Decoding the Black Box: How NTSB Investigators Solve Aviation Mysteries

WASHINGTON — In the Netflix series, The Bombing of Pan Am 103, investigators cross fields in Scotland, catalogue wreckage, and follow fragments toward a criminal case that spans countries and years. The series turns painstaking evidence work into drama. It also raises a question that follows nearly every major US aviation accident: What happens when the National Transportation Safety Board (NTSB) arrives?

The first answer is a jurisdictional one. The 1988 destruction of Pan Am Flight 103 over Lockerbie was an intentional act in Scotland, not a routine NTSB-led investigation—I mention the Netflix show because I just binged-watched it this weekend. The UK's Air Accidents Investigation Branch published the formal aviation-accident report on the Boeing 747, while Scottish police and the FBI pursued the criminal case.

An NTSB investigation has a different purpose. It is designed to establish what happened, determine probable cause, identify safety deficiencies, and recommend changes that could prevent another accident. It is not a prosecution, a lawsuit, or a regulatory enforcement action.

The distinction helps explain why the Board's work can feel both unusually open and frustratingly slow. Investigators release verified facts as an inquiry develops, but they resist the early answer that a dramatic image, radio call, or recovered recorder can appear to offer. Their job is to make the evidence agree.

The NTSB Investigates; the FAA Regulates

The NTSB is an independent federal agency. Congress separated it from the US Department of Transportation in 1974 so that it could examine a transportation system whose regulators, infrastructure, and oversight may themselves become part of an investigation. The agency's current mission includes objective investigations, safety studies, advocacy for safety recommendations, and assistance to disaster survivors and families.

For aviation, the division of responsibility is fundamental. The Federal Aviation Administration writes and enforces civil aviation rules, certifies aircraft and operators, and runs the US air traffic control system. The NTSB investigates accidents and selected incidents, determines probable cause, and recommends corrective action. It cannot order the FAA, an airline, or a manufacturer to adopt a recommendation.

The NTSB also does not investigate crimes. Its investigative-process guidance says that local law enforcement or the FBI becomes the lead when a transportation tragedy is determined to be a criminal act. That boundary separates the Board's safety mission from the joint police and FBI investigation dramatized in The Bombing of Pan Am 103.

In practice, the same event can produce parallel inquiries. The NTSB may seek safety lessons while the FAA examines regulatory compliance, an airline conducts an internal review, insurers assess loss, attorneys prepare civil claims, and law enforcement preserves potential criminal evidence. Those inquiries ask different questions and operate under different rules.

The First Hours Are About Preserving Evidence

Once the NTSB receives notice of an accident, aviation-safety leadership decides the scale of the response. A major airline accident can trigger a Go Team: specialists on rotating duty who deploy quickly with the protective equipment and technical tools required for the scene.

A senior investigator serves as investigator-in-charge, or IIC. The IIC directs the investigation and divides the work among technical groups selected for the circumstances. The NTSB's description of a Go Team lists specialties that can include operations, structures, powerplants, aircraft systems, air traffic control, weather, human performance, and survival factors.

The scene is only one part of the investigation, but it contains evidence that can disappear. Wreckage may need to be moved for rescue or recovery. Weather changes. Electronic records can be overwritten. Witness memories begin to shift. Investigators photograph, map, measure, and catalogue before the site is cleared, while also obtaining records and identifying components for further examination.

Public briefings occur alongside that work. Airways' coverage of the NTSB's first briefing after the January 2025 collision near Reagan National Airport (DCA) showed the agency forming specialized groups and emphasizing evidence collection. That is the purpose of an early briefing: to explain what investigators know and what they are doing, not to announce why the accident happened.

A Board member may serve as the public spokesperson at a major scene, but Board members do not lead the field investigation. The IIC does. Public-affairs staff coordinate the release of information so that parties working inside the investigation do not offer competing accounts based on incomplete evidence.

The “Black Box” Is a Witness, Not a Verdict

The familiar singular term “black box” usually refers to two devices on large commercial aircraft: a cockpit voice recorder (CVR) and a flight data recorder (FDR). Some smaller commercial, corporate, and private aircraft carry them as well, but many aircraft involved in NTSB investigations do not have both.

The CVR captures flight-crew voices, radio transmissions, alerts, and other cockpit sounds. The FDR records operating parameters such as altitude, airspeed, heading, aircraft attitude, control inputs, and system status, with the recorded set depending on the aircraft and installation. According to the NTSB's flight-recorder explainer, some modern recorders capture more than 1,000 parameters.

In an NTSB-led case, recorder specialists take the units to the agency's laboratory in Washington. Damage to the outer chassis does not necessarily mean the protected memory is unreadable. In the Atlas Air Flight 3591 investigation, the NTSB said its laboratory disassembled, cleaned, and dried the FDR memory module before successfully downloading its data.

The laboratory then turns raw information into a common timeline. Recorder specialists can synchronize cockpit audio with FDR parameters, air traffic control recordings, surveillance data, airport video, and other electronic sources. A change in a recorded parameter becomes meaningful only when investigators know what system produced it, how it was sampled, whether the sensor was reliable, and what else occurred at the same time.

Even sound requires interpretation. A click may correspond to a switch, an alert to a system state, or a change in background frequency to engine behavior. A committee with relevant technical representatives can assist in preparing the CVR transcript, but the NTSB controls the process.

The public will not hear the cockpit recording from the NTSB. Federal law prohibits the Board from releasing CVR audio. The agency can later publish a transcript of pertinent portions under controlled conditions, a safeguard intended to balance investigative value with the sensitivity of cockpit conversation.

Recorders can answer powerful questions: what the aircraft did, what systems reported, what the crew heard, and how rapidly an event unfolded. They cannot, by themselves, establish why a component failed, why a procedure was designed a certain way, what training a crew received, or whether an oversight system should have detected a hazard earlier.

Wreckage, Documents, and Digital Evidence Must Agree

A major investigation becomes a reconstruction assembled from different kinds of evidence.

Structures specialists examine deformation, fractures, paint transfer, and the distribution of wreckage. Powerplant and systems investigators may supervise component disassembly or testing at a manufacturer or specialist facility. The NTSB's Materials Laboratory Division can analyze materials and structures, fire and explosion evidence, and chemical or forensic questions. Vehicle-performance specialists use photogrammetry, three-dimensional scanning, video analysis, and animation.

Operations investigators build the history of the flight and relevant crew activity. Human-performance specialists examine training, workload, fatigue, medical information, medication, and the design of the working environment. Weather investigators reconstruct the conditions the crew encountered rather than relying on a single routine observation. Survival-factors specialists study impact forces, restraint performance, evacuation, emergency response, and crash-fire-rescue activity.

The paper and digital trail can be as important as the wreckage. Maintenance records may show when a part was installed, inspected, or repaired. Training records establish what procedures were taught and tested. Design drawings and certification documents define how a system was intended to work. Air traffic surveillance, radio recordings, dispatch messages, photographs, phones, cameras, and aircraft health-monitoring systems can add separate clocks and viewpoints.

No item is automatically trusted because it is electronic. Investigators establish where data came from, align time bases, check precision and gaps, and compare the result with physical evidence. A useful finding survives that cross-checking.

Why Airlines and Manufacturers Join the Investigation

The NTSB has approximately 400 employees across every transportation mode. It cannot maintain every model-specific tool, drawing, and operating specialty inside the agency. Its solution is the party system.

The FAA is automatically a party to an NTSB aviation investigation. The Board can also designate an airline, aircraft or engine manufacturer, labor union, airport, or another organization whose employees possess needed technical knowledge. A manufacturer may explain a component's design and supply test equipment. An operator may provide records, facilities, and personnel familiar with its procedures.

That arrangement does not hand the investigation to the organizations whose conduct may be examined. Under the NTSB's party-system rules, representatives work under Board direction; people serving in legal or litigation roles are not permitted as party representatives. The NTSB decides who participates and can remove a party that violates its rules.

Group members help collect evidence and check factual reports for accuracy. They do not participate in the NTSB's analysis or report writing. Parties may later submit proposed findings, probable cause, and recommendations for the public docket, but the Board reaches its own conclusions.

That wall between fact gathering and analysis is essential. Technical collaboration makes a complex investigation possible. Independent analysis gives the result its public value.

Preliminary Facts Are Not Probable Cause

An early NTSB report is deliberately limited. The agency says a preliminary report is generally released roughly a month after an accident and contains factual information gathered during the initial phase. It does not contain analysis or a probable-cause finding.

The distinction is easy to lose in a fast news cycle. A preliminary report may document a failed component, a warning, a weather condition, or a crew action without establishing why it occurred or how much it contributed. The NTSB explicitly warns reporters not to use that partial record to speculate about cause.

Fact gathering continues after investigators leave the scene. Engines and components may be torn down. Laboratory tests may be repeated. Investigators conduct interviews and collect maintenance, design, training, medical, and operational records. Group chairs prepare factual reports, and the evidence considered by investigators is added to a public docket at the appropriate stage.

The NTSB's accident-docket search gives the public access to factual reports and evidence used to develop probable cause. A docket is not itself the Board's conclusion. It is the evidentiary record from which analysis will be built.

The agency says a major final report can take one to two years, though timing depends on complexity and workload. That interval is not inactivity. It is where investigators test whether the mechanical, operational, human, environmental, and organizational evidence supports the same sequence.

A Hearing Is Not the Final Decision

For some investigations, the NTSB convenes an investigative hearing. Witnesses testify under oath, and NTSB staff, Board members, and designated parties can ask questions about issues selected for public examination.

The agency describes those hearings as fact-finding proceedings. They do not assign fault or legal liability, and they do not produce the final report. A hearing transcript normally becomes part of the docket.

That is different from a Board meeting. After investigators complete the factual work, NTSB specialists, led by current Chair Jennifer Homendy—my hero—analyze the evidence and draft a report.

Depending on the case, a modal office director can approve it under delegated authority, or the five-member Board considers it in a public meeting. Board members may debate and amend the staff proposal before voting to adopt the findings, probable cause, and recommendations.

The span between those stages was visible in Airways' Alaska Airlines Flight 1282 coverage. The first NTSB briefing described the party process and technical groups; the later Board action addressed probable cause and safety recommendations. The early and final stories were not competing versions. They documented different products of the same investigation.

The Most Important Product May Come Before the Report

Probable cause explains the accident. A safety recommendation asks someone with the power to change the system to act.

The NTSB can direct recommendations to the FAA, other government bodies, manufacturers, operators, labor organizations, or local authorities. It can also issue urgent recommendations before the final report when evidence identifies a hazard that should not wait for the investigation to close.

Recommendations are not regulations. The recipient decides what action to take, and the NTSB evaluates the response. The Board tracks each recommendation until it is closed, often over several years, and classifies whether a completed or planned response is acceptable.

That makes the NTSB influential without making it an enforcement agency. Its leverage comes from technical findings, public documentation, advocacy, and the pressure created when a regulator or company declines to address a documented hazard.

The work can change cockpit equipment, inspection programs, training, air traffic procedures, airport design, emergency response, certification standards, and the way operators manage risk. Sometimes corrective action begins while an investigation is still open, eliminating the need for a later recommendation on that point.

Families Are Part of the Response, But Not the Evidence Team

A major launch includes more than technical investigators and media staff. Under federal family-assistance law, the NTSB coordinates federal resources supporting survivors and victims' families while airlines, local authorities, disaster-relief organizations, and other agencies perform their assigned roles.

The federal aviation-disaster framework grew from legislation enacted in 1996. Family assistance is separate from determining probable cause, but it is not secondary to the agency's response. It helps establish a reliable channel for information and coordinates services during a period when families face intense uncertainty.

NTSB personnel do not publicly release victims' identities. Local authorities or the operator handle those announcements under their own responsibilities. Families may observe public proceedings and receive updates, but neither families nor investigative parties participate in the Board's final deliberation.

Outside the United States, Another State Usually Leads

International aviation investigations follow the state-of-occurrence framework in Annex 13 to the Convention on International Civil Aviation. If an accident abroad involves a US-registered aircraft, a US operator, or a US-designed or manufactured aircraft, the NTSB may appoint a US accredited representative and technical advisers.

The NTSB's foreign-investigation guidance makes the limit clear: the state conducting the investigation remains in charge and controls the release of information. The NTSB supports the inquiry and represents US interests; it does not publish a competing final report.

That framework is another reason not to describe every overseas accident involving a Boeing aircraft or US airline as an “NTSB investigation.” The agency may play a substantial technical role without leading the case.

Lockerbie brought the distinctions together. The AAIB examined how the aircraft was destroyed and published the safety investigation. Scottish and US law enforcement pursued responsibility for the bombing. Each investigation used evidence from the same catastrophe, but each answered a different institutional question.

Watching the show brought me back to my own stint in AVSEC, where I worked as an evaluator for a European firm assessing EU-regulated agents. It also reminded me how many moving parts can sit behind a modern aviation investigation, and why it matters to understand which agency is doing what, and what each stage of the process actually tells us.

How to Read the Next NTSB Update

The next time the NTSB holds a briefing, releases a preliminary report, opens a docket, or convenes a hearing, the label tells readers what the material can support.

An on-scene briefing describes verified facts and the work underway. A preliminary report records early factual information. A docket exposes the evidence. An investigative hearing adds sworn testimony. A final report connects facts to analysis, findings, and probable cause. Safety recommendations turn the lessons into proposed action, sometimes long before the final report is adopted.

The black boxes matter because they preserve information that might otherwise vanish. They do not solve the investigation in isolation. The answer emerges when the recorders, wreckage, documents, tests, and people tell a coherent story—and when investigators can explain not only what happened, but what should change because of it.

Featured image: All major pieces of the Mitsubishi Heavy Industries (MHI) RJ Aviation (Bombardier) CRJ700 and the Sikorsky UH-60 Black Hawk involved in the Jan. 29 mid-air collision near Ronald Reagan National Airport were recovered to a secure airport facility for further examination and documentation. Photo courtesy: NTSB