Graham Dilloway MBCS

Computer Consultant and Expert Witness

Note:   This report is reproduced exactly as it was when served excepting that company and personal names have been removed.

Personal

1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts and of the Society of Expert Witnesses. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years.

Instructions

1. My instructions have been discussed in conferences with S Solicitors and I understand my instructions to be that I should prepare a report discussing the evidence of illegal material and the evidence of intent to obtain illegal material.
   
2. I received a bundle of documents from S Solicitors with a covering letter dated 8 January 2009. This bundle included:

• Forensic Examination Report prepared by Sgt. G and dated 18 May 2007.
• Transcript of an interview on 24 October 2007.
• Transcript of an interview on 8 December 2006.

Report of Sgt. G

1. In his report dated 18 May 2007, Sgt. G describes the results of his examination of various Exhibits.
   
2. At Para. 1.6 of his report dated 18 May 2007, Sgt. G describes the content of the folder C:\Documents and Settings\J\Shared on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt. G says that the folder contains four movie files that are episodes of South Park and one illegal movie file. Sgt. G says, of the illegal movie file, "… was deleted on 27 Nov 06…"
   
3. At Para. 1.6 of his report dated 18 May 2007, Sgt. G describes the content of the folder C:\Documents and Settings\J\Shared on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt. G says that the folder contains a thumbs.db file and describes the file, "… is usually hidden from the user as it is only in use by the operating system." I have seen no evidence to show that the content of this thumbs.db file refers to files that existed on the computer when the computer was seized.
   
4. I do not know of any way that someone using a computer can access the content of a thumbs.db file, when the content refers to files that have been deleted, without the use of specialised software that is not usually found on a computer. I have seen no evidence to show that specialised software that could access the content of a thumbs.db file was found on computer KG/01.
   
5. At Para. 1.8 of his report dated 18 May 2007, Sgt. G describes the content of the folder C:\Documents and Settings\J\Incomplete on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt. G says that the folder contains "… 3 files that are deemed to be innocuous, a thumbs.db folder and 22 files that has suspicious titles and had been deleted." Para 1.9 clarifies that Sgt. G is referring to a thumbs.db file (not a "folder").
   
6. At Para. 1.10 of his report dated 18 May 2007, Sgt. G describes the content of the Recent folder on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt. G says that the folder contains "… small files that merely contain the location of other files". The files in the Recent folder do not contain illegal material but may point to the location of a file of illegal material and that file of illegal material may still exist or may have been deleted.
   
7. At Para. 1.11 of his report dated 18 May 2007, Sgt. G describes Lost files on Exhibit KG/01 (a laptop computer seized in Bahrain). Sgt. G says, of Lost files, "Files that have been deleted but not over-written may become lost …"
   
8. At Para. 2.4 of his report dated 18 May 2007, Sgt. G describes the content of the Administrator Recent folder on Exhibit JPC/81/7/12/10 (a hard drive seized in Yorkshire). Sgt. G says, "The recent folder for the Administrator Account was found to have been deleted on 12 Aug 06." Sgt. Gibson says that the folder contains "… deleted .lnk files" .lnk are the files that Sgt. G describes as "small files that merely contain the location of other files"
   
9. At Para. 2.5 of his report dated 18 May 2007, Sgt. G describes the content of the Recovered Deleted Incomplete Folder on Exhibit JPC/81/7/12/10 (a hard drive seized in Yorkshire). Sgt. G says, of this folder, "… had been deleted …" and, of the files in the folder, "... the following deleted files".
   
10. At Para. 2.6 of his report dated 18 May 2007, Sgt. G describes the Examination of Recycle Bin on Exhibit JPC/81/7/12/10 (a hard drive seized in Yorkshire). Files that I delete on my computer are automatically sent to the Recycle Bin. I can recover files from the Recycle Bin if I later discover that I deleted them by mistake.
    
11. At Para. 3.1 of his report dated 18 May 2007, Sgt. G describes the content of the C:\DUMP\thumbs.db file on Exhibit JPC/81/7/12/21 (an external hard drive seized in Yorkshire). I have seen no evidence to show that the content of this thumbs.db file refers to files that existed on the drive when the drive was seized.
    
12. At Para. 3.2 of his report date 18 May 2007, Sgt. G describes the content of the Recycle Bin on Exhibit JPC/81/7/12/21 (an external hard drive seized in Yorkshire). Files that I delete on my computer are automatically sent to the Recycle Bin. I can recover files from the Recycle Bin if I later discover that I deleted them by mistake.

Interviews

1. In the transcript of the interview on 24 October 2007, Mr D says, at the middle of Page 4, "… I didn’t want to see them so I just deleted them …"
   
2. In the transcript of the interview on 8 December 2006, Mr D says, at the top of Page 78, "… once ascertained what the nature of the file was, the file would be closed and then deleted …".
   
3. I have seen no evidence to show that files containing illegal material were not deleted.

Timescales

1. At Para. 1.6 of his report date 18 May 2007, Sgt. G says, of the file of illegal material in folder C:\Documents and Settings\J\Shared on Exhibit RG/01 (a computer seized in Bahrain), "… file was created on Exhibit KG/01 on 25 Nov 06 at 15.56 hours and was deleted on 27 Nov 06 at 16.59 hours."
   
2. At Para. 3.2 of his report date 18 May 2007, Sgt. G says, of the Recycle Bin on Exhibit JPC/81/7/12/21 (an external hard drive seized in Yorkshire), "The Recycle Bin was found to contain 145 picture files that were created between 28 Feb 06 at 1815 hours and 2300 hours. The files were last accessed on 01 Mar 06 at 0024 hours …." Sgt. Gibson appears to be saying that the files were deleted no more than a few hours after they were created.

Intent

1. I have seen no evidence to show that Mr D searched for illegal material on the Internet.

Summary

1. I have seen no evidence to show that specialised software that could access the content of thumbs.db files was found on the Exhibits.
   
2. I have seen no evidence to show that the content of the thumbs.db files referred to in Sgt. G’s report refer to files that existed on the Exhibits when the Exhibits were seized.
   
3. I have seen no evidence to show that files containing illegal material were not deleted.
   
4. I have seen no evidence to show that Mr D searched for illegal material on the Internet.
   
5. I understand my duty to the Court and I confirm that I have complied with and will continue to comply with that duty.
   
6. I confirm that insofar as the facts stated in my report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.