Dear S,

It is possible to draw conclusions about the likelihood that Mr D's’ computer was a victim of "hacking".

Mr D mentioned, at our meeting last week, that the computer was usually switched off when not in use, that there was no telephone answering software operating on the computer and that there was a conventional telephone answering machine connected to the telephone line.

Remote access to the computer would require that the computer be switched on and that a telephone connection would need to be open between the computer and the Internet or directly to another computer. Any attempt to establish a telephone connection with Mr D's computer by dialing in to it would fail because the call would be answered by the answering machine or by someone in the house.

For hacking to be successful, it would need to occur when someone in the house connected the computer to the Internet.

The History and Cache from the computer includes this sequence of Internet accesses:

The table shows five records of access to deleted-1 and then a jump to deleted-2. It may be that deleted-1 included a link to deleted-2 and the jump occurred when someone clicked on the link.

The third access to deleted-2 is a page called join.html. This is followed by five accesses to a site called site-key. It may be that the site-key site allows access to restricted areas on sites (by providing a "key" to the "site"). The rest of the table is records of access to deleted-2. It may be that credit card details were provided at site-key to allow access to deleted-2. The possibility that this occurred as a result of hacking could be established by the examination of credit card records.

A later sequence of records:

The first three records show the end of one Internet session at about 16:20. The next few records show a new Internet session starting at about 17:35 with a visit to jungle (a well known Internet shop). At 17:44 we see a sequence of accesses to deleted-2. It may be that a hacker was able to access the computer during the ten minutes of browsing at jungle, that the computer was accidentally left switched on and connected to the Internet and that the hacker was able to begin browsing deleted-2 by remote control. 

Another sequence:

Here we see the end of the earlier session of browsing at 17:52 and the start of a new session at 20:24. The 20:24 session begins at deleted-2. If the computer was disconnected from the Internet at 17:52, it would not be possible for a hacker to begin browsing at deleted-2 at 20:24. It may be that the computer was left switched on and connected to the Internet from 17:52 until 20:24 and the hacker was able to restart remote control at 20:24.

And again:

Here we see one session end at 20:28 and a new session begin 11:47 the next day. It may be that the computer was left switched on and connected to the Internet overnight. 

I counted six further sessions on 4^th, 5^th and 6^th of January that begin with accesses to either deleted-1 or deleted-2. For a hacker to be responsible for all of these sessions, it would require that the computer should have been left connected to the Internet almost continuously for three days or more. There are other sessions through to the end of January that begin with access to deleted-1 or deleted-2.

From the evidence that is available to me, it is my opinion that the accesses to deleted-1 and deleted-2 (and the searches for "naked children" etc) were not the result of hacking.

It is possible to draw conclusions about the likelihood that Mr D's computer was a victim of contamination.

Earlier I described what appeared to be a subscription to deleted-2 via site-key and I suggested that the subscription involved a credit card transaction. The absence of any corresponding credit card transaction would be consistent with contamination. The presence of a card transaction would not be consistent with contamination.

The email confirming a subscription to deleted-1 cannot be as a result of contamination because the dates in the email were put there by computers on the Internet and not by Mr D's computer.

For the numerous accesses to deleted-1 throughout January to have been the result of contamination, it would be necessary to opened the email software on Mr D's computer and to have searched for and then read the email from iwest.org confirming the subscription. It is quite possible that the email was read after the computer was seized. It may be thought a coincidence that the email was opened and searched and that an email confirming the subscription was found.

For the numerous accesses to deleted-2 throughout January to have been the result of contamination if the subscription via site-key was not contamination would require some effort. It would have been necessary to open the browser software on Mr D's computer and to have searched the Internet history or the Internet cache to find the web page that refers to the subscription. It may be thought a coincidence that the browser history or cache was searched and that a reference to deleted-2 was found.

A summary of all sessions accessing deleted-1 and deleted-2 (and what appear to be attempts to find indecent images of children by searching the Internet):

In addition to more than seven hours required to falsify the entries shown in the table, time would be required to repeatedly reset the clock and to reset file dates to restore the computer to show that it was last used before it was seized. I estimate the additional time to be about four hours. The total time required to create this amount of contamination is likely to be about twelve hours.

It may be thought that twelve hours is an excessive amount of time to have been spent contaminating evidence.

On 24 January 2001, an Internet session begins at 22:36 with accesses to scan.co.uk, an Internet shop. At 22:48, the accesses change to jungle.com, another Internet shop. At 22:58, the accesses change to deleted-2:

If the accesses to scan and jungle were not the result of contamination and the accesses to deleted-2 were contamination then it would have been necessary to access the Internet cache to find the time of the last access to jungle. It would then require a precise reset of the date and time and a precise start to the accesses to deleted-2 produce the close time values shown in the above table.

It seems unlikely that the accesses to scan and to jungle and to deleted-2 were all the result of contamination because the accesses to scan and jungle are unlikely icing on the cake.

It seems unlikely that the access to deleted-2 are the result of contamination if the accesses to scan and jungle are not because of the effort required to produce the close time values.

In cop shows on television, the police are able to obtain detail records of telephone calls from telephone companies. I have no knowledge that such records can be obtained in the real world. It may be that telephone records would show that Internet calls did or did not occur at the times shown above for accesses to deleted-2 and to deleted-1. It seems unlikely that anyone would knowingly contaminate the computer after it was seized if they knew that telephone records would reveal the contamination.

I found nothing to suggest that contamination had occurred. It seems likely that the subscriptions to deleted-1 and to deleted-2 were not the result of contamination because they can easily be shown to be contamination by credit card records. It seems unlikely that anyone would search email and the history or cache prior to contaminating the computer. It seems unlikely that anyone would spend about twelve hours contaminating the computer when far less time would provide evidence of equal value. It seems unlikely that the accesses on 25 January were the result of contamination because of the apparent overkill. It seems unlikely that contamination would have been attempted when there is a risk that the contamination could be exposed by the examination of telephone records.

I found no technical evidence to show that contamination has not occurred (but it may be that it is tricky to prove a negative). An examination of the computer may reveal contamination. If no contamination occurred, no amount of examination will find anything to suggest that it did. It is my opinion that an examination of the computer for evidence of contamination cannot be justified. I am willing and able to undertake an examination if instructed to do so.

And finally, some Health Warnings:

· I am confident that the dates, times and other values in this report are correct but they have not been re-checked as they would be if this were a report to be used in evidence.

· The dates and times used are Last Access values. It is quite possible that the some (or many) items were accessed one or more times prior to the Last Access date and time shown and that there is no record of these previous accesses.

· The history and cache files that provided this data are maintained automatically by the computer and any amount of information may have been deleted by this automatic process.

Yours sincerely

Graham Dilloway