The requirement to differentiate between incorporation and external contamination of drugs into hair is undisputed, in particular when dealing with compounds which are administered by sniffing or inhalation (e.g. cocaine). With the aim of making this discrimination, hair samples from cocaine (COC) users (group IN) and seized cocaine samples (group OUT) were compared regarding the parameters benzoylecgonine (BZE), ecgonine methyl ester (EME), ecgonine (ECG), anhydroecgonine methyl ester (AEME), cocaethylene (CE) and norcocaine (NCOC). Since most of these compounds may be minor by-products of COC or be formed by biotransformation or chemical degradation, the stability of each substance was carefully examined. COC was found to be converted into significant amounts of BZE, EME and ECG even under mild extraction conditions, while traces of NCOC proved to be a ubiquitous by-product of COC. Cocaine positive hairs and seized cocaine samples (diluted to relevant concentrations) were equally preprocessed and analyzed by LC-MS-MS. Out of the metabolites listed above, NCOC, CE and AEME (each normalised to COC) were significantly increased in the incorporation group (i.e. hair samples from cocaine users). Based on this approach, a statistical discriminant analysis enabled us to make a prediction (and estimation of uncertainty) for each cocaine positive hair sample as to its likelihood of belonging to the group of cocaine users or of being contaminated.