I have seen the "swab individually everything in the bag" before. It was by a trainee and the supervisor said that was the SOP. If so, then most TSO's thankfully don't follow the SOP.

Maybe I am missing something, but wouldn't it be more effective to take one swab and wipe everything with it and run it? If not positive, then good to go. If positive, then the TSO can be more diligent in ascertaining the culprit. Also seems that the cumulative swab would be more likely to pick up the traces being searched for as well.