When a bearing fails in industrial service, the immediate priority is usually getting the machine running again. But for many organizations, the failure itself triggers a second challenge: determining who is responsible. Was the bearing defective from the factory? Was it improperly installed? Did inadequate lubrication cause premature wear? Was the machine operated outside its rated parameters?
These questions matter because the answers determine who pays. In warranty disputes between equipment manufacturers and operators, in insurance claims for catastrophic machinery damage, and in regulatory compliance investigations, the physical evidence from the failure event is the foundation of every argument.
The problem is that standard condition monitoring systems were never designed to produce evidence. They were designed to produce alerts.
The Gap Between Monitoring Data and Forensic Evidence
Most bearing condition monitoring systems work on a simple principle: measure vibration periodically, trend the results over time, and alert when measurements exceed a threshold. This is useful for maintenance planning — it tells you that a bearing is degrading and approximately how fast. But it does not tell you why the bearing is degrading, and it does not preserve the detailed physical record of what happened at the moment of failure.
Here is why standard monitoring data falls short in disputes:
- Averaged and decimated data. Most systems store summary statistics — peak amplitude, RMS levels, spectral band energy — rather than raw waveform data. The original vibration signal that would reveal the failure mechanism is discarded to save storage and bandwidth.
- Periodic snapshots, not continuous capture. A system that samples every 4 hours misses everything between measurements. If the bearing transitions from healthy to failed in 30 minutes, the monitoring data shows “healthy” in one snapshot and “failed” in the next, with no record of the transition.
- No chain of custody. Data stored in a cloud platform can be edited, deleted, or selectively exported. There is no cryptographic proof that the data presented in a dispute is the same data that was originally recorded.
- No pre-event context. When a failure occurs, the most valuable evidence is the data from immediately before the event — the vibration signatures that reveal whether the root cause was a sudden impact, gradual fatigue, lubrication starvation, or misalignment. Standard systems that trigger alerts after a threshold is exceeded do not preserve what happened before the threshold was crossed.
What Makes Evidence “Forensic-Grade”
Forensic-grade bearing evidence has specific characteristics that distinguish it from standard condition monitoring data:
1. Pre-Event and Post-Event Capture
The sensor continuously maintains a rolling buffer of high-frequency vibration data. When a failure event is detected — via shock threshold, spectral discontinuity, thermal excursion, or acoustic transient — the system freezes the pre-event buffer and continues capturing post-event data for a defined window. The result is a complete record of what happened before, during, and after the failure.
2. High-Frequency Raw Waveforms
While standard monitoring systems might sample at 1 kHz and store RMS averages, forensic capture requires raw waveform data at 10–50 kHz or higher. At these sampling rates, the system captures the individual impulses from each rolling element striking a defect — the physical fingerprint that identifies the fault type, its location on the bearing, and its severity at the moment of failure.
3. Tamper-Evident Sealing
The evidence package must be cryptographically sealed on the sensor itself, before any data leaves the device. This means the raw waveforms, timestamps, sensor calibration data, and event metadata are hashed and signed immediately after capture. Any subsequent modification — even changing a single data point — invalidates the cryptographic seal. This is the digital equivalent of a tamper-evident evidence bag.
4. Chain of Custody Metadata
Every evidence package includes metadata documenting who deployed the sensor, when it was deployed, what machine it was monitoring, and what the sensor configuration was at the time of capture. Access to the sealed data requires multiple independent keys — no single party can unilaterally access, alter, or suppress the record.
Real-World Scenarios Where Forensic Evidence Matters
Warranty Disputes
A mining company installs new slurry pump bearings rated for 20,000 hours. They fail after 3,000 hours. The bearing manufacturer argues that contamination from the operating environment caused premature failure. The mining company argues that the bearings were defective. Without forensic-grade vibration data from the failure event, both sides are arguing from opinion rather than evidence. With it, a vibration analyst can examine the defect frequency signatures to determine whether the failure pattern is consistent with a manufacturing defect (inner race inclusion, for example) or an operational cause (contamination-induced surface damage).
Insurance Claims
A paper mill experiences a catastrophic gearbox failure that damages the machine frame and shuts down production for three weeks. The insurance claim is for $2.4 million. The insurer wants evidence that the failure was not caused by deferred maintenance. The mill needs to demonstrate that the failure was sudden and unpredictable — not the result of operating equipment in a known degraded condition. Forensic vibration data showing no prior degradation trends supports the mill’s position. Data showing progressive deterioration over months supports the insurer’s.
Regulatory Compliance
In regulated industries — marine propulsion systems governed by classification societies like DNV and Lloyd’s, railway axle bearings under Federal Railroad Administration oversight, nuclear facility rotating equipment — there are specific requirements for documenting equipment condition and failure events. Forensic-grade evidence with chain-of-custody metadata meets documentation standards that averaged trend data does not.
The Dual-Mode Advantage
The practical challenge with forensic evidence capture is justifying the sensor deployment. Installing sensors solely for the purpose of capturing failure evidence is difficult to justify economically — failures are rare events, and the sensors sit idle most of the time.
This is where dual-mode sensor platforms become compelling. A sensor that runs predictive maintenance firmware 99% of the time — providing continuous vibration trending, health scoring, and early warning alerts — justifies its deployment through day-to-day operational value. When a failure does occur, the same hardware switches to forensic capture mode, preserving the detailed evidence record that standard monitoring discards.
The firmware switch happens over the air — no physical access to the sensor required, no hardware swap, no truck roll. The sensor’s predictive maintenance operation provides the economic justification for deployment, while the forensic capability provides the evidence capture that matters when things go wrong.
For more on the technical architecture behind forensic bearing evidence capture, see our detailed article on why tamper-evident data changes everything in multi-party disputes.
What to Look For in a Forensic Bearing Monitoring System
If your organization operates in an environment where bearing failure evidence could become part of a dispute, insurance claim, or compliance investigation, here are the key capabilities to evaluate:
- Pre/post-event buffering — Does the system capture what happened before the failure trigger, or only after?
- Raw waveform storage — Does the system store the actual vibration waveforms, or only derived statistics?
- On-device sealing — Is the evidence package sealed cryptographically on the sensor, before data transmission?
- Multi-key access — Can any single party unilaterally modify or delete the evidence?
- Sampling rate — Is the capture rate sufficient to resolve individual bearing defect impulses at the operating speed?
- Survivability — Will the sensor and its stored evidence survive the failure event itself?
Standard vibration sensors answer the question “is this bearing healthy?” Forensic bearing sensors answer the question “what physically happened when this bearing failed, and can we prove it?”
In industries where the cost of a bearing failure extends beyond the replacement part — into warranty claims, insurance disputes, regulatory penalties, and production losses — the ability to answer that second question with verifiable evidence is the difference between a resolved dispute and a protracted one.