Lacking Evidence of Intent
My expert witness report highlights the lack of evidence of intent to acquire or save indecent images ofchildren.
Indecent images of children and extreme pornography were found on a computer. Most of the material was deleted files or in the web browser cache. The Prosecution did not produce evidence of the actions by the Defendant that caused the material to be on the computer.
Expert Witness Report
The Author
3. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years.
Instructions
4. I have discussed my instructions with S Solicitors and I understand these instructions to be that I should discuss the making or possession of illegal pictures on the computer.
5. I received a letter dated 28 October 2010 from S Solicitors and the bundle, enclosed with that letter, included a statement dated 24 February 2010 from Mr T and a report from Mr T, Exhibit EWT/1.
Pictures
6. Pages 39 – 42 of Exhibit EWT/1 lists about 24 pictures. Pages 47 – 48 lists about 11 pictures.
7. All of the pictures listed on pages 39 – 42 and 47 – 48 of Exhibit EWT/1 are in the web browser cache folder or in a file viewer thumbnails folder.
8. I can use web browser software to view web pages on my computer. Every web page that the browser software visits is automatically saved in the web browser cache folder.
9. The content of the web browser cache folder is managed automatically by the web browser software. Files are automatically added to the web browser cache folder when the software visits a web page and files are automatically deleted from the web browser cache folder to make space for new files.
10. I might browse web sites and web pages because I was looking for a hotel in Brighton. I might search using Google and click with the mouse on the results listed by Google. I might click on some text in a web page that said, “click here to see information about Brighton hotels”. I expect that some of the web pages that I would see would be web pages that were not about Brighton hotels because web searches and web page links are often inaccurate.
11. Some of the web pages that I visit are too big to fit on the screen of my computer. A scroll bar appears on the right side of the computer screen when a web page is too big to be fully displayed. I do not know of any way to show whether an over-sized web page has been scrolled so that all of its content has been viewed.
12. The cache on my computer may contain pictures that I have not seen because they were contained in web pages that were too big to be fully displayed on my computer screen.
13. I can display lists of files on the screen of my computer using file viewer software. I can display a list of all of the files in a folder. I can display a list of files to show information about the files including, for example, the date that a file was changed. Alternatively, I can display a list of files as thumbnail pictures.
14. A thumbnail picture is a small version of a picture. I can display a list of the files in a folder on my computer as thumbnail pictures. Typically, I might see about twenty thumbnail pictures on the computer screen when displaying the content of a folder.
15. A folder might contain many hundreds of files. A display of thumbnail pictures for a folder containing many hundreds of files would be too big to fit on the screen of a computer. A scroll bar appears on the right side of the computer screen when a display of thumbnails is too big to be fully displayed. I do not know of any way to show whether an over-sized display of thumbnails has been scrolled so that all of its content has been viewed.
16. The software that is used to display list of files automatically creates thumbnail pictures and stores them on the computer hard drive. The thumbnails are automatically stored to save the time required to re-create them should they need to be displayed at a later date.
17. About 19 of the pictures listed on pages 39 – 42 of Exhibit EWT/1 are thumbnail pictures that were created automatically by file viewer software. The thumbnail pictures are stored in a folder that includes the text “.thumbnails” in the folder name. The leading full stop indicates that the folder is “hidden” and would not be shown by typical use of file viewer software.
18. A Thumbnail picture that has been automatically created by file viewer software may still be on the computer after the original, large version of the picture has been deleted.
19. The “Full Path” for five of the files listed on Pages 39 – 42 of Exhibit EWT/1 includes the text, “.mozilla”. The leading full stop indicates that the folder is “hidden” and would not be shown by typical use of file viewer software.
Deleted Pictures
20. Pages 44 – 46 of Exhibit EWT/1 lists about 34 pictures that are described as being in unallocated clusters.
21. The content of a file is not physically deleted when a file on a computer is “deleted”. When a file is deleted, the space occupied by the content of the file is marked as being available for re-use. The content of the file can be recovered using specialised software until the space occupied by the content is re-used.
22. The files listed on Pages 44 – 46 of Exhibit EWT/1 have been deleted and the space occupied by the files has not yet been re-used.
23. I do not know of any way to show, from the information in Exhibit EWT/1, how or when the files listed on Pages 44 – 46 were created nor where they were stored nor when they were deleted.
24. I do not know of any way to show, from the information in Exhibit EWT/1, whether the files listed on Pages 44 – 46 were viewed on the screen of the computer.
Music Shared Folder
25. The file names and folder location of the files listed on Page 43 of Exhibit EWT/1 are consistent with the files having been obtained using file sharing software.
26. I can run file sharing software on my computer. I can use file sharing software to search for music by the band Queen by typing “Queen” into the software. The file sharing software will connect to many other computers on the Internet that are also running file sharing software. The number of computers that are connected may be hundreds or thousands.
27. The file sharing software will display a list of results for the search for “Queen” on the screen of my computer. The list will show files found on many other computers running file sharing software. The list is likely to be longer than will fit on the computer screen. It is likely that the scroll bars at the right of the screen will need to be moved to view the entire list.
28. It is likely that any list displayed by file sharing software in response to a search will include unintended items. For example, the result of a search intended to obtain Queen music is likely to include movies of the Queen.
29. I can select one or several or all of the items in the list of search results and download the files to my computer. I can download all of the items on the list if I click on the first item in the list of search results, click to move the scroll bar on the right side of the screen to the end of the list and click on the last item in the list. I can download all of the files in a list without seeing the name of every file in the list.
Extreme Pornography
30. The pictures listed on Pages 47 – 48 of Exhibit EWT/1 are described as “Extreme Pornography Images”. The pictures are all located in a web browser software cache folder.
31. I do not know of any way of avoiding the accidental display of extreme pornography when browsing pornography websites. The accidental display of extreme pornography can cause pictures of extreme pornography to be created in a web browser cache folder.
32. The “Full Path” for each of the files listed on Pages 47 – 48 of Exhibit EWT/1 includes the text, “.mozilla”. The leading full stop indicates that the folder is “hidden” and would not be shown by typical use of file viewer software.
Endnote
33. I understand my duty to the Court and I confirm that I have complied with and will continue to comply with that duty.
34. I confirm that insofar as the facts stated in my report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.
Graham Dilloway
Computer Expert Witness
39 Conham Hill
Bristol BS15 3AW