Computer Forensics in Scotland: Why would I need an independent review of expert evidence?

On many occasions, an independent expert review of evidence will reinforce the findings already set out by the prosecution. This, in itself, has value as it can assist the Court in early pleas and negating the need for a trial. However, given the complexity of digital forensics, an independent review can also highlight undiscovered issues that are directly relevant to the case in hand. Three recent cases exemplify the benefits of an independent review of the prosecution analysis of the evidential material in Scotland. All those cases were in relation to the alleged making of Indecent Images of Children.

Case study 1

In the first case, it was identified that a user had undertaken some rather ill-advised internet searches, which had resulted in the downloading of a number of images that had been promptly deleted by the user. A detailed examination of the Wi-Fi connection history of the device in question identified that none of this activity had occurred within the jurisdiction of the Scottish Court, and that no user-accessible image had been brought back to Scotland. The case was abandoned by the prosecution.

Case study 2

The second examination established by a full analysis of the internet history that, on a single occasion, the user had used the default Windows search engine to look for naturist images. Such a search would be wholly lawful. This led them to a site which declared itself plainly to host only lawful material but, on entering the site, they were presented with unlawful images. They did not knowingly download any illegal material and promptly exited the site. What did happen was the images were automatically downloaded to the browser cache which is an area inaccessible to the user. In effect, the user had been misled by statements made on an apparently lawful website and once they discovered this wasn’t the case, they left that site immediately. The case was stopped at the direction of the Procurator Fiscal.

Case study 3

In the final case the user had amassed an extremely large collection of material, mainly videos, that related to a lawful, but somewhat esoteric, form of adult erotica. Whilst seeking such material, a very small quantity of unlawful material had been downloaded. It was identified that each of those images bore a file name relating to the type of adult material sought but had a different type of content. Only one potential user access to any one of those files was identified and from analysis it was established that access to this video could not have been viewed for longer than eight seconds. What was critical is that the unlawful nature of that video would not have become apparent until over two minutes of its content had been viewed. This (together with a number of other evidential factors) supported the assertion of the user that he was unaware of the existence of unlawful material, had not sought it, and had not watched it. The case was stopped at the direction of the Procurator Fiscal.

Thinking again about whether you need an independent review?

In each of these cases. the prosecution examiners had performed competent examinations of the evidence and provided reports that reflected the evidence discovered and sufficient to “prove the case”. These examinations tend to concentrate on the “highways” and do not always explore the “bye-ways” that hold the additional scraps of evidence that can provide a different perspective on what has occurred. It is often the defence team who will push for further analysis to explore both the accuracy of the images recovered but also additional context that may be hidden in deeper layers of examination.

The penalties for this type of offence can be severe, and the reputational damage can be catastrophic. What may seem like cut and dried evidence when it comes to unlawful material can still have different expert interpretations when it comes to the classification, access and provenance. Our role as independent experts is to ensure that all the evidence has been appropriately explored.

Get in touch

Ross Donnelly, Steve Guest and Luke Wilkins form the Computer Forensics team at Keith Borer Consultants. They can be contacted on 0191 332 4999 or by email at kbc@keithborer.co.uk.