 |
Graham Dilloway MBCS Computer Consultant and Expert Witness |
|
Graham Dilloway MBCS Computer Consultant and Expert Witness |
| Background of Report on Dates, Hacking and Contamination | « Previous Report | Next Report » |
| The Defendant, Mr D, was charged with
indecent assault. Mr D's computer was seized and was found to
contain images of children. Mr D's counsel was of the view that
the witness testimony regarding the assault was not adequate to secure a
conviction and that the prosecution needed their case to include
evidence of the images found on the computer. The prosecution
evidence included about a dozen "samples" of the images found
on Mr D's computer. Mr D was not charged with regard to these
images.
At an early hearing, the police informally gave the defence solicitors a full listing of Internet accesses from Mr D's computer. The solicitor's understood this report to show the dates and times that Mr D's computer had been used to access the Internet. Mr D was able to provide strong evidence to show that he was not at home for many of the dates and times in the police report. My instructions were to examine Mr D's computer and prepare a report of the dates that the computer had accessed the Internet to provide confirmation of the police report. I inspected the computer and prepared a report. At a subsequent meeting with counsel, I was shown the police report for the first time and was initially embarrassed to find that the dates in my report were different to the dates in the police report. Subsequent investigation showed that the dates in my report were correct and that there had been a misunderstanding regarding the dates in the police report. I was asked to prepare a second report to clarify the various dates being quoted regarding Internet access. Mr D did not have alibis for the correct dates of Internet access. Mr D continued to deny responsibility for the images on his computer and suggested that the images must be the result of someone "hacking" into his computer or of contamination after the computer was seized. I was asked to investigate hacking and contamination and prepared an letter that showed that hacking and contamination were not at all likely. At a pre-trial hearing, defense Counsel argued to minimise the effect of the evidence regarding images on Mr D's computer. I gave evidence on the second day of the hearing to clarify any misunderstandings that may have arisen on the first day. |
| Note: This report
is reproduced exactly as it was when served excepting that company and
personal names have been removed.
Personal 1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts and of the Expert Witness Institute. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than fifteen years. Instructions
Internet History 7. Typically, a person using a computer to read pages of information and images from the Internet uses a program called a browser. The browser stores information about the pages that are being viewed and this information is stored in various places on the computer. 8. Information is stored in a folder usually called Temporary Internet Files that is often referred to as the cache. The information in the cache is used when a particular page is viewed on a second or subsequent occasion to avoid the delay involved in again obtaining the information from the Internet. 9. The pages in the cache may be deleted automatically by the browser to make room for more recent pages. The pages in the cache may be deleted manually by the person using the computer. The cache may not contain all of the Internet pages that have been viewed on the computer. 10. Information is stored in a folder usually called History. This information is an identifying record for every page on the Internet that has been viewed. Typically, the History folder contains information for every page viewed during the four weeks prior to the most recent use of the browser. Additionally, the History folder contains information about accesses to some of the files stored on the hard disk of the computer. 11. The software used by the police during their examinations of computers is called EnCase. One of the functions of EnCase is to merge the content of the cache and History folders to show all references to Internet pages for which information is still available on the computer. This merged information also includes references to accesses of some of the files stored on the hard disk of the computer. Mr W used EnCase to create a set of merged files and I received the files on 29 July 2002. 12. The merged files were in a format that allowed me to read the files in to the Excel spreadsheet program and the Access database program. I read all of the files into a single spreadsheet that then contained all of the Internet access information provided by Mr W. 13. The file created by EnCase includes a column headed "User Accessed" that indicates the most recent date that a computer user accessed the file. This date is a strong indication that the computer was connected to the Internet on that date. 14. Using Excel and Access, I have created a list of the "User Accessed" dates that have an entry including the text "http". These are the dates for which there is one or more records of an access to material on the Internet:
Sealink Booking
E-mail from name-deleted.com
Hacking and Unauthorised Access
Summary
|
