Athena Forensics Blog Articles, written by our Forensics ExpertsClick here to return to our Blog index
In a Changing World New Evidence Brings New Challenges
According to sources, pornography accounts for 68 million daily Internet searches (25% of all Internet searches), 12% of websites and 1.5 billion downloads a month. The sheer volume of people seeking such material is surprising. However, computers are a discreet, cheap and relatively effective method of accessing such material. The Internet allows users to freely share and download any type of pornography through a number of different sources including from commercial sites, where access is likely to cost money, or darker less well known areas of the Internet, where access is likely to be free.
Whilst we are not limited to such cases, the most common aspect of my work within criminal cases involves those where the Defendant has been charged with offences relating to pornography. For a number of years, a computer related pornographic offence normally involved the existence of indecent images of children, however, since its introduction as an offence on 26th January 2009, Athena Forensics have received instructions for a number of cases that include offences relating to extreme pornography.
Both types of material are freely available from a variety of Internet sources including websites and peer-to-peer software. The most common issues for a forensic investigator involved in cases of this type relate to the manner in which they were created on an item of evidence. Clearly, the existence of them on an individual's computer can be as a result of them being deliberately stored and this accounts for the majority of cases when the evidence is not contested. However, the mere existence of such files does not necessarily mean that they had been stored deliberately or that the user had intentionally sought them and exploring this possibility is one that is the most important and sometimes the most difficult within cases involving this type of evidence.
Over the past few years the use of peer-to-peer software has continued to increase allowing users to gain a variety of material, whether it be music, movies or pornography, from a single source. Basically, peer-to-peer software allows a group of user's to share files that are contained within designated 'shared' folders on their computers with one another over the Internet. The content of those files is limited to the content of the folders that are 'shared' by others. Whilst downloading can be varied in quality and speed, the increase in users makes it a more viable source of material and with an increase in use brings an increase in cases involving software of this type. There are a number of ways in which user's can isolate and download material from these sources; however, there are also a number in which files can be downloaded without a user being aware of the specific content of a given file.
Recently, I was instructed in a case that involved the downloading of files via peer-to-peer software called eMule and a number of images that were located within deleted areas of the hard drive. The Police had identified a number of partially and fully downloaded indecent images of children and a number of 'text fragments' relating to similar material.
The Defendant claimed, in relation to the eMule software, that whilst he had occasionally encountered files that displayed 'File Names' with references to indecent images of children, this had been during the pursuit of adult pornography and he had not deliberately downloaded any unlawful material. He was not aware of the presence or origins of any of the relevant material within the deleted areas of the hard drive.
During the investigation of the case, an examination was conducted of the hard drive and noted that, whilst a number of indecent images were within the deleted areas of the hard drive, they were within a close group of files within that region of the drive. It was then also possible to recover a web page that was found to have previously contained the images and identify that the page had contained both indecent images of children and adult pornography.
In addition to this, along with an examination of the evidential hard drive, the types of files that were available for download via eMule. The relatively basic manner in which the software identifies search results from a search string (keyword) can cause user's to be provided with results that may differ significantly in content from the material that was expected and even when downloaded the description given to a file can vary greatly from its content. The operation of the software allows users to download specific files individually or as part of a group of files.
When a search for a generic adult pornographic related term was conducted ('nudist') over 600 results were returned of files that were available at the time. The names of the files returned were reviewed and approximately 10% were noted to contain references that were indicative of potentially containing indecent images of children. As these files are only viewable once they have been downloaded (whether it be partially or fully downloaded), the content of them could not be confirmed. However, clearly, there is a possibility that a user would be able to conduct a search for adult related material and then download the results as a group. The majority of files downloaded are likely to have related to the material sought, however, a significant portion may have comprised of unlawful material that was unrelated to the search.
A review of the evidence was conducted and this identified that the time/date stamps of files that were contained on the evidential hard drive also supported the assertion that images had been created as a result of a download that predominantly comprised of adult pornography. The partially downloaded files were noted to have been likely to have either been halted from downloading or were unavailable, in any event they had not completed. The report that followed resulted in the Prosecution dropping the case pre-Trial.
This case is not an exception. This year, we have seen an increase in the number of cases where, when questioned and given a suitable level of examination and investigation, have been found to be based upon evidence that does not provide the level of proof necessary for the Court. The investigation carried out by Police is governed by budget and, therefore, limited time is spent on any given case even though the findings of these examinations sometimes form the basis of the proceedings.
Whilst it is not particularly difficult to identify evidential data such as that found in these types of cases, it is difficult to trace the steps in which that evidence had taken during creation and to identify whether that evidence had been deliberately or unintentionally created. This part of an investigation requires time and that time is being increasingly governed by budget.
Increasingly we see individuals or companies instructed purely based on price rather than experience or ability. It is possible for anyone to reduce costs by limiting work on a case, however, what would the result be as far as leaving key evidence to go undetected? Is the evidence simply being processed or is it actually being examined and investigated?
Whilst the case mentioned above is not one that we would classify as particularly technical it is one that, if the evidence is not given the correct level of investigation, key points would be missed. Particularly in cases of this type, when a suspect claims that evidence produced by Police is incorrect a level of disbelief is often received whether those claims are valid or not. Without a correct level of investigation, any supportive evidence will go undetected and that would seem to be a regression of Justice.
Director, Senior Forensic Consultant and Expert Witness at Athena Forensics