in the analysis of public market data. All findings produced under this methodology are based on publicly available data sources, including but not limited to: SEC filings (Form 4, 8-K, S-1), exchange-listed price and volume data, FDA regulatory event records, news headlines from public RSS feeds, and the publisher's own derived analytical signals. No proprietary or non-public information is used. No personal recommendations are offered. The publication operates under the publisher exclusion of the Investment Advisers Act of 1940 §202(a)(11)(D) and discloses, per CFTC Rule 4.41, that hypothetical or simulated performance has limitations as a measure of future results.
DISCLAIMER: Forensics.us is not an investment adviser, broker-dealer, or commodity trading advisor. Findings published under this methodology are forensic descriptions of observable market state and do not constitute investment advice, recommendations, or solicitations to buy or sell any security. Readers are responsible for their own investment decisions and are encouraged to consult a registered investment adviser regarding their individual circumstances.