Intent to Obtain Indecent images.
My expert witness examination found no evidence of deliberate searching or saving of indecent images. The Defendant received a conditional discharge.
The Defendant was serving in the military and I received evidence from investigations by military and civilian police. In conference with the prosecution expert witness, we agreed that there was no evidence that indecent images were deliberately sought and there was evidence that all illegal images was deleted promptly. It is my understanding that the Defendant fell foul of the Harrison judgement and had to plead guilty and was then given a conditional discharge. My computer expert witness report follows.
Note: This expert witness report is reproduced exactly as it was when served excepting that company and personal names have been removed.
Personal
- This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts and of the Society of Expert Witnesses. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years.
- My
instructions have been discussed in conferences with S Solicitors
and I understand my instructions to be that I should prepare an
expert
report discussing the evidence of illegal material and the evidence
of intent to obtain illegal material.
- I received a bundle of documents from S Solicitors with a covering letter dated 8 January 2009. This bundle included:
- Forensic Examination Report prepared by Sgt. G and dated 18 May 2007.
- Transcript of an interview on 24 October 2007.
- Transcript of an interview on 8 December 2006.
- In his report dated 18
May 2007, Sgt. G describes the results of his examination of various
Exhibits.
- At Para. 1.6 of his
report dated 18 May 2007, Sgt. G describes the content of the folder
C:\Documents and Settings\J\Shared on Exhibit KG/01 (a laptop
computer seized in Bahrain). Sgt. G says that the folder contains
four movie files that are episodes of South Park and one illegal
movie file. Sgt. G says, of the illegal movie file, "… was deleted
on 27 Nov 06…"
- At Para. 1.6 of his
report dated 18 May 2007, Sgt. G describes the content of the folder
C:\Documents and Settings\J\Shared on Exhibit KG/01 (a laptop
computer seized in Bahrain). Sgt. G says that the folder contains a
thumbs.db file and describes the file, "… is usually hidden from the
user as it is only in use by the operating system." I have seen no
evidence to show that the content of this thumbs.db file refers to
files that existed on the computer when the computer was seized.
- I do not know of any
way that someone using a computer can access the content of a
thumbs.db file, when the content refers to files that have been
deleted, without the use of specialised software that is not usually
found on a computer. I have seen no evidence to show that
specialised software that could access the content of a thumbs.db
file was found on computer KG/01.
- At Para. 1.8 of his
report dated 18 May 2007, Sgt. G describes the content of the folder
C:\Documents and Settings\J\Incomplete on Exhibit KG/01 (a laptop
computer seized in Bahrain). Sgt. G says that the folder contains "…
3 files that are deemed to be innocuous, a thumbs.db folder and 22
files that has suspicious titles and had been deleted." Para 1.9
clarifies that Sgt. G is referring to a thumbs.db file (not a
"folder").
- At Para. 1.10 of his
report dated 18 May 2007, Sgt. G describes the content of the Recent
folder on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt.
G says that the folder contains "… small files that merely contain
the location of other files". The files in the Recent folder do not
contain illegal material but may point to the location of a file of
illegal material and that file of illegal material may still exist
or may have been deleted.
- At Para. 1.11 of his
report dated 18 May 2007, Sgt. G describes Lost files on Exhibit
KG/01 (a laptop computer seized in Bahrain). Sgt. G says, of Lost
files, "Files that have been deleted but not over-written may
become lost …"
- At Para. 2.4 of his
report dated 18 May 2007, Sgt. G describes the content of the
Administrator Recent folder on Exhibit JPC/81/7/12/10 (a hard drive
seized in Yorkshire). Sgt. G says, "The recent folder for the
Administrator Account was found to have been deleted on 12 Aug 06."
Sgt. G says that the folder contains "… deleted .lnk files"
.lnk are the files that Sgt. G describes as "small files that merely
contain the location of other files"
- At Para. 2.5 of his
report dated 18 May 2007, Sgt. G describes the content of the
Recovered Deleted Incomplete Folder on Exhibit JPC/81/7/12/10 (a
hard drive seized in Yorkshire). Sgt. G says, of this folder, "… had
been deleted …" and, of the files in the folder, "... the following
deleted files".
- At Para. 2.6 of his
report dated 18 May 2007, Sgt. G describes the Examination of
Recycle Bin on Exhibit JPC/81/7/12/10 (a hard drive seized in
Yorkshire). Files that I delete on my computer are automatically
sent to the Recycle Bin. I can recover files from the Recycle Bin if
I later discover that I deleted them by mistake.
- At Para. 3.1 of his
report dated 18 May 2007, Sgt. G describes the content of the
C:\DUMP\thumbs.db file on Exhibit JPC/81/7/12/21 (an external hard
drive seized in Yorkshire). I have seen no evidence to show that the
content of this thumbs.db file refers to files that existed on the
drive when the drive was seized.
- At Para. 3.2 of his report date 18 May 2007, Sgt. G describes the content of the Recycle Bin on Exhibit JPC/81/7/12/21 (an external hard drive seized in Yorkshire). Files that I delete on my computer are automatically sent to the Recycle Bin. I can recover files from the Recycle Bin if I later discover that I deleted them by mistake.
- In the transcript of
the interview on 24 October 2007, Mr D says, at the middle of Page
4, "… I didn’t want to see them so I just deleted them …"
- In the transcript of
the interview on 8 December 2006, Mr D says, at the top of Page 78,
"… once ascertained what the nature of the file was, the file would
be closed and then deleted …".
- I have seen no evidence to show that files containing illegal material were not deleted.
- At Para. 1.6 of his
report date 18 May 2007, Sgt. G says, of the file of illegal
material in folder C:\Documents and Settings\J\Shared on Exhibit
RG/01 (a computer seized in Bahrain), "… file was created on Exhibit
KG/01 on 25 Nov 06 at 15.56 hours and was deleted on 27 Nov 06 at
16.59 hours."
- At Para. 3.2 of his report date 18 May 2007, Sgt. G says, of the Recycle Bin on Exhibit JPC/81/7/12/21 (an external hard drive seized in Yorkshire), "The Recycle Bin was found to contain 145 picture files that were created between 28 Feb 06 at 1815 hours and 2300 hours. The files were last accessed on 01 Mar 06 at 0024 hours …." Sgt. G appears to be saying that the files were deleted no more than a few hours after they were created.
- I have seen no evidence to show that Mr D searched for illegal material on the Internet.
- I have seen no evidence
to show that specialised software that could access the content of
thumbs.db files was found on the Exhibits.
- I have seen no evidence
to show that the content of the thumbs.db files referred to in Sgt.
G’s report refer to files that existed on the Exhibits when the
Exhibits were seized.
- I have seen no evidence
to show that files containing illegal material were not deleted.
- I have seen no evidence
to show that Mr D searched for illegal material on the Internet.
- I understand my duty to
the Court and I confirm that I have complied with and will continue
to comply with that duty.
- I confirm that insofar as the facts stated in my expert witness report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.
Instructions
Report of Sgt. G
Interviews
Timescales
Intent
Summary
Graham Dilloway
|
30 January 2009 |
39 Conham Hill Bristol BS15 3AW |