Informal Evidence Review

A gentleman who was facing an imminent trial for making and possessing indecent images of children contacted me and sent me documents that would be used as evidence.  I reviewed the documents and prepared an expert witness letter discussing the evidence.

Expert Witness Letter

29 January

Mr D

Dear Mr D

Evidence of Indecent Images

Nothing that I say in this letter should be regarded as any kind of advice or recommendation regarding legal proceedings.

We can imagine a prosecution where examination of a computer found two or three indecent images of children. It is my understanding that the Prosecution would have to show evidence of specific detail about how each image came to be on the computer so that we can be sure that a knowing and deliberate act caused each image to be made or possessed.

We can imagine a prosecution where examination of a computer found 10,000 indecent images of children. It may be that the Prosecution can argue that this volume of images must be the result of many knowing and deliberate acts. The Prosecution may argue that we can be sure that knowing and deliberate acts caused at least 9,000 of the images to be made or possessed even though we do not know which 9,000 images were deliberate.

It may be important that the context in which images were found is fully detailed. For example, a folder that contains five indecent images of children and no other files is different to a folder that contains five indecent images of children and 495 images of legal adult pornography. An argument that images of children were unintentional may be more credible when the child images are five among 500.

It is not for me to predict whether the lawyers, judge and jury will require specific evidence in any particular case. They would probably be influenced by factors that include, for example, anything that was said during police interviews.

Counts 1 to 13 in the Indictment are for making indecent images with Counts 1 to 10 each being for a single images. Counts 11, 12 and 13 are each for multiple images.

Several Counts are for images in the Firefox cache. It is likely that the Prosecution will argue that the images on the computer are evidence that the same images had been displayed on the computer screen while web browsing. I have seen no evidence to show the text typed or the words or pictures clicked with a mouse that caused images to be displayed on screen by web browser software. I have seen no evidence of a knowing and deliberate act that caused a specific image to be displayed by web browser software.

Several Counts are for images in folders named “New folder”. Some images are stored in folders called “New folder” with some “New folder” folders being inside other “New folder” folders. “New folder” is the name given to a folder by Windows when the person operating the computer creates a new folder and doesn’t type a name for that folder. One folder might contain multiple “New folder” folders with a number appended to the “New folder” name to distinguish between folders.

There is mention in the police interviews of file downloads using eMule file sharing software. Typically, file sharing software is used to download large files with each large file containing multiple smaller files with each smaller file containing a single picture. After downloading a large file, it is necessary to extract the picture files.

Files that are obtained with file sharing software can be misnamed and mislabelled. For example, files might be labelled as containing only legal adult pornography when one or more of the smaller picture files may be an illegal picture.

It is possible to extract the smaller picture files from a larger file obtained by file sharing software without seeing all of the pictures contained in the larger file.

A person that is hurriedly extracting picture files from a larger file obtained by file sharing software might not take the time to give names to all of the folders created during the extraction process resulting in multiple folders named “New folder”. I have seen multiple folders called “New folder” in other cases involving the downloading of pictures using file sharing software.

Mr E, the police computer examiner, says that the two hard drives found not in a computer (Exhibits EX/1 and EX/11) contained more than 67,800 pictures and that 81 of these were indecent images of children. I have not seen and do not know the proportion of legal adult pornography among the 67,800 images. I do not know the distribution of images between folders and cannot say if individual folders contained dozens or hundreds or thousands of pictures. I do not know if indecent images of children were found in folders that contained a very much larger proportion of legal material.

I do not know the context for individual images. As a generalisation, an assertion that 81 images were obtained unknowingly and unintentionally among a total of 67,800 would be credible.

One Count is for an image in the “My Documents Desktop stuff” folder. Any observations regarding this image would depend upon information that I do not have regarding the content of the “My Documents” folder and the “Desktop stuff” folder.

Counts 11, 12 and 13 are for a total of 69 images and I have no information about these images. I expect that many of the observations regarding the images in Counts 1 to 10 also apply to the images in Counts 11, 12 and 13.

Counts 14 to 23 are each for possession of an extreme image with a single image for each Count.

Several Counts are for images that are in the Media Player cache. These are still pictures created automatically by Media Player software to indicate the content of a movie file when that movie file was displayed as one of a list by Media Player. I have seen no evidence to show knowledge of the Media Player cache process or location. I have seen no evidence to show knowledge of or access to hidden folders such as the Movie Player cache.

Several possession Counts are for images in “New folder” folders. The earlier observations regarding “New folder” folders apply. I have seen no evidence to show knowledge of or access to illegal images in the “New folder” folders.

All of the possession Counts charge that the image was “in possession” on the Creation date reported by Mr E.

I can move (not copy) a file from one computer to another and the Creation date is also “moved”. For example, I have two computers. I can create a file on Monday on one computer. On Tuesday, I can move the file from one computer to a second computer. The file would then show on the second computer as having been created on Monday.

It can be argued that the Creation date for a file is not a reliable indicator of when a file was created on the computer where the file was found.

I have seen no evidence to show that we can be sure that the images in Counts 14 to 23 were “In possession” on the dates in the Indictment.

A problem with a hard drive (Exhibit EX/1) is discussed during the police interviews. It appears that a problem (or “corruption”) with EX/1 is the reason why the hard drive was no longer in use in a computer.

There is a reference in the interviews to the inaccessibility of files on the second hard drive (Exhibit EX/11).

Simply stated, Windows includes security features that deny access to files on a hard drive unless that hard drive is being used with the original Windows installation. I have been asked to inspect data from the hard drives taken from computers. Windows often denies me access to some of the files on these drives. I have to use specialised techniques to access the files.

I have seen no evidence to show that there was not a problem (or “corruption”) in the Windows installation on EX/1. I have seen no evidence to show that files on EX/11 were accessible after the problem with EX/1. I have seen no evidence to show the knowledge and expertise necessary to access files on EX/1 and EX/11 when the drives were connected to another computer. In short, it is credible that some files on EX/1 and EX/11 were inaccessible.

It is my understanding that possession of extreme images (including, for example, animals) became illegal in January 2009. I have no evidence to show that any of the images in Counts 14 to 23 predate January 2009.

The police interviews include a reference to knowing and deliberate access to an indecent image of a child as part of research.

The police interviews include a reference to knowing and deliberate access to one or more extreme images.

It may be that the Prosecution could answer concerns regarding evidence by changing the Indictment. Some of the issues raised would not apply if the Indictment referred only to images in named folders (perhaps including “New folder”) and if the dates of each making and each possession charge was for a range of dates. An example might be charging possession of the image in the current Count 23 as “possessed” between February 2009 and 10 April 2011 (the date that the drives were seized).

In summary:

• In other cases, I have challenged images in locations such as the web browser cache and the media browser cache and these images have been dropped from the Indictment.

• It may be credible to argue that the images in named folders (including “New folder”) were created during bulk downloads of legal adult material and that the illegal images went unnoticed due to the large quantity of other images. The credibility of this argument may depend on the specific content of individual folders.

• I have seen nothing from Mr E to show text in Google web search or eMule file sharing search that is evidence of searches for illegal material.

• It is not for me to speculate regarding remarks made in police interviews regarding knowledge of indecent child images for research and knowledge of animal images.

And finally, we can imagine a closing statement by defence Counsel regarding the number of images, “Mr E tells us that there were more than 67,800 pictures on these two hard drives. How long might be needed to have a look at one of these pictures?

“Let us say that at least three seconds is needed to look at each picture. That would mean twenty pictures could be looked at in one minute. Fifty minutes in each hour might be spent looking at pictures … after allowing for cups of tea and whatnot. That would take us to 1,000 pictures per hour.

“A typical office worker might spend about 35 hours per week at their desk. So, after spending the equivalent of an entire working week looking at pictures … minute after minute … hour after hour … day after day … barely more than half of the pictures on these two drives would have been looked at in a week.

“Mr E tells us that there were 138 pictures involving children or animals. … “

Having re-read this hypothetical speech, I can see that it might not be a good idea to suggest that anyone actually looked at every single picture!

Mr E also tells us that there were 2,150 movies. I do not know the durations of these movies. A speculative estimated duration of five minutes each gives total duration of about 180 hours.

I might be instructed to write a formal report in this case after some discussions with lawyers. Depending upon my instructions, I might examine the drives to establish the volume of material in individual folders. My report might say, in summary:

• I have no evidence to show knowing and deliberate “making” of illegal child images on a computer screen (or on a hard drive) while web browsing.

• I have seen no evidence to show knowing and deliberate “possession” of still images automatically created by Media Player software.

• The locations of pictures, and the quantities of pictures in those locations, are consistent with pictures being downloaded in bulk using file sharing software.

• I have seen no evidence to show that any specific illegal picture was displayed on a computer screen.

I cannot be sure about some aspects of the evidence in this case for reasons that include not having seen any information regarding the images in Counts 11, 12 and 13.

Please let me know how you might wish to proceed.

Yours sincerely

Graham Dilloway
Computer Expert Witness