Computer Forensics Case Study

CYFOR were formally instructed by criminal law specialists Fieldings Porter to provide computer forensics expertise in an indecent imagery case.

Case Background

The client of Fieldings Porter was charged with possession of indecent imagery, possession of extreme imagery and possession of prohibited imagery. The offending images were identified on various computer equipment seized from the client’s personal address. The defendant stated that they had no prior knowledge of the imagery in question and stated that he received the computer equipment from someone else, now deceased, prior to moving to his current address.

Digital Evidence

The following devices were provided for forensic imaging. This is an exact copy of the original data, which can then be used as admissible evidence in court:

• 4 desktop computers;
• 1 Hard disk drive (HDD);
• 2 USB thumb drives;
• 1 SD card;

Instructions

CYFOR were instructed to examine the devices and undertake an investigation with regard to accurately dating when the images were accessed, viewed and downloaded. This included an attempt to ascertain if there was an indication of who may have accessed or downloaded the images, as well as any concurrent computer usage which pointed to who may have been using the devices at the time. Instructions also included whether peer to peer sharing had occurred and whether any particular IP address could be linked to the unlawful images.

Digital Forensic Process

The exhibits were securely collected and transported to CYFOR’s forensic laboratory via our in-house courier service. Our digital forensic investigators were then able to examine, identify and reconcile the indecent imagery across the digital devices. This included the implementation of a concise keyword, file and internet activity review across the four desktop computers. The digital forensic examination was then correlated and reviewed against the prosecution papers, culminating in the production of a detailed court-ready report.