What will forensics analysis of devices show?

Olliers’ Hannah Poole considers the analysis of electronic devices in the context of indecent image investigations

The question, can the police retrieve and recover files once deleted extends to how far back can they retrieve such documents? A focal point and area of concern for individuals who have been accused to be in possession of indecent images or to have created images of this nature. In order to analyse individual devices, the police will obtain a warrant for seizure of the individual’s equipment which is believed to hold indecent, extreme pornographic or prohibited material. Enabling them to gather such evidence which connects to the making or possessing of the indecent images of children. Such analysis of the items seized is a process which is extensive and can last some 6-12 months. Once obtaining the results from analysis, these results will be reviewed by an officer to the case, whereby a decision will be given to the grading and specific category to the material found. 

Accessibility of images

On a device being seized, an examination will assess whether these images were accessible or inaccessible to the user, significantly impacting the charges which could follow. If the images are accessible to the user, this individual will run the risk of being charged in possession of indecent images. Alternatively if they are inaccessible, it may result in a charge of making the indecent images.  Possession encompasses both a physical and mental element. The physical element, that a person must have ownership and control of the photographs. The mental, is the knowledge to these photographs – the individual must knowingly have ownership and control of them. It is unnecessary for the prosecution in this instance to prove that the individual knew the photographs in his possession were indecent images of children.  Prosecutors will bear in mind what needs to be proved regarding the possession of the images. This will depend;

• On the location of the images on the device;
• How the images came to be located there;
• How accessible the images are in the location without specialist knowledge or software. 

An example of this would include the individual viewing an image on their device, which then automatically is cached onto the device’s memory, they would not be in possession of that image unless it could be proved that they knew of the cache.

Child Abuse Images Database (CAID)

If found and to ensure the police on analysing the images have graded the images properly, experts will operate through known database CAID – Child Abuse Images Database to ascertain the type of image found on that device. If discovered, it raises the concern as to whether the owner of the device was aware of the presence of the images, and the ease of access to these.  Experts will assess whether search engines have also been used to obtain such images or whether the images stored have been moved to default or stay in downloaded folders. Moving from one folder to another suggests to the expert and ultimately the prosecution that there is a knowledge and awareness to the existence of these files containing the images, fundamentally impacting a charge if one is to follow. 

Can deleted files be recovered and how far back can this stretch? 

If a particular file has been deleted, depending on the size, this file transfers to the recycle sleeve if the device is a computer. Once this is emptied, the contents are no longer accessible to a regular user but still retrievable to the expert. However when using a computer, data can regularly become overwritten by new material and when analysing the results, only half whether it be a picture or document in some cases can be retrieved. The same applies to those operating from mobile devices and the time frame to retrieving these deleted files proves to be indefinite.  

How does the forensic analysis work?

Once the police have utilised the specialist Forensic Analysis companies, a Streamlined Forensic Report or a prosecution report will be produced. The report generated will include information on the quantity of the images found, whether these were accessible on the device and any indicative terms searched for. Fundamentally, the report will determine whether any illicit material has been traced on the device.  Indicative terms searched generally within Streamlined Forensic Report’s is earmarked for phrases that suggest the searching of indecent material. Despite there not being a definitive list of search terms, there are certain distinguished phrases which are both prevalent and recognised to both the defence and prosecution.

How can Olliers help me?

At Olliers we regularly speak to clients who have had computer equipment and phones seized by the police. On the one hand it is a waiting game but there is still a lot that can be done. We always ensure that we make early contact with the police. We will confirm the anticipated timeframe for the investigation with the police and obtain an assurance that any further contact will be through Olliers, ensuring that there is no embarrassment caused by a police visit to home or workplace. We can discuss with our clients the circumstances that may have led to their material being seized. We will give our clients an opportunity to discuss any anxiety they may feel. Many want to discuss worst case scenarios and we can advise on the different offences of possessing, distributing and producing indecent images. We can also explain the different categories of offences as well as current sentencing guidelines. If you are under investigation for offences relating to indecent images please contact Ruth Peters by email to ruthpeters@olliers.com or by telephoning 020 3883 6790 or 0161 8341515 and we can arrange a confidential discussion as to how Olliers can assist you at this time.

Article written by Hannah Poole