Indictment Not Matching the Evidence

The examination of two computers found indecent images of children in locations that included the web browser cache and as deleted files.  The Indictment in the case did not appear to take account of the evidence and charged as if all images had been acquired and saved deliberately.  I prepared letters and reports in response to the various attempts to produce an Indictment that matched the evidence.

Letter Discussing the Evidence

5 March

Miss S
S Solicitors

Dear Miss S

Expert Witness Examination

Thank you for your emails of 1 March and the attached scans of documents.

The files listed in PC C's Initial Report are in one of several categories …

In a “user” folder. I can download pictures from the Internet and save those pictures on my computer. When a computer is first acquired and setup, the Windows software asks for a user name that will be used to log on to the computer. Windows automatically creates a folder with this name. Typically, I might save the pictures that I download from the Internet into the folder that was automatically created by Windows and has the folder name entered when Windows was set up. It appears that Exhibit E/1 was set up with a user name and an automatically created folder with the name “User”..

The presence of files in the “user” folder suggests that the files were deliberately downloaded and saved in that folder. It is possible that illegal pictures are in the “user” folder by accident. For example, I might download a single large file expecting that file to contain pictures of railway trains. I might open and save the many pictures in the single large file and not look at the pictures as I was saving them. I might later find that some of the pictures that I have saved are pictures of motor cars.

Reference to file access. Windows stores data about access to files. I can click the Start button (aka Windows button) at the bottom left of my computer screen. The Start menu includes an item “Recent” and when I click Recent a list of files that I have recently accessed is displayed.

Recycle bin. I can delete a file on my computer and the deleted file is sent to the Recycle bin. I can recover the deleted file from the recycle bin.

Unallocated clusters. This refers to a file that has been fully deleted and can only be recovered using specialised software.

Thumbnail. I can use Windows Explorer to list the files stored in a folder on my computer. I can display the list of files in various layouts. One way that I can display the list of files is as thumbnail pictures. A thumbnail picture is a small version of a larger picture stored on the computer. I might see a dozen or more small versions of pictures stored in a folder when I display the content of the folder as thumbnails. Many software programs can display pictures as thumbnails. Many software programs create and store thumbnail versions of pictures on my computer. These thumbnail pictures are created automatically and most people are not aware that they are stored on the computer.

Temporary Internet Files. When I browse websites on the Internet, everything that is displayed on the screen is automatically stored on my computer in space called “Temporary Internet Files”. Typically, the date that a picture is created in Temporary Internet Files is the date that the web page containing the picture was viewed. These temporary Internet pictures are created automatically and most people are not aware that they are stored on the computer.

Backup File. Typically, a backup is a single large file that contains copies of very many files from a computer. Periodically, Windows software automatically creates backup files. These backup files are created automatically and most people are not aware that they are stored on the computer

Files 1 and 2 are a related pair. File 1 is a picture in a “user” folder. File 2 is not a picture. File 2 is a backup file that contains a reference to a “History Record”. The history record may be evidence that the picture in File 1 was viewed on the computer screen on 2 January .

Files 1 – 24 are pairs of related files with the first file in each pair being a picture and the second file in each pair being a text reference to the picture. All of the picture files are in a “user” folder except File 13. File 13 is in the Recycle bin.

Files 25 and 26 are pictures in “user” folders.

Files 27 and 28 are thumbnail pictures.

Files 29 – 56 are deleted files (in “unallocated clusters”).

Files 57 – 63 are pictures in “user” folders.

Files 64 – 66 are deleted files (in “unallocated clusters”).

Files 67 – 76 are pairs of related files with the first file in each pair being a picture and the second file in each pair being a text reference to the picture. All of the picture files are in a “user” folder.

Files 77 – 114 are deleted files (in “unallocated clusters”).

Files 115 – 120 are pictures in “user” folders.

File 121 is a thumbnail picture.

Files 122 – 128 are Temporary Internet Files.

Files 129 – 135 are deleted files (in “unallocated clusters”).

File 136 is a Temporary Internet File.

Files 137 – 144 are deleted files (in “unallocated clusters”).

Files 145 – 146 are Temporary Internet Files.

Files 147 – 155 are deleted files (in “unallocated clusters”).

File 156 is a movie in “user” folders.

Files 157 – 158 are Temporary Internet Files.

The number of picture and movie files in each category …

• 33 in “user” folder.

• 3 are thumbnail pictures.

• 93 are deleted files.

• 12 are in Temporary Internet files.

• 17 are references to file access and are stored in backup files.

The Counts in the Indictment appear to refer to files in the Initial Report.

Count 1 refers to File 1. This appears to have been saved to the computer on 10 November  and viewed on screen on 2 January .

Count 2 refers to File 21. This appears to have been saved to the computer on 15 November  and viewed on screen on 2 January .

Count 3 refers to File 25. This appears to have been saved to the computer on 3 December . I have seen nothing to show that it was viewed after it was saved.

Count 4 refers to File 118. This appears to have been saved to the computer on 3 January . I have seen nothing to show that it was viewed after it was saved.

Count 5 refers to File 76. This is not a picture or movie file.

Count 6 refers to File 121. This file is a thumbnail that was created automatically by software. Mr D did not knowingly make this file on the computer. It might be argued that the existence of the thumbnail is evidence that a larger version of the picture was made on screen. I have seen no evidence to show that a larger version of this thumbnail was made on screen knowing that it was an indecent picture of a child.

Count 7 refers to File 130. This is a deleted file. I have seen no evidence to show that Mr D performed some deliberate act that caused this picture to be displayed on screen or be saved on the computer.

Count 8 refers to File 139. This is a deleted file. I have seen no evidence to show that Mr D performed some deliberate act that caused this picture to be displayed on screen or be saved on the computer.

Count 9 refers to File 145. This file is in Temporary Internet files. This file was created automatically by web browser software. Mr D did not knowingly make this file on the computer. It might be argued that the existence of the file is evidence that the picture was made on screen. I have seen no evidence to show that the picture was made on screen knowing that it was an indecent picture of a child

Count 10 refers to File 156. This is a movie file and appears to have been saved to the computer on 8 November . I have seen nothing to show that it was viewed at the time that it was saved or after it was saved.

Count 11 refers to File 158. This movie file is in Temporary Internet files. This file was created automatically by web browser software. Mr D did not knowingly make this file on the computer. It might be argued that the existence of the file is evidence that the movie was made on screen. I have seen no evidence to show that the movie was made on screen knowing that it was an indecent movie of a child.

Counts 12 and 13 are roll-up charges of possession of more than 100 pictures. The majority of these pictures are deleted pictures. I have seen nothing to show where they were deleted from. It may be, for example, that these pictures were in Temporary Internet Files before they were deleted. I have seen nothing to show that Mr D knew that pictures were saved in Temporary Internet Files. It may be that Mr D cannot be guilty of possession of all of the pictures in Counts 12 and 13 because he did not know that all of the pictures were on the computer.

In summary, it appears that 33 files have been saved in “user” folders. The rest are variously deleted, automatically created by software or not pictures or movies.

There are several possible next steps. I would welcome the chance to discuss these next steps and look forward to hearing from you.

Yours sincerely

Graham Dilloway
Expert Witness

Formal Expert Witness Report

Author

1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years.  I have worked as an expert witness for more than twenty years.

Instructions

2. I have discussed my instructions with S Solicitors and I understand my instructions to be that I should describe the evidence that supports the Counts in the Indictment.

Making Indecent Images

3. Count 3 on the Indictment says, “image number 25 from the Initial Report with exhibit reference E/3571/2 at SAP level 3”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 3, that “Item 25 to 35” are “11 still images believed by the case officer to be consistent with SAP level 2.”

4. Count 5 on the Indictment says, “image number 76 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 31, of item 76, “Note this is not a picture or a video clip”.

5. Count 6 on the Indictment says, “image number 121 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 43, of item 121, that the picture is in a folder called, “... \Local Settings\Application Data\Ahead ...”. It is my understanding that this folder and its content is created automatically by software with the brand name Nero. I have seen nothing to show that Mr D knew of the existence of this folder and its content.

6. Count 7 on the Indictment says, “image number 130 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 46, of item 130, that the picture is in, “Unallocated Clusters” and “Is Deleted: No”. I cannot recall that I have ever seen the phrase “Unallocated Clusters” used to indicate anything other than a deleted file. I have seen nothing to show any action by Mr D, or any other person, that caused the image in Count 7 to be created. I have seen nothing to show that this image was originally created in a folder known to and accessed by Mr D.

7. Count 8 on the Indictment says, “image number 139 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 49, of item 130, that the picture is in, “Unallocated Clusters” and “Is Deleted: No”. I cannot recall that I have ever seen the phrase “Unallocated Clusters” used to indicate anything other than a deleted file. I have seen nothing to show any action by Mr D, or any other person, that caused the image in Count 8 to be created. I have seen nothing to show that this image was originally created in a folder known to and accessed by Mr D.

Temporary Internet Files

8. I can use my computer to view web pages using Internet Explorer software.

9. Internet Explorer software automatically creates a copy of everything that is contained in a web page. This copy is contained in one or more files on the hard drive of my computer. Some of these automatically created files contain pictures. These automatically created files are stored in a folder called “Temporary Internet Files”.

10. I might view the web page for a hotel. The hotel web page might contain some text and two pictures. One picture might be at the top of the web page and the other picture might be at the bottom of the web page. There might be many dozens of lines of text between the two pictures. It may be that there are so many lines of text that the complete web page is too big to be displayed all at one time on the screen of my computer. It may be that I never see the picture at the bottom of the web page.

11. I might search the Internet for web pages describing hotels in Brighton. I might click on some text expecting to see information about a Brighton hotel and see the web page for a hotel in Bournemouth.

12. I might search the Internet for web pages describing hotels in Brighton and I might view the web pages for Brighton hotels. During my viewing, web pages for hotels in Bournemouth might “pop-up” on the screen even though I have done nothing knowingly to cause the pop-ups.

13. I might search the Internet for the web pages of hotels in Brighton and click on text and look at various hotel web pages. After my viewing session, the Temporary Internet Files folder might contain a picture from the bottom of a web page even though I have never seen the picture. The Temporary Internet Files folder might also contain pictures from the web page of a hotel in Bournemouth even though I was not interested in Bournemouth hotels.

14. Count 9 on the Indictment says, “image number 145 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 51, of item 145, that the picture is in a folder called, “... \Temporary Internet Files\ ...”. It is my understanding that this folder and its content is created automatically by Internet Explorer web browsing software. I have seen nothing to show that Mr D viewed “image number 145” on the computer screen. I have seen nothing to show that “image number 145” was stored in the Temporary Internet Files folder because Mr D had, for example, clicked on some explicit text. I have seen nothing to show that “image number 145” was not stored in the Temporary Internet Files as the result of some pop-up web page.

15. Count 11 on the Indictment says, “image number 158 from the Initial Report with exhibit reference E/3571/2 ...”. I have a copy of the Initial Report with exhibit reference E/3571/2 that says, at Page 54, of item 158, that the movie is in a folder called, “... \Temporary Internet Files\ ...”. It is my understanding that this folder and its content is created automatically by Internet Explorer web browsing software. I have seen nothing to show that Mr D viewed “image number 158” on the computer screen. I have seen nothing to show that “image number 158” was stored in the Temporary Internet Files folder because Mr D had, for example, clicked on some explicit text. I have seen nothing to show that “image number 158” was not stored in the Temporary Internet Files as the result of some pop-up web page.

Act of Making Indecent Images

16. PC C's Initial Report ( Exhibit E/3571/2 ) lists about 32 pictures and 1 movie as being in a “User” folder. I have seen no evidence to show the actions taken by Mr D, or any other person, to acquire these items and to cause them to be stored on the computer.

Possession of Indecent Images

17. PC C's Initial Report ( Exhibit E/3571/2 ) lists 158 items that are:

• 33 items stored in a folder called “... User ...”.

• Items described by PC C as, “... This is not a picture or video clip”.

• Items in folder “... Temporary Internet Files”. I have seen nothing to show that Mr D knew of the existence of this folder and its content.

• Items in unallocated clusters. I have seen nothing to show that these items were known to Mr D or accessed by Mr D before or after they were deleted.

• Items that are thumbnail pictures that were created automatically by software. I have seen nothing to show that Mr D knew of the existence of these thumbnail pictures.

18. Counts 12, 13, 14, 15, 16, 17, 18 and 19 specify a total of 129 images. The majority of these images are in Temporary Internet Files or are deleted or are automatically created thumbnails or are described by PC C as, “... this is not a picture or a video clip.”

19. I do not know of any way that Mr D could be in possession of images that he did not know were stored on his computer because the images were in Temporary Internet Files or deleted or automatically created thumbnails files described by PC C as, “... this is not a picture or a video clip.”

Summary

20. I have seen nothing to show that Count 5 refers to an image.

21. I have seen nothing to show that the images in Counts 6, 7 and 8 were ever in folders known of by Mr D.

22. I have seen nothing to show that Mr D viewed the images in Counts 9 and 11 on the computer screen. I have seen nothing to show that the images were stored in the Temporary Internet Files folder because Mr D had, for example, clicked on some explicit text. I have seen nothing to show that the images were not stored in the Temporary Internet Files as the result of some pop-up web page.

23. I have seen no evidence to show the actions taken by Mr D, or any other person, to acquire any images and to cause them to be stored on the computer.

24. I understand my duty to the Court and I confirm that I have complied with and will continue to comply with that duty.

25. I confirm that insofar as the facts stated in my report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.

Graham Dilloway
Expert Witness

27 April

Letter after Discussion with Police Computer Examiner

1 June

Miss S
S Solicitors

Dear Miss S

Expert Witness Examination

PC C has telephoned me today to discuss his latest statement.

It appears that PC C and I are in agreement about most of this.

It is not for me to put words into the mouth of PC C. The following is based on the content of his evidence.

I would expect that the testimony in Court would be …

Count 1 – PC C will probably say that the picture is in the User folder because it was deliberately saved into the User folder and that item 2) in the list shows that the picture was viewed on the screen of the computer.

Count 2 - PC C will probably say that the picture is in the User folder because it was deliberately saved into the User folder and that item 22) in the list shows that the picture was viewed on the screen of the computer

Count 3 - PC C will probably say that the picture is in the User folder because it was deliberately saved into the User folder. PC C is likely to agree that there is no evidence that the picture was viewed. The Indictment says SAP level 3 and PC C's report says SAP level 2.

Count 4 - PC C will probably say that the picture is in the User folder because it was deliberately saved into the User folder. PC C is likely to agree that there is no evidence that the picture was viewed.

Count 5 – It is likely that the Indictment will be amended to say Item 75 (and not item 76 as it is now). For an amended Count, PC C will probably say that the picture is in the User folder because it was deliberately saved into the User folder and that item 76) in the list shows that the picture was viewed on the screen of the computer.

Count 6 – PC C says “it has not been possible to test precise user actions” and that it is “highly likely” that the picture exists because a picture or video was copied to a DVD or CD. PC C is likely to agree that he can't be sure what was done that caused the picture to be on the computer. PC C is likely to agree that the picture is on the computer as an unintended consequence of some action (such as creating a CD).

Count 7 – PC C is likely to agree that this is a deleted picture and he cannot say that it was deliberately saved on the computer. PC C is likely to say that the picture is on the computer because a user of the computer has an interest in pictures of this kind.

Count 8 - PC C is likely to agree that this is a deleted picture and he cannot say that it was deliberately saved on the computer. PC C is likely to say that the picture is on the computer because a user of the computer has an interest in pictures of this kind.

Count 9 – PC C is likely to say that this picture is on the computer as an “automated consequence” of a computer user accessing the picture while viewing a web page. PC C is likely to say the the web page being viewed was probably a page used to access email. It is likely that PC C will agree that we cannot be sure that sure that the picture was on the computer because of email. It is likely that PC C will agree that we cannot be sure that the picture was on the computer because of a specific deliberate act (such as clicking on the words, “Click here for nasty pictures”).

Count 10 - PC C will probably say that the movie is in the User folder because it was deliberately saved into the User folder. PC C is likely to agree that there is no evidence that the movie was viewed.

Count 11 - PC C is likely to say that this movie is on the computer as an “automated consequence” of a computer user accessing the movie while viewing a web page. PC C is likely to say the the web page being viewed was probably a page used to access email. It is likely that PC C will agree that we cannot be sure that sure that the movie was on the computer because of email. It is likely that PC C will agree that we cannot be sure that the movie was on the computer because of a specific deliberate act (such as clicking on the words, “Click here for nasty movies”).

Counts 12 to 19 – PC C has agreed, in an informal telephone conversation, that the numbers of pictures listed in these Counts are wrong. But, in his statement dated 31 May , PC C says, the User folder “contains 164 images or video clips which are generally unlawful”. It may be that these Counts could be amended to refer only to undeleted material in the User folder. It is likely that PC C would say that any such material in an amended Count is on the computer deliberately.

PC C has re-examined the computers and has produced an Additional Report Exhibit E/3571/4. From a cursory glance at this report, it would appear that PC C has found evidence that a computer was used to search the Internet using phrases that include “preteen models”.

PC C also appears to have found evidence regarding the use of Limewire software. Limewire is file transfer software that is used to obtain files from the computers of Internet users (as opposed to downloading files from web sites). PC C's evidence contains text that indicates indecent images of children.

From my conversation with PC C, it is my understanding that the CPS have been advised that amendments should be made to some of the Counts.

Please call if you wish to discuss this.

I look forward to hearing from you.

Yours sincerely

Graham Dilloway
Expert Witness

Second Formal Expert Report

Author

1. This report was prepared by Graham Dilloway of 39 CoEXam Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years

Instructions

2. I have discussed my instructions with S Solicitors and I understand my instructions to be that I should describe the evidence that supports the Counts in the Indictment.

Exhibits

3. On 14 June , I visited Police and collected copies that appear to be the content the hard drives from Exhibits E/01 and E/02. The copies ,that I have use the references EX3 and EX4.

4. PC C says in his statement dated 5 June , of the Exhibits, “... examined by CO 12345 H ...”. I have not seen a witness statement by CO H. It appears that EX3 is a copy of the content of the hard drive from E/02. It appears that EX4 is a copy of the content of the hard drive from E/01.

Making Indecent Images

5. Count 1 on the Indictment says, “... on the 10th day of November  made an indecent photograph of a child, namely image number 1 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 1” has File Created date of 10 November .

6. I have seen nothing to show the actions that caused the file “image number 1” to be stored on the computer on 10 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

7. Count 2 on the Indictment says, “... on the 3rd day of January  made an indecent photograph of a child, namely image number 3 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 3” has File Created date of 3 January .

8. I have seen nothing to show the actions that caused the file “image number 3” to be stored on the computer on 3 January . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

9. Count 3 on the Indictment says, “... on the 10th day of November  made an indecent photograph of a child, namely image number 5 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 5” has File Created date of 10 November .

10. I have seen nothing to show the actions that caused the file “image number 5” to be stored on the computer on 10 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

11. Count 4 on the Indictment says, “... on the 1st day of December  made an indecent photograph of a child, namely image number 7 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 7” has File Created date of 1 December .

12. I have seen nothing to show the actions that caused the file “image number 7” to be stored on the computer on 1 December . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

13. Count 5 on the Indictment says, “... on the 3rd day of December  made an indecent photograph of a child, namely image number 9 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 9” has File Created date of 3 December .

14. I have seen nothing to show the actions that caused the file “image number 9” to be stored on the computer on 3 December . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

15. Count 6 on the Indictment says, “... on the 15th day of November  made an indecent photograph of a child, namely image number 11 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 11” has File Created date of 15 November .

16. I have seen nothing to show the actions that caused the file “image number 11” to be stored on the computer on 15 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

17. Count 7 on the Indictment says, “... on the 13th day of December  made an indecent photograph of a child, namely image number 13 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 13” has File Created date of 31 December . There may have been a typing error that transposed the digits in the date in the Indictment.

18. The file “image number 13” is in the recycle bin. I have seen nothing to show that Mr D knew that an action by him would cause a file to be “made” in the recycle bin. I have seen nothing to show that the file referred to in file number 14 of PC C's report is the same file called “2_John” that is referred to in file number 13 of the report.

19. Count 8 on the Indictment says, “... on the 10th day of November  made an indecent photograph of a child, namely image number 15 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 15” has File Created date of 10 November .

20. I have seen nothing to show the actions that caused the file “image number 15” to be stored on the computer on 10 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

21. Count 9 on the Indictment says, “... on the 3rd day of January  made an indecent photograph of a child, namely image number 17 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 17” has File Created date of 3 January .

22. I have seen nothing to show the actions that caused the file “image number 17” to be stored on the computer on 3 January . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

23. Count 10 on the Indictment says, “... on the 14th day of December  made an indecent photograph of a child, namely image number 19 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 19” has File Created date of 14 December .

24. I have seen nothing to show the actions that caused the file “image number 19” to be stored on the computer on 14 December . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

25. Count 11 on the Indictment says, “... on the 15th day of November  made an indecent photograph of a child, namely image number 21 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 21” has File Created date of 15 November .

26. I have seen nothing to show the actions that caused the file “image number 21” to be stored on the computer on 15 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

27. Count 12 on the Indictment says, “... on the 3rd day of January  made an indecent photograph of a child, namely image number 23 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 23” has File Created date of 3 January .

28. I have seen nothing to show the actions that caused the file “image number 23” to be stored on the computer on 3 January . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

29. Count 13 on the Indictment says, “... on the 10th day of November  made an indecent photograph of a child, namely image number 67 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 67” has File Created date of 10 November .

30. I have seen nothing to show the actions that caused the file “image number 67” to be stored on the computer on 10 November . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

31. Count 14 on the Indictment says, “... on the 18th day of December  made an indecent photograph of a child, namely image number 69 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 69” has File Created date of 18 December .

32. I have seen nothing to show the actions that caused the file “image number 69” to be stored on the computer on 18 December . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

33. Count 15 on the Indictment says, “... on the 18th day of December  made an indecent photograph of a child, namely image number 71 as analysed in the Report produced by PC C dated 5 June  with exhibit reference E/01(1) ...”. PC C's report says that “image number 71” has File Created date of 18 December .

34. I have seen nothing to show the actions that caused the file “image number 71” to be stored on the computer on 18 December . It may be that the file was received in an email with the text, “Here is a picture of a fully dressed woman”. It may be that the file was saved onto the computer without the content having been viewed.

Temporary Internet Files

35. I can use my computer to view web pages using Internet Explorer software.

36. Internet Explorer software automatically creates a copy of everything that is contained in a web page. This copy is contained in one or more files on the hard drive of my computer. Some of these automatically created files contain pictures and movies. These automatically created files are stored in a folder called “Temporary Internet Files”.

37. I have seen nothing to show that Mr D knew that pictures and movies are stored on a computer in Temporary Internet Files. I have seen nothing to show that Mr D could have accessed and viewed pictures and movies stored on a computer in Temporary Internet Files.

Unallocated Clusters

38. The term “unallocated clusters” is used to describe a file that has been deleted. I have seen nothing to show that Mr D knew how to access and view deleted pictures.

Possession of Indecent Images

39. Count 18 on the Indictment appears to be referring to images numbered 25 to 35 as analysed in the Report produced by PC C dated 5 June .

40. The images numbered 27 and 28 as analysed in the Report produced by PC C dated 5 June  were automatically created by software. I have seen nothing to show that Mr D knew that images numbered 27 and 28 were on the computer.

41. The images numbered 29, 30, 31, 32, 33, 34, and 35 as analysed in the Report produced by PC C dated 5 June  were deleted files.

42. Count 19 on the Indictment appears to be referring to images numbered 36 to 66 as analysed in the Report produced by PC C dated 5 June .

43. The images numbered 36 to 56, 64, 65 and 66 as analysed in the Report produced by PC C dated 5 June  were deleted files.

44. Count 20 on the Indictment appears to be referring to images from those numbered 77 to 120 as analysed in the Report produced by PC C dated 5 June .

45. The images numbered 77 to 114 as analysed in the Report produced by PC C dated 5 June  were deleted files.

46. Count 21 on the Indictment appears to be referring to videos numbered 156, 157 and 158 as analysed in the Report produced by PC C dated 5 June .

47. The videos numbered 157 and 158 as analysed in the Report produced by PC C dated 5 June  were in Temporary Internet Files.

48. Count 22 on the Indictment says, “... namely 9 images (item numbers 121 – 129) ...”.

49. The image numbered 121 as analysed in the Report produced by PC C dated 5 June  were automatically created by software. I have seen nothing to show that Mr D knew that images numbered 27 and 28 were on the computer.

50. The images numbered 122 – 128 as analysed in the Report produced by PC C dated 5 June  were in Temporary Internet Files.

51. The image numbered 129 as analysed in the Report produced by PC C dated 5 June  is a deleted file.

52. Count 23 on the Indictment says, “... namely 9 images (item numbers 130 – 138) ...”.

53. The image numbered 136 as analysed in the Report produced by PC C dated 5 June  is in Temporary Internet Files.

54. The images numbered 130 to 135, 137 and 138 as analysed in the Report produced by PC C dated 5 June  are deleted files.

55. Count 24 on the Indictment says, “... namely 6 images (item numbers 139 – 144) ...”.

56. The images numbered 139 to 144 as analysed in the Report produced by PC C dated 5 June  are deleted files.

57. Count 25 on the Indictment says, “... namely 11 images (item numbers 145 – 155) ...”.

58. The images numbered 145 and 146 as analysed in the Report produced by PC C dated 5 June  are in Temporary Internet Files.

59. The images numbered 147 to 155 as analysed in the Report produced by PC C dated 5 June  are deleted files.

Summary

60. I have seen nothing to show the actions taken by Mr D that caused pictures to be stored on the computer for files in Counts 1 to 15.

61. Counts 18 to 25 refer to pictures and movies that are in files stored in locations that are unknown or inaccessible to Mr D.

62. I understand my duty to the Court and I confirm that I have complied with and will continue to comply with that duty.

63. I confirm that insofar as the facts stated in my report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.

Graham Dilloway
Expert Witness

20 August