Fabrication of Car Registration Documents

November 2011

Mr S

S Solicitors

Dear Mr S

Computer Examination

Thank you for your letter dated October 2011 and the bundle of documents and the two computer disks enclosed with that letter.

The expert witness report regarding the computer R/1 was prepared by Mr J of XYZ Police.  Mr J list 78 files in his report and includes copies of those files on his Exhibit CD disk.

The files listed by Mr J include documents regarding mortgage applications, motor vehicle insurance, property purchases and leases, web pages from ebay regarding vehicle sales and DVLA letters and vehicle registration documents.

I have selected some of the files found on computer R/1 and these are listed in the enclosed file, “Selected files from R1.doc”.  Mr J describes each of the documents that he lists and his descriptions for the selected files are:

1. Comment Corel Draw document, Mercedes blank manufacturers VIN plate
2. Comment Corel Draw Document, letter, DLVA to Mr K re W999 WXX reverting to LF9999 XXX, 4 Mar 2008
3. Comment Corel Draw Document, ID, Mr K, Maintenance, Aberdeen
4. Comment Corel Draw document, Overlay details, V5 front, LF9999 XXX
5. Comment Corel Draw document, Overlay details, V5 inside, LF9999 XXX
6. Comment Corel Draw document, Merc Vin Plates
7. Comment Corel Draw document, Tax disk, details removed, 24/05/08
8. Comment Corel Draw Document, letter, DLVA to Mr K re W999 WXX reverting to LF9999 XXX, 4 Mar 2008
9. Comment Corel Draw Document, letter, DLVA to Mr M re S969 MVY, 15 Dec 2008
10. Comment Image, Tax disc, BJ99 XXX Merc, 16/06/08
11. Comment Image, Tax Disc, Mazda, BV99 XXX, 24/05/08
12. Comment Image, Blank V5 front
13. Comment Image, Blank V5 inside
14. Comment Image, Blank V5 rear
15. Comment Corel Draw Document, Overlay V5 details, LF9999 XXX
16. Comment Corel Draw document, Car Tax disk, Partially blank, Mercedes, 16/06/08
17. Comment Corel Draw document, Overlay details, V5 Front, Mr K, LF9999 XXX
18. Comment Corel Draw document, Overlay details, V5 inside, Mr A, LF9999 XXX
19. Comment Corel Draw document, Overlay details, V5 rear, LF9999 XXX
20. Comment Corel Draw document, Car tax, altered to read LF9999 XXX
21. Comment Image, Car Tax, blanked, 24/05/08

Items 7, 10, 11, 16, 20 and 21 are described by Mr J as a “tax disc”.  These “tax disc” files are:

7.   Serial – 05 7599935 9, Vehicle – blank

10. Serial – 06 7299952 6, Vehicle – BJ99 XXX

11. Serial – 05 7599935 9, Vehicle – BV99 XXX

16. Serial – 06 7299952 6, Vehicle – partially blank

20. Serial – 05 7599935 9, Vehicle – LF9999 XXX

21. Serial – 05 7599935 9, Vehicle - blank

Items 7 and 21 are different files that appear to be the same when viewed.

The report regarding the memory sticks was prepared by staff at X.  Mr H lists about 1,330 files plus the files for a website for a business called “B”.

One of the memory sticks (the Staples stick, K/10) contains two files that are pictures of a tax disc.  One file is the back of a tax disk.  The other file is a picture of the front of a tax disk with the values:

Serial – 05 7599935 9, Vehicle - blank

The tax disc files on the memory stick have file created and modified dates:

		Created	Modified
Graphics\279.jpg	Tax disc front, Serial – 05 7599935 9, Vehicle - blank	2/10/2008 14.48	28/9/2008 15.04
Graphics\280.jpg	Tax disc back	2/10/2008 14.48	28/9/2008 15.04

The files from the computer that are tax disc files with the same serial number have file created and modified dates:

	Created	Modified
7.   Serial – 05 7599935 9 Vehicle – blank	29/11/2008 22.12	29/11/2008 21.20
11. Serial – 05 7599935 9 Vehicle – BV99 XXX	10/11/2008 02.30	10/11/2008 02.30
20. Serial – 05 7599935 9 Vehicle – LF9999 XXX	29/11/2008 21.20	29/11/2008 22.12
21. Serial – 05 7599935 9 Vehicle - blank	29/11/2008 11.14	29/11/2008 11.14

The dates for all of the tax disc files (serial – 05 7599935 9) from the computer are later than the dates for the equivalent files from the memory stick.  These dates support the argument that the tax disc files were originally copied from the memory stick to the computer.

None of the tax disc files on the computer are identical copies of the files from the memory stick.  The “blank” tax disc files on the computer are in a different file formats to the equivalent files on the memory stick.  The disparity in file formats between tax disc files on the computer and on the memory stick supports the argument that the files were not copied from the memory stick.

A picture file can be stored in one of several formats.  Typically, the format of a picture file depends upon the software used to create the picture file.  Two picture files, in two file formats, can appear to be identical when displayed on the computer screen.

Two of the tax disc files (with serial – 05 7599935 9) from the computer include details of vehicles BV99 XXX and LF9999 XXX.  The tax disc files on the memory stick do not include details of any vehicle.

The difference in file formats between the tax disc files on the memory stick and on the computer and the vehicle details on the tax discs from the computer support the argument that the tax disc files have been edited on the computer.

The creation and modified dates of a computer file may not be the date that the file was created or most recently knowingly modified.  For example, some of the tax disc files listed above have modified times that are earlier than the creation times.  It cannot be that a file was modified before it was created.  The created and modified dates might be altered by tasks that include copying or moving a file. 

The list of selected files from the computer includes files that are described by Mr J as “V5” documents.  I looked for, and did not find, identical files among the files recovered from the memory stick.  The memory stick contains files that appear to have been created by Powerpoint software and appear to contain text that could be printed onto a blank V5. 

The registration marks from the Powerpoint V5 documents on the memory stick appear to be:

AV99 XXX

RO99 XXX

HY99 XXX

YD99 XXX

The registration marks used on the Powerpoint V5 documents on the memory stick do not appear to support the argument the V5 files on the computer were copied from the memory sticks.

Some of the V5 documents on the computer are described by Mr J as being in Corel Draw format.  I did not find any V5 documents on the memory stick that are in Corel Draw format.

The difference in file formats between the V5 files on the memory stick and on the computer and vehicle details on the V5 documents from the computer support the argument that the V5 files have been edited on the computer.

One of the files in the enclosed “Selected Files” list has a “Full Path” that includes “ControlCenter3\Scan\CCI09112008_00000.bmp”.  These folder and file names are consistent with this document having been created using a Brother scanner and the software supplied with that scanner.  The “Selected Files” list includes other files that are in the same folder and that have similar names. 

Files with names beginning “CC …” in the “ControlCenter3\Scan” folder, and listed in the enclosed “Selected Files” list, are consistent with documents having been scanned onto the computer and then edited.

In summary;

• I did not find tax disc or V5 files on the memory stick and on the computer that are identical in appearance and in file format.

• The tax disc files using serial 05 7599935 9 have earlier dates than the tax disc files on the computer using the same serial.  This may support the argument that the tax disc file with serial 05 7599935 9 originated from the memory stick.

• The file names, folder locations, file formats and content of files on the computer supports the argument that files have been edited on the computer.

• Files on the computer with modified dates that are earlier than the file creation dates support the argument that files have copied or moved after having been edited.  I have seen nothing to show where these files were copied or moved from.  The files may have been copied or moved from another folder on the computer or from a memory stick (after being edited on another computer and then copied from that computer to the memory stick).

The Prosecution might say that the computer contains many tax disc and V5 files that do not have exact copies on the memory sticks (or anywhere else) and this supports the argument that the tax disc and V5 files were created or edited on the computer.

The Defence might say that there are tax disc and V5 files on the computer and on the memory sticks and the dates for these files show that files have been moved or copied and this supports the argument that we cannot be sure that the files were edited on the computer.

I appreciate that this is all complicated and inconclusive.  Please call and I will attempt to clarify any uncertainties.

I look forward to hearing from you.

Yours sincerely

Graham Dilloway

Computer Expert Witness