Atkins Judgement and Internet Files

The police seized a personal computer from the Defendants home.  An police inspection of the computer found numerous images that appeared to have been obtained from the Internet.  The Defendant was charged with making indecent images.

Defence counsel requested that an appeal judgement regarding images in the browser cache (Atkins vs. DPP, 2000) should be taken into account during preparation of the report.

The CPS decided not to proceed shortly after receiving this report.

Note:   This report is reproduced exactly as it was when served excepting that company and personal names have been removed.

Personal

1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. Mr Dilloway is a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. Mr Dilloway has worked with computers for 29 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). Mr Dilloway has worked with personal computers almost exclusively for more than fifteen years.

Instructions

2. My instructions are contained in a letter from Solicitor X dated 24 October 2000 that was copied to me on 30 October 2000:
"We would like you to prepare a report dealing with the following matters:
The way in which the Internet operates; how the Internet caches work; how easy it would be to access images contained in the temporary cache and the degrees of knowledge and expertise required by a computer operator to understand how the temporary Internet files/cache works in practical terms."

3. Further instructions were discussed in a telephone conversation on 16 January 2001 with Solicitor X and I understand these further instructions to be:
"Report upon the values present in the settings and options of the web browser program on Mr Z’s computer. Report upon the dates recorded against each of the files in the internet cache of Mr Z’s computer. Describe any conclusions about web browser usage that can be reached from the settings, option and date information."

The Internet

4. The Internet is very many computers connected by telephone lines and by specialised equipment. On 19 December 2000, a company that provides software for searching the Internet (Google.com) was claiming that it had identified more than one billion pages of information on the Internet. I have calculated this to be equivalent to a stack of photocopier paper more than sixty miles high.

5. The computers on the Internet may be:

Servers. A server is a computer that provides one or more services to users of the Internet. A service might be storing e-mail messages (these are messages sent by a person at one computer to a person at another computer) or storing information that people can view.

Clients. A client is a computer that a person would use to access the services provided by servers.

6. A single computer may be both a server and a client but this is rare.

7. Most server computers and some client computers are always connected to the Internet. Many client computers connect to the Internet only when someone needs to access an Internet service. Most home computers in the UK only connect to the Internet when necessary.

8. The telephone lines and specialised equipment that connect computers on the Internet varies. Some Internet lines are the equivalent of the telephone trunk lines that connect cities and that carry very many simultaneous voice telephone calls. These Internet lines are able to carry large quantities of information at high speed. The Internet line to a home computer is usually the same telephone line that we use to make a single voice telephone call. The capacity of these home lines is low. Home telephone lines slow down the speed that information can be transferred from the Internet to the home computer.

The World Wide Web

9. One of the services available via the Internet is the World Wide Web.

10. The World Wide Web is very many server computers that store information containing a precise (more or less) set of rules about the way that the information should be displayed on a computer screen. Client computers are able to run programs that understand these rules and are able to display the stored information.

11. The term "World Wide Web" is frequently abbreviated to Web and will be for the rest of this report.

12. The usual way to gain access to a server on the Internet is by name. The names that are used to access Web servers usually begin www and the name is usually referred to as the name of a web site. A name that begins www identifies a web site that may be many computers working together to provide information about, for example, a large corporation. A www name may also point to a particular place on a single server computer that stores many small web sites with each small web site having its own www name.

13. Perhaps the most well known web site in the UK is www.bbc.co.uk. This is the name of the web site for the BBC and contains information about BBC programmes and much else.

Client Access to Web Sites

14. A client computer accesses information stored on a web site using a software program that understands the rules that specify how the information should be displayed. This type of program is called a web browser and two popular examples are Netscape Navigator and Microsoft Internet Explorer.

15. Information on a computer is stored in files. The files that people create when they use a computer typically contain information plus instructions that a program can use. A file created with a word processor program would contain the words of the document plus instructions to tell the word processor, for example, how large the text characters should appear on screen or on paper. A file created with a spreadsheet program would contain numbers plus instructions to tell the spreadsheet program which mathematical functions should be used to obtain the desired result, for example, to add or multiply the numbers.

16. A web browser program reads a file from a web site on the Internet and uses the instructions in the file to display on the computer screen the information in the file. The display on the computer screen generated from a web site file is often called a web page.

17. The are several sets of rules used to create the files stored on a web site with some sets of rules relating to the display of documents that contain text and other sets of rules relating to the display of pictures. The web browser understands the various sets of rules and switches between them automatically.

18. Some web site files contain instructions that direct the web browser to display the content of other files that are not necessarily on the same server. A typical web site file would contain text that is displayed as words on the computer screen plus instructions to display other files that contain pictures. A single web page would be displayed on screen by the browser and this web page would be a composite of the content of the several files.

19. Many web pages include areas on the screen, or words, or lines of text that point to other web pages. Another web page is displayed when one of these pointers is clicked with a mouse. The pointers are called links. The web browser also displays a Back button on the screen that allows the original page to be re-displayed.

Web Browser Cache

20. People sometimes browse paper magazines and newspapers by flicking quickly through the pages and pausing to read the most interesting items, then returning to the beginning, flicking through again and reading other items. People sometimes browse the Web in the same way by clicking on links to see new pages and then clicking the Back button to return back through the sequence of pages that have just been viewed.

21. Some web pages take longer than others to appear on the computer screen. Pages that take a long time to appear usually contain a lot of information. This information might be a large amount of text or, more commonly, one or more pictures.

22. The web browser is designed to minimise the delay when a web page is re-displayed soon after a previous display. The web browser saves a copy of the page and any pictures or other computer files used in the page. The copies are saved on the hard disk of the computer that is running the browser. The web browser is able to quickly check whether the information that it has saved has changed on the web server before displaying the copy information from the hard disk. Displaying information that has been saved on the hard disk avoids the need to repeat the transfer of information from the web server and the re-display from the copy is usually quicker that the original display. The term used to describe this save and re-display process is caching and the saved pages are stored in a cache.

23. Caching happens automatically whenever the browser is used to display pages from the Web. The information that is displayed is the same irrespective of whether the information is being displayed from a web server or from the cache on the hard disk. The person viewing the screen might notice that second and subsequent displays of the same page are quicker than the original display of that page.

24. Web browsers include an item in the "File" menu that allows pages to be saved to the hard disk of the computer. The "File" menu is the list of choices that appear when the word "File" in the horizontal list at the top of the web browser is clicked. Saving web pages from the "File" menu is distinct from the cache and does not alter the operation of the cache.

Controlling the Browser Cache

25. Web browser programs allow many options to be set by the person using the browser. A few of these options are straightforward. For example, it is possible to specify the web page that is displayed each time that the browser program is started. The majority of the browser options are not straightforward and would have little meaning for most people. For example, the browser security options refer to Fortezza, PCT, SSL and TLS and these terms are unknown to most people.

26. There are browser options to control the operation of the cache. Most of these options are available from the first dialog box that is displayed when the "Tools" menu item for Options is selected. Dialog box is the term used to describe the panels that pop up on the screen to display information or to obtain information from the person using the computer. Almost all dialog boxes have an OK button and usually a Cancel button.

27. The following description of options is based on an examination of Internet Explorer version 5. The options that are available in Internet Explorer version 4 differ slightly but the following description is still valid. The operation of other web browser programs is likely to be similar.

28. The Internet Explorer Options dialog box, invoked from the "Tools" menu, includes a section referring to "Temporary Internet files" when the box first pops up. This section is subtitled "Pages you view on the Internet are stored in a special folder for quick viewing later." The dialog box has buttons labelled "Delete Files" and "Settings".

29. Clicking the "Delete Files" button in the Internet Explorer options dialog deletes all of the web pages stored in the cache on the local hard disk.

30. The "Settings" button in the Internet Explorer options dialog permits values to be specified that control how often and when the browser checks to see if the web server version of a page has been updated. It is also possible to specify the amount of disk space that should be used to store files.

31. The "Settings" button in the Internet Explorer "options" dialog also allows the web pages in the cache to be viewed. Another dialog box is displayed when the "Settings" button is clicked and this second dialog includes a "View Files" button. Clicking the "View Files" button displays a list of the web pages (and a list of any pictures that are displayed by these pages) and each page and picture may be displayed by clicking on its entry in the list.

32. The content of the cache can be viewed using Windows Explorer. The cache files are stored in the Temporary Internet Files folder. The location of this folder varies depending upon the operating system used on the computer (for example, Windows 98 or Windows 2000) and on the configuration of the operating system (for example, whether a user name and password are required to access the computer). Windows Explorer is a standard tool on Windows computers and is used for managing files on the hard disk of the computer.

Expertise Required to use Cache Options

33. The default options that are automatically set when a web browser is installed on a computer provide satisfactory operation of the browser in almost all cases. I browse the Web almost every day and I cannot recall that I have ever had to change browser options in order to get a satisfactory result. I have changed options on a few occasions to alter the appearance of pages when they are displayed. For example, it is possible to control whether links to other pages are underlined when the links are displayed on screen.

34. Many of the options in Internet Explorer are highly technical and are likely to be avoided by most people. It is likely that the options would only be used if the browser stopped working properly and this rarely happens

35. It is not likely that a person who uses a computer in a routine way would be aware of the existence of the cache nor of the options that control it nor of the options that allow its content to be displayed.

36. It is not likely that a person who uses a computer in a routine way would accidentally find the cache files using Windows Explorer. They would need to explore folders looking to see what could be found.

37. Routine use of a computer would be use with a popular word processor and spreadsheet, Internet access using a web browser and e-mail, playing popular games and using up to about four other popular programs.

Content of the Cache on Mr Z’s Computer

38. I supplied a hard drive to DC A at Police Headquarters on 19 January 2001. DC A recreated the content of the hard drive on Mr Z’s computer on the hard drive that I supplied. I collected the hard drive containing the copied content on 23 January 2001.

39. I visited the Police Station on 24 January 2001 and, in the presence of DC B, I removed the original hard drive from Mr Z’s computer and took the computer away for the preparation of this report. The original hard drive was left with DC B.

40. I installed the hard drive recreated by DC A into Mr Z’s computer and this was the computer that I inspected. This computer, including the content of the hard drive, was, for all practical purposes, a facsimile of the computer seized by the police on 24 May 1999 assuming that nothing had been done after the seizure to cause any change to the hard drive.

41. I started the computer from an operating system on a diskette. The operating system is the software that loads when the computer is first switched on.

42. Starting the computer from an operating system on a diskette allows the hard drive of the computer to be inspected without changing the content of the drive.

43. The web browser cache was found in the "Temporary Internet Files" folder within the "Windows" folder on the hard drive.

44. The browser cache folder contained twelve sub-folders that had been automatically created and named by the caching process. A list of the files in each of these twelve folders together with their "Last Modified" dates was created on a diskette. The "Last Modified" date is maintained automatically by the operating system and indicates the date on which the content of a file was most recently changed. The "Last Modified" date indicates the date that the file was created on the hard drive when the file has not been modified since its creation. It is reasonable to assume that the "Last Modified" date is the creation date for files in the cache.

45. The list of the files in each of these twelve folders together with their "Last Modified" dates was read into the Excel spreadsheet program on my own computer. The list shows that the total number of files from all of the twelve folders was 2,375.

46. Excel includes several functions that allow analysis of a list of values. A simple example would be to find the average value for a list of values. Excel is able to count the number of times that each of several values occurs in a list of values. This calculation is performed by using the "Frequency" function.

47. The "Frequency" function was used to count the number of times that the same "Last Modified" date occurred for each of the files in the cache. The range of dates that was used began at 30 December 1998 because this was the earliest date found for any of the files in the cache. The range ended with 31 May 1999 because this is after the date that the police seized the computer.

48. The cache is maintained automatically by the web browser. This automatic maintenance includes deleting files for reasons that include making space for new files. The table on the following page shows the number of files that were created on each date in the range where the files were still in the cache at the time of inspection. Additional files may have been created in the cache on any date and been automatically deleted prior to the inspection.

 

 

Date		Date		Date		Date		Date
30-Dec-98	8	4-Feb-99	36	12-Mar-99	0	17-Apr-99	0	23-May-99	44
31-Dec-98	940	5-Feb-99	0	13-Mar-99	52	18-Apr-99	10	24-May-99	0
1-Jan-99	0	6-Feb-99	0	14-Mar-99	9	19-Apr-99	0	25-May-99	0
2-Jan-99	0	7-Feb-99	0	15-Mar-99	24	20-Apr-99	1	26-May-99	0
3-Jan-99	0	8-Feb-99	0	16-Mar-99	0	21-Apr-99	0	27-May-99	0
4-Jan-99	0	9-Feb-99	0	17-Mar-99	0	22-Apr-99	33	28-May-99	0
5-Jan-99	0	10-Feb-99	60	18-Mar-99	9	23-Apr-99	0	29-May-99	0
6-Jan-99	0	11-Feb-99	0	19-Mar-99	0	24-Apr-99	0	30-May-99	0
7-Jan-99	35	12-Feb-99	46	20-Mar-99	0	25-Apr-99	0	31-May-99	0
8-Jan-99	0	13-Feb-99	0	21-Mar-99	0	26-Apr-99	0
9-Jan-99	232	14-Feb-99	213	22-Mar-99	0	27-Apr-99	11
10-Jan-99	0	15-Feb-99	0	23-Mar-99	0	28-Apr-99	13
11-Jan-99	0	16-Feb-99	0	24-Mar-99	0	29-Apr-99	1
12-Jan-99	0	17-Feb-99	67	25-Mar-99	9	30-Apr-99	0
13-Jan-99	0	18-Feb-99	0	26-Mar-99	10	1-May-99	0
14-Jan-99	0	19-Feb-99	0	27-Mar-99	0	2-May-99	0
15-Jan-99	1	20-Feb-99	0	28-Mar-99	0	3-May-99	0
16-Jan-99	0	21-Feb-99	1	29-Mar-99	0	4-May-99	0
17-Jan-99	0	22-Feb-99	0	30-Mar-99	0	5-May-99	0
18-Jan-99	0	23-Feb-99	37	31-Mar-99	2	6-May-99	0
19-Jan-99	0	24-Feb-99	10	1-Apr-99	25	7-May-99	0
20-Jan-99	0	25-Feb-99	1	2-Apr-99	0	8-May-99	32
21-Jan-99	0	26-Feb-99	0	3-Apr-99	0	9-May-99	0
22-Jan-99	0	27-Feb-99	1	4-Apr-99	0	10-May-99	0
23-Jan-99	102	28-Feb-99	27	5-Apr-99	0	11-May-99	0
24-Jan-99	0	1-Mar-99	0	6-Apr-99	0	12-May-99	0
25-Jan-99	0	2-Mar-99	0	7-Apr-99	0	13-May-99	0
26-Jan-99	0	3-Mar-99	0	8-Apr-99	0	14-May-99	0
27-Jan-99	1	4-Mar-99	13	9-Apr-99	0	15-May-99	15
28-Jan-99	0	5-Mar-99	0	10-Apr-99	0	16-May-99	0
29-Jan-99	0	6-Mar-99	11	11-Apr-99	0	17-May-99	0
30-Jan-99	122	7-Mar-99	1	12-Apr-99	14	18-May-99	0
31-Jan-99	1	8-Mar-99	0	13-Apr-99	0	19-May-99	0
1-Feb-99	0	9-Mar-99	0	14-Apr-99	0	20-May-99	10
2-Feb-99	0	10-Mar-99	0	15-Apr-99	0	21-May-99	2
3-Feb-99	0	11-Mar-99	0	16-Apr-99	0	22-May-99	82

 

49. The table on the preceding page shows that files created throughout the period from 30 December 1998 until the computer was seized are still in the cache. It is reasonable to assume that the web browser function that deletes cache files:
Was not used after 30 December 1998.
Or
Was used after 30 December 1998 but did not function correctly.

Web Browser Setting on Mr Z’s Computer

50. The computer was started from the operating system on the hard drive. This is the usual way of starting a home computer.

51. A web browser called Navigator was seen to be installed on the computer when the "Desktop" screen was displayed as the computer started. The "Desktop" screen is the screen that is displayed when no other software is running. The "Desktop" is usually a display of a picture and there are usually icons (that is, small pictures) on the left of the screen that may be clicked to start software applications.

52. The Navigator web browser stores its cache in a different location to the Internet Explorer web browser. The Navigator cache was found on the hard drive at "Program Files\Netscape\Navigator\Cache".

53. The Navigator cache contained files created on:
9 Jan 99 11 Jan 99 8 May 99 9 May 99 13 May 99 17 May 99

54. Files were created in the Internet Explorer cache on more dates than files were created in the Navigator cache. It is reasonable to assume that Internet Explorer was the browser most commonly used on this computer. The settings that are discussed in this report are the settings for Internet Explorer.

55. The Start Menu appears when the Start button, in the bottom left corner of the screen, is clicked. From the Start Menu it is possible to access the Internet Settings by selecting in sequence; "Settings" then "Control Panel" then "Internet".

56. The settings in the "Temporary Internet files" section of the Internet Properties dialog box were reviewed. Pressing the Settings button opens a Settings dialog box that contains values for the cache. These values were set to the default values. The default values are the values set automatically by the software when the browser software is installed on the computer.

57. The default values for the cache include a value for the maximum amount of hard drive space that should be used. This value was set to be equal to 3% of the hard disk size. An article on the Microsoft web site says, of the differences between Internet Explorer version 4 and previous versions, "The default amount of disk space used by the Temporary Internet Files folder (cache) is increased to 3 percent of your hard disk."

58. The Settings dialog box includes a "View Files" button. Pressing this button opens a window that contains a list of the files that are in the cache. The names of about 39 files were listed. The list also shows a "Last Accessed" date for each file. The Last Accessed date is the latest date that the file had been viewed using the web browser. All 39 files had the same Last Accessed date and this date was 23 May 1999. I understand this to be one day before the police seized the computer.

59. It is a contradiction that the Internet settings displayed via Control Panel show a list of 39 files when the list obtained by starting the computer from a diskette shows 2,375 files.

60. In my opinion, the contradiction between the list of 39 files and the list of 2,375 files is probably due to:
An error in the browser settings software that causes the list to be truncated.
Or
An error in the Delete Files software for the cache that causes the Delete Files to fail to delete the files from the cache folders but causes the browser settings software to list the content of the cache as if the delete had been successful.

61. In my opinion, it is more likely that the error is within the Delete Files software. It is likely that the Delete Files button was pressed on 22 or 23 May 1999. Pressing the Delete Files button would have seemed to delete the 82 files created in the cache on 22 May 1999 and all of the files created before that date. Pressing the button caused the Internet Settings software to "lose sight" of the files in the cache at the time that the button was pressed but failed to delete the files from the hard drive.

62. It is not possible to ascertain whether the View Files button was ever pressed to list the content of the cache. Pressing the View Files button would have shown that there were no files in the cache if the View Files button had been pressed immediately after the Delete Files button.

Summary

63. All of the pages Web displayed on a computer screen by a browser program are automatically stored in a cache on the hard drive of the computer and this allows them to be re-displayed more quickly for second and subsequent displays.

64. It is not likely that a person who uses a computer in a routine way would know that Web pages are stored in a cache on the hard drive of the computer.

65. It is more likely than not that a software problem has occurred on Mr Z’s computer that causes files to remain on the hard drive after they have been deleted by pressing the Delete Files button in the Internet Settings.

66. It is more likely than not that the Delete Files button has been pressed on Mr Z’s computer.

67. I believe that the facts I have stated in this report are true and that the opinions I have expressed are correct.

Graham Dilloway
Expert Witness

39 Conham Hill
Bristol
BS15 3AW