1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15
3AW. I am a Member of the British Computer Society, the chartered
professional body for the computer industry in the UK. I am a member of
the Academy of Experts. I have worked with computers for more than 30
years. This work has all involved the implementation and configuration of
computers, their operating systems and the core software applications of a
computer environment (e.g. word processors and spreadsheets). I have
worked with personal computers almost exclusively for more than twenty years.
2. My instructions have been discussed with S Solicitors and I understand my
instructions to be that I should prepare a report discussing the evidence
regarding access to and use of a computer that I understand to have belonged to
Mr D..
3. I received items from S Solicitors and from the Serious and Organised Crime
Agency that include:
· Witness statement of Mr B dated 30 July 2010
· CD Exhibit 2 and CD Exhibit 1.
4. In his statement dated 30 July 2010, Mr B says, at Page 656, "I
identified there was no password associated to the profile 'I', since the
profile is not password protected this would mean that any user with access to
the computer would be able to access the data and software programs …"
5. From Mr B's description of the computer and of the profile "I", I
would expect that a password would not be requested when the computer is
switched on. I would expect that it would be possible to switch on and use
the computer without any knowledge of the computer's owner or other users.
6. In his statement dated 30 July 2010, Mr B lists the names of various files
and other information obtained from the computer. For example, the top of
Page 660 lists files and the lower part of the same page lists information
described by Mr B as being from "Internet History". The name
"I" appears in the names of the files and in the "User"
column of the Internet History.
7. From Mr B's description of the computer and of the profile "I", I
would expect that the default action of the software on the computer would be to
associate the creation of files and other actions with the user name
"I". I would expect that it would be possible to switch on and
use the computer and for any such use to be associated with the user name
"I".
8. In his statement dated 30 July 2010, Mr B says, at Page 673, " … a
user had booked return flights from London Gatwick to Alicante for 'PH' …".
This may be evidence that the computer is being used by a person other than Mr D.
9. I have seen nothing to show that the inclusion of the name "I" in
the names of folders and elsewhere is evidence that the computer was being used
by someone called "I".
10. The files found by Mr B and exhibited on CD Exhibit 2 are in two categories:
· User created documents - These are documents created by somebody typing at a
computer keyboard and using software such as Microsoft Word and Excel to create
documents.
· System created files - Software automatically creates files that are used to
ease or to speed up the operation of the computer. An example of a system
created file is a "link" file as described by Mr B at Page 658 of his
statement dated 30 July 2010.
11. Only one of the user created documents on CD Exhibit 2 appears to have been
deliberately saved on the computer. The document called "latest
A&L_statement_p(1).xls", and described by Mr B at Page 657 of his
statement dated 30 July 2010, is saved in a folder that is consistent with the
document having been created and saved on this computer.
12. I have seen no evidence to show that any of the user created documents
referred to on CD Exhibit 2 were created, edited or stored on the computer with
the exception of the "latest A&L_statement_p(1).xls" spreadsheet.
13. In his statement dated 30 July 2010, Mr B says, at Page 667, " …
these documents had been created on a version of Microsoft Publisher that had
been registered in the name 'PH'". Other files are described in a
similar way on Pages 666, 664 and 669.
14. I would expect that "Microsoft Publisher that had been registered in
the name 'PH'" would be on a computer belonging to person named PH.
15. I would expect that documents that had been created with "Microsoft
Publisher that had been registered in the name 'PH'" would have been
created on a computer belonging to a person named PH.
16. It is my understanding that all of the material on CD Exhibit 2 is alleged
to be related to the illegal importation of drugs. It is also my
understanding that the material on CD Exhibit 1 includes material related to
legitimate business enterprises.
17. I have prepared a table that shows some periods of computer activity based
on date times from CD Exhibit 2 together with examples of documents that are not
on CD Exhibit 2. The table shows periods of alleged drug related activity
in the two leftmost columns. The rightmost columns show dates, times, file
names and a description of file content for files that have been accessed at
about the time of alleged drug related activity. It is my understanding
that the files in the rightmost columns are related to legitimate business
enterprises.
Time and subject of computer activity from CD Exhibit 2. Example of document
not present on CD Exhibit 2.
Table content omitted.
The same document appears twice in the table because documents are duplicated on
the computer or because documents have different created and modified
dates.
18. From Mr B's description of the computer and of the profile "I", I
would expect that a password would not be requested when the computer is
switched on. I would expect that it would be possible to switch on and use
the computer without any knowledge of the computer's owner or other users.
19. I have seen nothing to show that the inclusion of the name "I" in
the names of folders and elsewhere is evidence that the computer was being used
by someone called "I".
20. I have seen no evidence to show that any of the user created documents
referred to on CD Exhibit 2 were created, edited or stored on the computer with
the exception of the "latest A&L_statement_p(1).xls" spreadsheet.
21. I would expect that documents that had been created with "Microsoft
Publisher that had been registered in the name 'PH'" would have been
created on a computer belonging to a person named PH.
22. I understand my duty to the Court and I confirm that I have complied with
and will continue to comply with that duty.
23. I confirm that insofar as the facts stated in my report are within my own
knowledge I have made it clear which they are and I believe them to be true, and
that the opinions I have expressed represent my true and complete professional
opinion.
Graham Dilloway 1 October 2010
39 Conham HillBristol BS15 3AW