When a critical bearing fails in service, the replacement cost is rarely the largest expense. The real financial exposure comes from what happens next: warranty disputes between operators and manufacturers, insurance claim investigations, regulatory compliance reviews, and production-loss liability arguments. In every one of these scenarios, the outcome depends on evidence — specifically, on the physical record of what happened to the bearing before, during, and after the failure event.
Forensic bearing failure evidence capture is the practice of preserving high-fidelity sensor data from the moment a bearing fails, sealed in a tamper-evident format that maintains chain-of-custody integrity. It is not condition monitoring. It is not predictive maintenance. It is a fundamentally different function designed to answer a fundamentally different question: not “is this bearing degrading?” but “what physically happened when this bearing failed, and can we prove it?”
Why Standard Condition Monitoring Data Is Not Evidence
Predictive maintenance systems are designed to alert operators before a failure occurs. They measure vibration periodically — typically every few minutes to every few hours — extract summary statistics like RMS velocity, peak acceleration, and spectral band energy, then trend those values over time. When a value exceeds a preset threshold, the system generates an alert.
This is valuable for maintenance planning. It is not valuable for post-failure dispute resolution, for several specific reasons:
Decimated and Averaged Data
Most condition monitoring systems discard the raw vibration waveform after extracting summary features. A 10-second capture at 25.6 kHz produces roughly 512,000 data points. The system reduces this to perhaps 10–20 derived values: overall RMS, peak, crest factor, and energy in a few spectral bands. The original waveform — which contains the bearing defect impulses, their spacing, their amplitude modulation pattern, and the precise spectral signature that identifies the failure mode — is gone.
In a dispute, an independent vibration analyst needs the raw waveform to perform root cause analysis. Summary statistics tell you a bearing was degrading. The raw waveform tells you why — and specifically whether the failure pattern is consistent with a manufacturing defect, installation error, contamination, inadequate lubrication, or overload. Without raw data, both parties in a dispute argue from interpretation rather than physical evidence.
Gaps in the Record
A monitoring system that captures a 2-second vibration snapshot every 4 hours provides 0.014% coverage of the operating period. If a bearing transitions from healthy to failed in 30 minutes — which does happen during sudden-onset failure modes like cage fracture, contamination ingress, or loss of lubrication — the monitoring record shows “healthy” in one snapshot and “failed” in the next. The failure event itself, including the critical pre-failure signatures that reveal root cause, falls in the gap.
No Tamper Protection
Standard monitoring data is stored in databases or cloud platforms where it can be edited, selectively exported, or deleted. In a multi-party dispute, there is no cryptographic proof that the data presented by one party is the same data that was originally recorded by the sensor. An operator presenting trend data showing no prior degradation has no way to prove that degradation data was not selectively removed. A manufacturer disputing the operating conditions has no way to verify that the condition data was not modified after the fact.
No Pre-Event Context
Standard monitoring systems trigger alerts after a threshold is exceeded. They do not preserve what happened before the threshold was crossed. But the most diagnostically valuable data in a bearing failure is the pre-event record: the subtle changes in vibration signature that reveal whether the root cause was progressive fatigue, sudden impact damage, thermal event, or operational overload. Without pre-event data, forensic analysis of the failure mechanism is severely limited.
What Forensic Evidence Capture Actually Involves
Forensic bearing failure evidence capture addresses each of these limitations through a fundamentally different data architecture. Rather than optimizing for maintenance alerts, it optimizes for producing a complete, tamper-evident, legally defensible record of the failure event.
Continuous High-Frequency Buffering
A forensic capture system maintains a rolling buffer of raw vibration data at high sampling rates — typically 25.6 kHz to 51.2 kHz for standard bearing applications, or higher for high-speed machinery. The buffer operates continuously, overwriting the oldest data as new data arrives. When a failure trigger fires — whether from a shock threshold, spectral discontinuity, thermal excursion, or acoustic transient — the system freezes the buffer, preserving the pre-event data, and continues capturing post-event data for a defined window.
The result is a continuous, high-fidelity record spanning the period before, during, and after the failure. For a system with a 60-second pre-trigger buffer sampling at 25.6 kHz, that represents over 1.5 million data points of pre-event context — enough for detailed spectral analysis of the bearing condition immediately before the failure, including identification of specific defect frequencies (BPFO, BPFI, BSF, FTF) and their harmonics at operating speed.
On-Device Cryptographic Sealing
The evidence package is sealed cryptographically on the sensor hardware itself, before any data leaves the device. This means the raw waveform data, timestamps (synchronized to a verified time source), sensor calibration parameters, trigger conditions, and device identification are hashed together and digitally signed using a private key stored in the sensor’s secure element.
Any modification to the sealed data — changing a single sample value, altering a timestamp, removing a segment of the record — invalidates the cryptographic signature. This provides the digital equivalent of a tamper-evident evidence bag: the evidence can be verified as unmodified by any party with access to the corresponding public key, without trusting the party that collected the evidence.
Multi-Key Access Control
In a dispute, no single party should have unilateral control over the evidence. A forensic evidence system implements multi-key access: accessing the sealed evidence package requires authorization from multiple independent parties. This prevents any single party — the operator, the manufacturer, the sensor vendor — from accessing, modifying, or suppressing the evidence without the knowledge and consent of the other parties.
This is analogous to the physical chain-of-custody procedures used in forensic investigations: evidence is sealed, access is logged, and no individual can compromise the record without detection.
Comprehensive Metadata
The evidence package includes not just the vibration data but the complete context necessary to interpret it: sensor serial number and calibration certificate, mounting location and orientation, machine identification and operating parameters (speed, load, temperature at the time of capture), firmware version and configuration, GPS coordinates and timestamp, and trigger event details. This metadata ensures that the evidence can be independently interpreted without relying on the collecting party’s verbal description of the operating conditions.
Where Forensic Evidence Capture Matters Most
Not every bearing installation warrants forensic evidence capture. The cost and complexity are justified where the financial exposure from a failure dispute significantly exceeds the cost of the bearing itself.
Marine Propulsion Systems
A stern tube or thrust bearing failure on a commercial vessel can trigger a cascade of costs: emergency towing ($50,000–$500,000+), port delay penalties, cargo demurrage, drydock repair, and classification society investigation. Disputes between the vessel operator, bearing manufacturer, and shipyard that installed the bearing can extend for years. Forensic evidence that definitively identifies the root cause — manufacturing defect, installation error, or operational abuse — resolves these disputes on the basis of physical evidence rather than competing expert opinions.
Railway Axle Bearings
Axle bearing failures on rolling stock carry safety implications beyond the immediate mechanical damage. Federal Railroad Administration investigations following bearing-related incidents require documentation of bearing condition history and the failure event itself. Forensic evidence from continuous high-frequency monitoring provides the documentation that post-incident inspection of damaged hardware often cannot.
High-Value Industrial Rotating Machinery
Large electric motors, turbines, compressors, and gearboxes in process industries can carry replacement costs in the hundreds of thousands to millions of dollars. When these bearings fail prematurely, warranty disputes between the OEM and operator routinely involve competing claims about whether the failure was caused by a manufacturing defect or by operating conditions outside the bearing’s rated envelope. The party with better evidence has the stronger position.
The Economic Argument
The cost of forensic evidence capture hardware is measured in hundreds to low thousands of dollars per monitoring point. The cost of a major bearing failure dispute — including legal fees, expert witnesses, production losses during the dispute period, and the settlement itself — is measured in tens of thousands to millions of dollars.
More importantly, the presence of forensic evidence capture capability often prevents disputes from escalating in the first place. When both parties know that a tamper-evident, high-fidelity record of the failure event exists, the incentive to negotiate in good faith increases substantially. Disputes that would otherwise require months of expert analysis and legal proceedings can be resolved by reviewing the evidence record — because the evidence record actually contains the physical information needed to determine root cause.
For organizations that have experienced bearing failure disputes, the value proposition is straightforward: the question is not whether forensic evidence capture is worth the investment, but whether the next dispute will occur before or after the system is installed.
How Forensic Evidence Capture Differs from Predictive Maintenance
It is important to understand that forensic evidence capture is not a replacement for predictive maintenance — it is a complement to it. The two functions serve different purposes, optimize for different outcomes, and require different data architectures.
Predictive maintenance answers: “Is this bearing degrading, and when should we intervene?” It optimizes for early detection and maintenance planning. Forensic evidence capture answers: “What happened when this bearing failed, and can we prove it?” It optimizes for post-failure accountability and dispute resolution.
A dual-mode sensor platform can serve both functions on the same hardware: running predictive maintenance firmware during normal operations (providing the day-to-day operational value that justifies deployment) and switching to forensic capture mode when a failure event is detected (preserving the evidence record that matters when things go wrong). For a deeper discussion of how these architectures differ, see our article on why forensic bearing evidence matters in warranty disputes.
For technical details on how bearing defect frequencies are used in both predictive and forensic analysis, our companion article on understanding BPFO, BPFI, BSF, and FTF provides the mathematical foundations.
Getting Started
Organizations considering forensic bearing failure evidence capture should evaluate three factors: which bearing installations carry the highest financial exposure from failure disputes, what data architecture is required to produce evidence that will withstand scrutiny in warranty claims, insurance investigations, or regulatory reviews, and whether a dual-mode platform can provide both predictive maintenance value and forensic capture capability on the same hardware deployment.
The bearings that justify forensic evidence capture are not necessarily the ones that fail most often. They are the ones where failure triggers the most expensive disputes — and where the absence of verifiable evidence is the reason those disputes become expensive in the first place.