Digital forensics is a section of forensic science which involves the recovery, examination and investigation of material found on digital devices. Due to its more recent inception digital forensics falls into the non-traditional category of forensic science. For that reason standards in the field have had far less time to develop and can often fall short of those which would be routinely expected within the traditional fields.
Our digital forensic experts
Our team of digital forensic experts hold over 100 years’ of combined experience in the provision of digital forensic services and are all leaders in their chosen specialisms. We have provided forensic investigation services in vast numbers of cases involving theft, fraud, robbery, terrorism, bribery, indecent images (IIOC), supply of drugs, assault, indecent assault, rape, firearms, manslaughter, conspiracy to murder and murder.
Digital forensic capabilities
Our expertise span the entire range of digital forensic services; identifying, realising and explaining the value of evidence hidden among digital sources such as computers, tablets, mobile phones, satellite navigation systems and other data storage devices.
Our vast data systems, technical capabilities and significant expertise all work together to deliver reliable, robust and cost-effective solutions. They also provide us with the absolute best opportunity to recover any deleted, hidden or fragmented data.
Our digital forensic examinations are always meticulous and our reports designed to be easily understood by a layperson, so as to be of maximum benefit to the court.
Our processes and protocols
All of our processes are set to prevent any data from being compromised and we have strict protocols in place so as to ensure full compliance with the ACPO (Association of Chief Police Officers) Guidelines for Electronic Evidence as well as other UK and international standards.
Forensic Voice Recognition, Audio Enhancement and Transcription
Forensic speech analysis covers a number of areas including identifying an individual by voice, deciphering unclear speech and the provision of transcripts.
Often the prosecution will claim that the voice that can be heard on a recording of interest (i.e covert recordings / 999 calls) is consistent with a particular individual or they may suggest that a particular word or sentence has been said which is often disputed by the defence, especially when the material is of a criminal nature.
​
How can our audio analysts assist?
​
Our experienced analysts can review these prosecutions assertions by carrying out a comparison of the questioned material and the known/’reference’ material. For example, there could be a covert recording of individuals discussing the sale of drugs and are alleging that one of the voices heard can be attributed to a particular defendant. We would then obtain reference material, such as voicemails, PACE interviews, or BWV (or alternatively interview the defendant and produce our own reference profile) and compare the two. This is achieved by reviewing speech characteristics of the disputed recordings with accepted/reference recordings and comparing them in terms of language use, voice quality, pitch, fluency, accent, speech tempo and general pronunciation of vowels and consonants in order to establish whether samples are or are not consistent with a single (1) speaker.
​
Questioned telephone recordings and the ‘reference’ samples are then profiled in greater detail, phonetically and acoustically. Factors considered in this phonetic profiling included voice quality, vocal pitch, pitch range, intonation, speech tempo, pausing, fluency and rhythmic properties, pronunciation of vowels and consonant sounds, and use of language (conversational fillers, lexical choice, syntax and morphology) and non-speech sounds such as laughter and other vocalisations). Noting the details of the pronunciation of the vowels and consonant sounds was facilitated by the use of the conventions of the revised International Phonetic Alphabet, the IPA.
​
In parallel with and aiding this descriptive analysis, sound spectrography software (PRAAT, University of Amsterdam) is also employed to examine the recording bandwidth and speech features such as fundamental frequency, voice quality, speech resonances and temporal properties of relevant speech sounds.
​
With regards to speaker identification, it should be stressed that owing to our understanding of speaker individuality, any report of this kind can only rarely state categorically that two (2) speech samples originate from the same or different speakers. Speaker identification based upon phonetic methods is not comparable with DNA-profiling or fingerprinting.
When audio enhancements are required, we carry out an initial assessment using a waveform editor (Adobe Audition V3.0), an external sound card (Edirol UA-25) and professional quality headphones (Sennheiser HD640) under laboratory conditions.
The initial assessment of the questioned recording includes examination of its audio structure and speech intelligibility.
​
Once it had been established that the recording is amenable to forensic analysis, the transcribing begins and the auditory examination is conducted in five (5) ‘passes’ across each channel using the waveform editor, each ‘pass’ refining the previous version until ambiguities were resolved as far as was possible.
We use a number of transcription conventions in order to provide the most accurate portrayal of what can and cannot be heard.
CCTV Enhancement and Imagery Analysis
Eyewitness evidence, although often powerful, is plagued by the frailties that accompany honest, but mistaken witnesses. There are countless cases where honest witnesses have erred in their evidence; equally there are many cases where witnesses cannot identify the perpetrator, even though he is in the line-up or standing in the dock. Stress, sensory impairment, time and circumstance impact upon a witness’s ability to accurately identify perpetrators of offences.
It is a fundamental tenet of our Criminal Justice System that we should prosecute criminal offences with vigour and ensure that only the guilty are convicted.
CCTV evidence is not subject to the same frailties that face humans; it can be said that, subject to certain considerations, which must include the proper forensic retrieval and analysis of such evidence, that the camera has the potential to be the ‘Perfect Witness’. The CCTV camera is never subject to stress; whilst tumultuous events may unfold before it, the CCTV system will capture and record accurately and dispassionately all that occurs before it. Although silent, it remains a constant, unbiased witness with instant and total recall of all that it observed and unlike the human witness, it is not subject to influence post the event. So long as the recorded imagery is of reasonable quality and provides a clear record of the events and the perpetrator, it may provide the most reliable evidence of identification and/or sequence of events. It is relevant and admissible evidence that can, by itself, be cogent and convincing evidence on the issue of identity.
Advances in digital technology have led to the use of various scientific techniques in the analysis and presentation of CCTV evidence within the Courts. In some cases, it now makes the difference between admitting video evidence or excluding it.
The admissibility and the potential value of CCTV evidence is however, hugely dependent on the forensic analysis and presentation of such evidence, by suitably trained and experienced accredited forensic scientists who specialise in forensic video analysis. Forensic video analysis is a science and must therefore be subject to the same principles as any other forensic discipline.
“Forensic Video Analysis is the scientific examination, comparison and/or evaluation of video in legal matters”.
​
How can our digital forensic scientists aid counsel?
Where the Crown’s case is largely dependent on CCTV evidence, it is hugely important that the Forensic Scientist works closely with the Defence team; in order to properly and forcefully present the defence case. It is essential that Defence Counsel has a thorough understanding of all the issues at hand.
CCTV technology has changed dramatically post 2003/4 and as a consequence, forensic video practitioners from within the Law Enforcement and Private sectors have had to undergo extensive training in both the acquisition and processing of digital media. In order to accurately interpret the content of an image, it is imperative that the analyst does not mistake artefacts of the imaging process as reflective of physical properties of the subject depicted. Resolution, compression, optical defects, lighting conditions, atmospheric conditions, aspect ratio issues, motion blur, together with camera to subject geometry, among others, may introduce barriers to reliable interpretation. Of course, not all of the above issues are insurmountable for the skilled forensic video analyst; they are nevertheless real issues that require the ability to produce a credible and reproducible technique for overcoming and/or accounting/allowing for such issues. Failure to recognise the limitations imposed by image resolution itself, means that there must therefore exist, an inherent difficulty in attaching any degree of confidence that apparent similarities (or differences) can accurately represent the underlying reality.
Our digital forensic scientists can:
​
Undertake Forensic Imagery Comparison
This involves a number of important practices and processes, so as to ensure and demonstrate validity. The concept of Class vs. Individual characteristics is fundamental to the process.
​
Class characteristics are used to sub-divide things into groups or classes. Individual characteristics allow the analyst to differentiate objects within a class from one another. Individual characteristics may be used to uniquely characterise an object; usually arising from random natural processes, alterations, additions or simple wear and tear. The ability to identify an individual object requires a correspondence of individual characteristics, although no arbitrary number of characteristics is required.
A commonly accepted protocol applied to image comparison is known as ACE-VR (Analysis, Comparison, Evaluation, Verification and Reporting).
1. Analysis: the process of imagery comparison has to involve a thorough assessment of the properties and attributes of the features contained within the images that are the subject of the examination. While the features involved are objectively determined, the cognitive assessment of such features is an inherently subjective process. This includes determining which (if any) features are Class or Individual characteristics, together with issues of image formation, such as image resolution, lighting, focus and camera to subject geometry.
2. Comparison: In the comparison stage, an assessment is made of the correspondence and/or discordance of those characteristics that were identified during the analysis process.
3. Evaluation: During the evaluation process, a tentative conclusion may be reached and the correspondence/discordances are tested against it. Any discordance is evaluated to determine if they reflect true differences between the subjects. There are three types of potential differences that may be observed:
1. Explainable Differences - which may result from the image process or conditions in the scene.
2. Unexplainable differences - which are of an unknown source or significance.
3. Exclusionary differences - that reflect a true difference between the objects subject to comparison and as a consequence, are able to support elimination. If no exclusionary differences exist, then the number and quality of the corresponding features can be used to determine the level of correspondence. In the absence of statistical models, the evaluation process has to be a cognitive evaluation. This relies on the drawing of conclusions from visualised features.
4. Verification: In the verification stage, the results of the examination should be evaluated through independent review, by an equally competent practitioner. This is otherwise known as a peer review.
As a company, Forensic Equity’s policy is that no report is released without it having first been peer reviewed by a second scientist. This is the case not just for digital evidence but applies across the board.
Cell Site Analysis
Cell Site Analysis is the science concerned with locating the geographical position of a mobile phone at a particular moment in time. The purpose of which is to identify whether a particular phone was in the vicinity of a specific event location or was indeed at the scene of a crime, or not. Using the data provided by mobile network operators together with our own cell-site coverage and network surveys our digital forensic analysts are able to determine the geographical locations and the movements of a particular phone during particular ‘periods of interest’.
Increasingly, cell site evidence is being used to prove or disprove alibis, demonstrating 'associations' or 'conspiracies', confirming a victim's movements and geographically 'placing' a suspect at the scene of a crime.
It is important to note however, that any analysis will not reveal who was holding the mobile for a call event. As such it is also often important to undertake analysis so as to prove or disprove whether a particular device can be attributed to a single person. Furthermore, it is often only possible to place a phone within a geographical area/zone and not to pinpoint its specific location.
Communications data is the information about a communication be it a phone call, text or email.
The data may include information such as the date and time the communication was sent, the duration of the communication (in the case of a phone call), the telephone number which was communicated with and the location data of the originator such as the location from which a phone call was made or in the case of an email the IP address and to and from addresses.
Communications data does not include any of the content of the communication. i.e. it does not include the text of an email, the content of a text or the conversation that was had on the telephone.
It is information about a communication, not the communication itself
Why is it important?
​
Communications data is used by the police during the investigation of a vast majority of crimes. It enables the police to build a picture of the activities and contacts of a person who is under investigation. It is then regularly used by the prosecution as supporting evidence in court.
Mobile location evidence or cell-site evidence
What is cell-site?
Cell Site analysis (CSA) or Radio Frequency Propagation Surveying (RFPS) is defined as the analysis of commination data records in order to investigate, movement, usage patterns and the possible attribution (ownership) of a device.
Cell Site analysis can be applied to calls, text messages or sent or received downloads.
Using a device’s communication data (held for up to 1 year by the service provider) it is possible to identify the historic, geographical movement of the phone from place to place. These records (called Call Data Records or CDRs) will include details of the mast used at the start and end of a call. Using this information, a cell-site analyst can map the historical movement of the phone in question, and can focus in or places and times of interest.
In more complex cases such as those where it must be determined whether a particular mast could have been providing service on a particular occasion a cell site survey can be undertaken. This involves using specialist equipment and surveying numerous masts on a range of mobile networks. The data is then represented on a map where the coverage of all identified cell sites is shown.
There are 4 major networks in the UK, 3, Everything Everywhere (EE, previously Orange and T-Mobile), O2 and Vodafone.
Other providers such as Tesco or Virgin Mobile will often use the network provided by one of the main providers mentioned above.
Typically, a network is made up of many thousands of cell sites located across the UK. A Cell Site provides coverage for the networks users and enables them to communicate. It is important to note that cell sites often overlap in terms of their geographical coverage and therefore on many occasions a phone will have a range of cells through which it can connect.
It is also important to realise that Call Data Records (CDR) held by the network providers only record the details of the cell site that was used to connect the call (where the call started) and also the details of the last cell site used (i.e. the one that was being used when the call was disconnected). The cell sites that may have been used during in the intervening duration of the call (i.e. if the person was moving during the call) are not recorded. Phones are programmed via the Sim Card to use the ‘best serving cell’. i.e. the one which provides the best available quality/strength of signal.
Similar information is also recorded when a text is made or received. Connections to the internet are also recorded when the network (i.e. 3G or 4G) is used. Internet usage through wifi will not create a data record.
The data also only shows the data for the cell site used by the phone in question. It will not show information about the caller’s phone.
Police can obtain CDR information from providers under the regulation of investigatory powers act (2000)
Basic cell site from CDRs can only show to which cell the phone connected and when the phone connected and disconnected. It cannot show the phones precise location of the phone nor does it show who was using the phone at the time.
It is important to note that mobile network providers will only retain data for 12 months. As such if the prosecution have not undertaken any cell-site analysis and you wish for it to be done then you will need to obtain a court order to retrieve the data within 12 months of the alleged offence. Post this date, the data will have been deleted and no cell-site analysis will ever be able to be undertaken.
Radio Frequency Propagation Surveys (RFPS).
​
The second type of evidence involves a Radio Frequency Propagation Surveys (RFPS). The surveyor investigates an area in which different cell sites enable a call to be made. This is usually done to support the contention that the mobile device belonging to the suspect was in the area at the time of the offence.
The surveyor begins by examining the call schedule in order to identify where he should carry out a survey. This may be a specific location, a surrounding area or a route to and from a specific location.
Having decided where to survey the surveyor then needs to decide what to survey. i.e. which networks masts to survey. If the suspect’s phone is on the Vodafone network then it is the Vodafone cells which need to be surveyed not those belonging for example to EE.
The surveyor uses equipment which replicates a regular mobile phone. The machine has a sim card for the relevant network. It also has a GPS which works like a Sat-Nav to record its exact location. As the surveyor drives the equipment around it makes test calls, seeing if it can connect to the network. As it makes each call the equipment makes a note of the time, the GPS position, if connection was possible and the ID of the cell site it was connected to. Handheld equipment is also used in situations where it is not possible to drive to the location.
A survey cannot show the phone’s precise location or confirm the user of the device. But what the survey can show is whether a particular Cell Site provides coverage at or near a scene. Therefore, given the Call Data Records (which show the cell sites which the phone connected to during a given period) a survey can determine whether a phone was or could have been at or very near a crime scene at the time of the incident.
What can cell site analysis be used to do?
​
Provide support, or not, for the attribution or association of a mobile phone number to a particular person.
Provide support or not for the attribution or association of a mobile phone number to a particular address.
To detail specific patterns of movement of a mobile phone between different areas or locations
Provide support for, or repudiation of assertions, such as that of a particular mobile phone being used at a location of interest.
It used to be that cell site analysis was generally only used in cases involving allegations of serious or organised crimes however changes in how the Police coordinate cell site analysis has led to such examinations being used in cases involving much less serious crimes such as burglaries, robberies, and the breach of restraining orders.
The Prosecution will often seek to demonstrate that the cell site usage is consistent with their case however, this support is rarely such that it also excludes other possibilities. As such, it is important to assess the defendant’s account of their movements against the cell usage in order to appraise whether the evidence equally supports the defence case or whether it indeed provides greater support for one hypothesis over another
Our digital and cell site analysts can:
-
Examine and interpret call data records (CDR’s)
-
Conduct cell site mapping and on-site network readings and radio surveys, including:
-
Taking spot readings at significant locations.
-
Conducting route profiles in order to determine cellular coverage along routes travelled by those accused of involvement.
-
Undertaking coverage profiles in order to determine the area covered by particular cell masts.
-
Undertaking network profiles in order to demonstrate the coverage of all cellular networks at a given location.
-
Produce a detailed and comprehensive forensic statement which evaluates all of the issues present in the case and explains how the evidence relates to your clients’ case: All of our cell site reports include call data table and geographic mapping presentations as appropriate.
-
Appear as an expert witness should the case go to trial, where they will ensure that the true value of the prosecution’s evidence is explained in a clear and credible manner, with other possible interpretations put forward for the benefit of the court.
-
Support for the attribution or association of a mobile phone number to a person;
-
Support for the attribution or association of a mobile phone number to an address;
-
Patterns of movement of mobile phones between areas or locations;
-
Support for, or repudiation of, contentions such as of a mobile phone being used at a location.
All of our investigations are undertaken in strict compliance with Association of Chief Police Officers (ACPO) Guidelines for managing and evaluating digital evidence. Furthermore, our cell site analysis experts contribute to a number of leading working groups as well as undertaking constant research into these spheres, to ensure our approaches to Cell Site Analysis (CSA) remain in touch with Best Practice.
Computer Forensics
The computing items that surround us every day, contain a great deal of information about an individuals life. Their computer and phone make record of their communications, their relationships with people, businesses and systems, their photos and documents and their searches on things of interest to them. For years the designers of systems have spent a huge amount of effort making sure that nothing gets lost; what use is a phone that cannot recall the phone number of your friend when you need it? This plays perfectly into the hands of the digital forensic examiner. Systems are designed to retain information; purging it has to be a conscious and deliberate act, and even then, it isn’t particularly effective in many cases. This gives an experienced and highly qualified examiner an unprecedented opportunity to recreate the life of the individual, when given the right things to look at and it is this which enables you to make a case for that person.
​
What types of issues can our digital forensics address?
​
â–ª Times and dates – most applications or software on a computer system almost always have time stamp on them. Using these, our scientists can determine when a file was created and when it was edited. Some files; photographs in particular, are good at recording times within them.
â–ª Locations – wherever a device has the capability to track its own location via GPS, then there is often information on the system of where it has been and when it was there. Again, photographs, especially those taken on smart phones, often embed the location that the picture was taken.
â–ª Who was it – where a device belongs to an individual, it is often locked with a passcode or phrase that is known only to a limited number of people. It is usually possible to show that a given user has logged into a device and then carried out an action. Frequently, there is further evidence that can be placed either side of a particular action, which increases the accuracy of this assertion; for example an e-mail being sent immediately before a video is watched.
â–ª What were they doing – it is often possible to reconstruct exact timelines of the usage of a device from a user logging in, carrying out a particular search on the internet, obtaining specific material from that search, viewing it and sharing it further.
â–ª Who else was involved – communications have two ends, and it is often possible to provide additional information to an investigation as to the sources and destinations of communications, even those that, at first glance, might appear to be anonymous.
​
Association of Chief Police Officers (ACPO) Guidelines – what are they?
Four principles are involved:
Principle 1:
No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court.
Principle 2:
In circumstances where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
Principle 3:
An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
Principle 4:
The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to. An Explanation of the principles
​
Computer-based electronic evidence is subject to the same rules and laws that apply to documentary evidence. The doctrine of documentary evidence may be explained thus: “The onus is on the prosecution to show to the court that the evidence produced is no more and no less now, than when it was first taken into the possession of the police”.
​
Operating systems and other programs frequently alter and add to the contents of electronic storage. This may happen automatically, without the user necessarily being aware that the data has been changed. In order to comply with the principles of computer-based electronic evidence, wherever practicable, an image* should be made of the entire target device. Partial or selective file copying may be considered as an alternative in certain circumstances e.g. when the amount of data to
be imaged makes this impracticable. However, investigators should be careful to ensure that all relevant evidence is captured if this approach is adopted. In a minority of cases, it may not be possible to obtain an image using a recognised imaging device. In these circumstances, it may become necessary for the original machine to be accessed to recover the evidence. With this in mind, it is essential that a witness, who is competent to give expert evidence in a court of law makes any such access. It is essential to display objectivity in a court, as well as the continuity and integrity of evidence. It is also necessary to demonstrate how evidence has been recovered, showing each process through which the evidence was obtained. Evidence should be preserved to such an extent that a third party is able to repeat the same process and arrive at the same result as that presented to a court.
​
Extract from the current ACPO Guidelines.
*Image – a copy of the data that is taken from the original digital device seized. This copy should either be an exact replica of the original device, or the deviations from the original should be noted by the competent person creating the image. Most notably, mobile phones are nearly impossible to image without deviation from the original.
​
How can our digital forensic scientists assist counsel?
​
By carrying out forensic analysis of any digital items involved within a case, our scientists can clarify whether the prosecutions has actual evidence for their allegations. More often that not, many of the prosecutions presumptions cannot be proven and it is down to our scientists to highlight that their claims cannot be traced digitally, or rather cannot support the extent of their report.
​
Case Example
​
Background:
We intervened in this case at the stage of the Newton Hearing, with the defendant having already
submitted a guilty plea.
​
The defendant had been involved in a technical scheme, whereby a single, legitimately bought,
subscription to television services through a satellite provider was resold a number of times. This was
carried out through a technology known as ‘card sharing’ and involved the sale of connections to
the ‘card sharing’ server.
​
The prosecution position:
The prosecution were asserting a loss of revenue in the order of £1.6 million. On the basis of a claim of
1667 ‘identified customers’.
​
Our initial thoughts:
Our initial view on the case was that the prosecution were actually unable to prove that any ‘card
sharing’ had taken place at all. Two key pieces of evidence were missing:
The first was a proxy server, which the prosecution asserted had been used by all of the alleged
paying clients in the case. This had been held in a data centre in Germany and it had not been
seized or imaged in any way and therefore it was impossible to tell how many clients were
configured or using it.
The second was a router ( a network device ) that had been seized at the defendant’s home In
order for the card sharing to have taken place, this would have had to have been configured, to
allow communication between the alleged proxy server in Germany and the alleged card sharing
source at the defendant’s home. This particular item of evidence had
been destroyed. Therefore, it was impossible to demonstrate the configuration one way or another.
​
Our analysis and conclusions:
We carried out a forensic analysis of the computers and media devices that had been seized and
identified that the only clear evidence of the alleged card sharing, was a set of e-mails, where the
defendant had clearly sold access to 97 specific, identifiable customers; a stark contrast to the 1667
originally alleged by the prosecution. In discussion, the prosecution agreed with our analysis of the
digital evidence and agreed that they could prove no more than that figure.
​
The outcome:
The final conclusion and outcome of the case was that the defendant received a 6 month
suspended sentence and a fine, which was set at £30,000 (an amount which had already been
seized as cash from the defendants home at the time of the raid).
​
This was a very interesting and complex case, involving, standard computers, networking equipment,
specific specialist hardware for the ‘card sharing’ and international servers. Collaboratively, our
digital team have a great deal of experience in networks and server related issues, as well as what
we generally refer to as ‘alternative operating systems’ – computers running on things other than
Microsoft Windows, such as MacOS X, Linux/UNIX and embedded devices.
​
​
​
​
​
​
​
The relevant legislation
Section 1 of the Protection of Children Act 1978
Section 160 of the Criminal Justice Act 1988
Section 62 of the Coroners and Justice Act 2009
Section 63 Criminal Justice and Immigration Act 2008
Section 1 of the Protection of Children Act 1978
It is an offence for a person –
-
To take, or permit to be taken, or to make any indecent photograph or pseudo-photograph of a child;
-
or to distribute or show such indecent photographs or pseudo-photographs;
-
or to possess such indecent photographs or pseudo-photographs, with a view to their being distributed or shown by himself or others;
-
or to publish or cause to be published any advertisement likely to be understood as conveying that the advertiser distributes or shows such indecent photographs or pseudo-photographs, or intends to do so.
This section creates a series of offences relating to indecent photographs or pseudo-photographs of a children falling into the following areas:
-
Creation
-
Dissemination
-
Possession with intent
-
Advertisement
It is necessary for the prosecution to prove that the defendant deliberately and/or knowingly committed the offences
​
Creation offences:
-
Taking an indecent photograph of a child
-
Taking an indecent pseudo-photograph of a child
-
Permitting another to take an indecent photograph of a child
-
Permitting another to take an indecent pseudo-photograph of a child
-
Making an indecent photograph of a child
-
Making an indecent pseudo-photograph of a child
Dissemination offences:
-
Distributing an indecent photograph or pseudo-photograph of a child
-
Showing an indecent photograph or pseudo-photograph of a child
​
​
Possession with intent offence
-
Possessing an indecent photograph or pseudo-photograph of a child with an intention that it be distributed or shown
-
Advertisement offence
-
Publishing an advertisement suggesting that an indecent photograph or pseudo-photograph of a child will be distributed or shown
​
Section 7 of the Protection of Children Act 1978 provides interpretations of the meaning of some of the language used within Section 1:
-
References to a photograph include data stored on a computer disc or by other electronic means which is capable of conversion into a photograph
-
References to an indecent photograph include an indecent film, a copy of an indecent photograph or film, and an indecent photograph comprised in a film
-
Film includes any form of video-recording
-
References to a photograph also include a tracing or other image, whether made by electronic or other means (of whatever nature) which is not itself a photograph or pseudo-photograph, but which is derived from the whole or part of a photograph or pseudo-photograph (or a combination of either or both)
-
Pseudo-photograph means an image, whether made by computer-graphics or otherwise howsoever, which appears to be a photograph
-
If the impression conveyed by a pseudo-photograph is that the person shown is a child, the pseudo-photograph shall be treated for all purposes of this Act as showing a child and so shall a pseudo-photograph where the predominant impression conveyed is that the person shown is a child notwithstanding that some of the physical characteristics shown are those of an adult.
Stated cases deal with the term make:
-
R v Bowden [2000] 1 Cr App R 438
Downloading an indecent photograph from the Internet was “making a copy of an indecent photograph” since a copy of that photograph had been caused to exist on the computer to which it had been downloaded.
-
R v Jayson [2002] EWCA Crim 683
The act of voluntarily downloading an indecent image from the internet to a computer screen was an act of making a photograph or pseudo-photograph because the computers operator, in so downloading, was causing the image to exist on the screen.
Stated cases deal with the term indecent:
-
R v Stamford [1972] 2 Q.B. 391
The test for indecency is for the jury to decide based on what is the recognized standard of propriety.
-
R v Graham-Kerr 88 Cr App R 302 CA
The circumstances and motive of the defendant are not relevant to the question of indecency, although they may be relevant to the question of whether the photograph was deliberately taken or made.
Section 7 of the Protection of Children Act 1978 also provides additional advice on what constitutes an indecent photograph of a child:
-
Photographs (including those comprised in a film) shall, if they show children and are indecent, be treated for all purposes of this Act as indecent photographs of children
-
This means that the child need not be involved in the indecency - some other aspect of the photograph can add the element of indecency (as in, for example, a photograph showing a child observing an adult performing an indecent act).
Section 2 of the Protection of Children Act 1978 states:
-
In proceedings under this Act relating to indecent photographs of children a person is to be taken as having been a child at any material time if it appears from the evidence as a whole that he was then under the age of 18
-
Section 7 of the Protection of Children Act 1978 states:
-
Child means a person under the age of 18
-
This was altered from 16 to 18 years by section 45(1) of the Sexual Offences Act 2003, in force from 1st May 2004
-
R v Land [1998] 1 Cr App R 301 CA
The age of a child is ultimately for the jury to determine. It is a finding of fact for the jury, and expert evidence is inadmissible on the subject, since it is not a subject requiring the assistance of experts.
Section 1 (2) of the Protection of Children Act 1978 states:
-
For purposes of this Act, a person is to be regarded as distributing an indecent photograph or pseudo-photograph if he parts with possession of it to, or exposes or offers it for acquisition by, another person
-
Exposes or offers it for acquisition means to offer to sell an indecent photograph of a child or offer to give it away
Stated case relating to the term show:
-
R v Fellows and Arnold [1997] 1 Cr App R 244
Providing another with a password to enable him to access pornographic data stored on a computer was said to be showing him the data.
Statutory Defences (a defence to the offence written into the statute)
-
1(4) where a person is charged with an offence under subsection 1(b) or (c) [which relate to distribution of indecent images of children or possession with a view to their being distributed], it shall be a defence for him to prove-
-
a) that he had a legitimate reason for distributing or showing the photographs or pseudo-photographs or having them in his possession; or
-
b) he had not himself seen the photographs or pseudo-photographs and did not know, nor had any cause to suspect, them to be indecent.
Statutory Defences Section 1B Exception for criminal proceedings, investigations etc.
​
-
(1) In proceedings for an offence under section 1(1)(a) of making an indecent photograph or pseudo-photograph of a child, the defendant is not guilty of the offence if he proves that-
-
a) it was necessary for him to make the photograph or pseudo-photograph for the purposes of the prevention, detection or investigation of crime, or for the purposes of criminal proceedings, in any part of the world,
-
b) at the time of the offence charged he was a member of the Security Service, or the Secret Intelligence Service and it was necessary for him to make the photograph or pseudo-photograph for the exercise of any of the functions of that Service, or
-
c) at the time of the offence charged he was a member of GCHQ, and it was necessary for him to make the photograph or pseudo-photograph for the exercise of any of the functions of GCHQ.
Statutory Defences Section 1A Marriage and other relationships
-
This section provides a defence to the taking , making or possessing photographs of their partners (either married or living together as partners in an enduring family relationship) where they are 16-17 years of age
Section 160 of the Criminal Justice Act 1988
-
(1) It is an offence for a person to have any indecent photograph or pseudo-photograph of a child in his possession.
-
(2) Where a person is charged with an offence under subsection (1) above, it shall be a defence for him to prove –
-
a) That he had a legitimate reason for having the photograph or pseudo-photograph in his possession; or
-
b) That he had not himself seen the photograph or pseudo-photograph and did not know, not had any cause to suspect, it to be indecent; or
-
c) That the photograph or pseudo-photograph was sent to him without any prior request made by him or on his behalf and that he did not keep it for an unreasonable time.
​
Stated cases relating to possession:
-
R v Porter [2006] EWCA Crim 560
The Court of Appeal held that an image will only be considered in possession if the defendant had custody or control of the image at that time. If at the time of possession the image is beyond his control, then he will not possess it.
By implication, if an image has been deleted, possession will depend on whether the defendant had the know-how and or the software to allow him to retrieve the image.
In practice, many indictments specify between dates, working on the assumption that the image concerned must have been within the custody and control of the defendant at one point in time.
Stated cases relating to possession:
-
Atkins v. DPP ([2000] 1 W.L.R. 1427)
Where a person views an indecent image of a child on the internet and his computer automatically caches the image, unbeknown to him, he could not be said to be in possession of the photograph in the cache for possession requires some degree of knowledge
Section 62 of the Coroners and Justice Act 2009
Possession of prohibited images of children
The offence is targeted at non-photographic images (this includes computer generated images (CGI’s), cartoons, manga images and drawings) and therefore specifically excludes indecent photographs, or pseudo-photographs of children, as well as tracings or derivatives of photographs and pseudo-photographs.
(1) It is an offence for a person to be in possession of a prohibited image of a child.
(2) A prohibited image is an image which–
a) is pornographic,
b) falls within subsection (6), and
c) is grossly offensive, disgusting or otherwise of an obscene character.
(3) An image is pornographic if it is of such a nature that it must reasonably be assumed to have been produced solely or principally for the purpose of sexual arousal.
Sub sections (4) and (5) relate to the context of an image when created as part of a series of images. In this case a pornographic image may not be a prohibited image.
(6) An image falls within this subsection if it—
a) is an image which focuses solely or principally on a child’s genitals or anal region, or
b) portrays any of the acts mentioned in subsection (7)
(7) Those acts are—
a) the performance by a person of an act of intercourse or oral sex with or in the presence of a child;
b) an act of masturbation by, of, involving or in the presence of a child;
c) an act which involves penetration of the vagina or anus of a child with a part of a person’s body or with anything else;
d) an act of penetration, in the presence of a child, of the vagina or anus of a person with a part of a person’s body or with anything else;
e) the performance by a child of an act of intercourse or oral sex with an animal (whether dead or alive or imaginary);
f) the performance by a person of an act of intercourse or oral sex with an animal (whether dead or alive or imaginary) in the presence of a child.
(8) For the purposes of subsection (7), penetration is a continuing act from entry to withdrawal.
Exclusion of classified film etc.
(1) Section 62(1) does not apply to excluded images
(2) An excluded image is an image which forms part of a series of images contained in a recording of the whole or part of a classified work
(3) But such an image is not an excluded image if—
a) it is contained in a recording of an extract from a classified work, and
b) it is of such a nature that it must reasonably be assumed to have been extracted (whether with or without other images) solely or principally for the purpose of sexual arousal.
Classified work means a video work in respect of which a classification certificate has been issued by a designated authority
Defences
(1) Where a person is charged with an offence under section 62(1), it is a defence for the person to prove any of the following matters—
a) that the person had a legitimate reason for being in possession of the image concerned;
b) that the person had not seen the image concerned and did not know, nor had any cause to suspect, it to be a prohibited image of a child;
c) that the person—
i. was sent the image concerned without any prior request having been made by or on behalf of the person, and
ii. did not keep it for an unreasonable time.
Section 63 Criminal Justice and Immigration Act 2008
Possession of extreme pornographic images
(1) It is an offence for a person to be in possession of an extreme pornographic image
(2) An extreme pornographic image is an image which is both—
a) pornographic, and
b) an extreme image
(3) An image is pornographic if it is of such a nature that it must reasonably be assumed to have been produced solely or principally for the purpose of sexual arousal.
Sub sections (4) and (5) relate to the context of an image when created as part of a series of images. In this case a pornographic image when considered alone may not be a pornographic image for the purposes of this offence.
(6) An extreme image is an image which—
a) falls within subsection (7), and
is grossly offensive, disgusting or otherwise of an obscene character
(7) An image falls within this subsection if it portrays, in an explicit and realistic way, any of the following—
a) an act which threatens a person’s life,
b) an act which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals,
c) an act which involves sexual interference with a human corpse, or
d) a person performing an act of intercourse or oral sex with an animal (whether dead or alive), and a reasonable person looking at the image would think that any such person or animal was real.
(8) In this section image means—
a) a moving or still image (produced by any means); or
b) data (stored by any means) which is capable of conversion into an image within paragraph a)
(9) In this section references to a part of the body include references to a part surgically constructed (in particular through gender reassignment surgery).
Exclusion of classified film etc.
(1) Section 63 does not apply to excluded images
(2) An excluded image is an image which forms part of a series of images contained in a recording of the whole or part of a classified work
(3) But such an image is not an excluded image if—
a) it is contained in a recording of an extract from a classified work, and
b) it is of such a nature that it must reasonably be assumed to have been extracted (whether with or without other images) solely or principally for the purpose of sexual arousal.
Classified work means a video work in respect of which a classification certificate has been issued by a designated authority
Defences: general
(1) Where a person is charged with an offence under section 63, it is a defence for the person to prove any of the matters mentioned in subsection (2).
(2) The matters are—
a) that the person had a legitimate reason for being in possession of the image concerned;
b) that the person had not seen the image concerned and did not know, nor had any cause to suspect, it to be an extreme pornographic image;
c) that the person—
i. was sent the image concerned without any prior request having been made by or on behalf of the person, and
ii. did not keep it for an unreasonable time.
Note:
A pseudo-photograph is an image, whether made by computer-graphics or otherwise howsoever, which appears to be a photograph
These are relatively rare but are sometimes made by merging photographs of adults and children e.g. using computer software such as Photoshop to place the face of a child on the naked body of an adult
The image is to be treated as an image of a child where the impression conveyed is a child or the predominant impression conveyed is of a child despite the fact that some of the physical characteristics shown are not those of a child
These may be prohibited images of children which have been illegal since 6th April 2010
To be illegal the image must be pornographic and grossly offensive, disgusting or obscene
The image must focus on the genital area or show one of a list of sexual acts
​
​
Charges Related to Indecent Images
Facial Mapping and Reconstruction
The face is the most individually recognisable part of the human body. Facial comparison or identification is the process by which a forensic scientist will compare an unknown image of a face with a known image (for example that from a custody record). This is a new area of forensic science for which there is currently no universally accepted methodology, validation of the processes or means of determining whether someone is actually competent. All opinions of facial identification should be treated with caution and we recommend that the methodology used should always be the subject of a peer review by a forensic scientist.
Facial mapping or imaging is admissible to demonstrate similarities in particular facial characteristics or combinations of such characteristics - see R v Grey [2003] EWCA Crim. 1001.
The first issue for the Courts to consider is whether the opinion of an expert witness in this field is necessary. A bench or a jury may be able to form its own opinion as to the similarity between the face of an offender from CCTV and that of the suspect in a photograph obtained by the police on arrest. There may also be no need for facial mapping, where a witness purports to be able to recognise someone well-known to them from a visual image, even if that image is not suitable for enhancement.
Alternatively, the use of enhancement techniques facilitated by specialist equipment may render an image that can be used by a bench or jury in its deliberations. The party seeking to adduce evidence arising from enhancement must be in a position to prove how the enhancement technique works. In producing his/her report and giving evidence, the person enhancing the image must be able to produce the original image (also known as the ‘native image’) and the enhanced version, with an explanation of the process undertaken. The process used should always be repeatable by another suitably qualified person.
If the image is such that a bench or jury cannot reach its own conclusion, then the opinion of an expert in facial mapping may be required. The legal position is that set out in R v Atkins and Atkins [2009] EWCA Crim. 1876. Having explained points of similarity between images, a suitably qualified scientist/expert can express his conclusions as to the significance of his/her findings by using a verbal scale arranged in sequence from “lends no support” to “lends powerful support”. The scientist/expert should not express any conclusion as to the probability of occurrence of those facial features, as there is no statistical database recording the incidence of the features compared, as they appear in the population at large. It should be stressed that expert/scientific evidence in these circumstances is an expression of subjective opinion and it is ultimately for the bench or jury to decide whether the images match.
Even more caution is required, where Counsel are faced with evidence where an expert purports to be able to compare other physical features or objects (such as car number plates, height estimations, colours and items of clothing) in ‘different images’ with a view to offering an opinion as to any similarities.
​
Concerns include:
Whether the expert is in any better position than the bench or jury to form an opinion. For example: the defendant is the registered keeper of a green Volkswagen Golf. A CCTV image shows a small green car at the crime scene at the time of the offence. An expert states that it is a Volkswagen Golf. What is the expert’s qualification in car design that enables him to be more of an expert in this field than the jury? The image expert will be able to describe certain features within an image and provide the bench or jury with additional knowledge as to whether they are artefacts within the image or actual features of the object. This does not make the witness an expert in the objects being compared;
Whether the expert evidence advances the case. For example, the offender in the CCTV is wearing a bracelet that is the same as that worn by the offender on arrest. If there is nothing else in the CCTV of assistance to the case, then this will be of little help to the prosecution case, when the object in question is a common one or a moveable one and could have been given away by the offender after the incident and prior to his arrest;
The risk of cognitive bias means that those instructing experts should take care not to provide the expert with information that is not needed and which might unduly influence the expert in reaching their conclusions. For example: “Can the expert confirm if person 2 in the CCTV, who is believed to be the assailant, is holding a knife?” and;
Lack of validation and competence. The lack of validation studies, published scientific opinion, a peer review or formal training may not necessarily result in the exclusion of the expert’s evidence but will be relevant to the weight which can reliably be attached to it.
What can our digital forensic scientist do to assist counsel?
​
Our scientist can help in an array of ways
​
Mobile Phone Forensics and Networking
​
Unlike computer, mobile phones are not held to the same standard that computers are in regards to their design. With computers, their hard drives are similar int he respect that a hard drive from a Dell device can be examined in the same way as one from a HP device because a hard drive conforms to a particular standard. In Computer Forensics therefore, it is a case of obtaining the hard drive, imaging it and then examining the resulting disk image. Unfortunately for mobile phones, there is no easily-removable hard disk in a phone.
Instead, each model has flash memory chips which are soldered (and often then glued) to the main board. Instead of having common standards (aside from the default ones that they have to adhere to for the communication side of things) their manufacturers create each device differently. Not only are they different, they also contain closely-guarded, secret proprietary features in order to prevent competitors reverse-engineering them.
As each device is unique, the forensic examination is therefore based on the exploitation of the phones’ built in features, designed by the manufacturers to transfer data between phone and computer, in order to extract data from the device. Some examples are iPhones which are dumped by asking the phone to do a full back-up and then producing a report from the resulting back-up files plus the limited publicly-accessible part of the file system that the device allows the computer access to. Some Android phones can be fooled into dumping their memory by the computer masquerading as a software update using the manufacturer’s own publicly available (leaked onto the internet) firmware update software.
Mobile forensics is a very fluid field and capabilities are constantly changing. What cannot be recovered one month is suddenly available the following month. Data analysis is constantly evolving so sometimes running an old dump through a new version of software can yield more data or put a different spin on the existing data. Because of the “closed” nature of the industry discussed previously, development of new tools to get data from devices relies on reverse-engineering or “hacking” devices, the fruits of which often end up being incorporated in future forensic software tools.
No two phone models are the same to examine and indeed the examination of two identical phone models can give very different examination results. When brand new, out of the box, two phones will be identical, but then the user of each adds apps and uses or ignores standard features of the phone. The phones are identical, but from a data perspective, can be vastly different. For the examination of apps on locked-down devices such as iPhones we are at the mercy of whether or not the apple operating system (iOS) allows the app to put back-up data outside the locked-down area of the device. If it does not, however, although you will be able to see the data by looking at the app on the phone, you cannot get at it electronically.
​
​
What can we do to assist the defence?
​
Whilst providing all the same services as a mobile phone forensic scientist for the prosecution, often we can help fill in the picture, or rather demystify the jury as to the claims the prosecution have made. Many a time they can cherry pick images or texts out of context which can put a discriminating spin on the situation, however, our scientists are there to provide the jury with the full story, which can drastically alter the outlook.
​
As mentioned, it is not always easy or straight forward to obtain such data and our mobile forensic scientists can help debunk theories that it is as simple as getting hold of a phones internal hard drive in order to access all information. This is helpful as it reduces the strength of mobile phone evidence from the prosecution as it throws doubt onto how reliable such data is.