Digital Evidence in Criminal Cases Computer & Mobile Phone Forensic

Lndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gPiAudGItZ3JpZC1jb2x1bW46bnRoLW9mLXR5cGUoM24gKyAxKSB7IGdyaWQtY29sdW1uOiAxIH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gPiAudGItZ3JpZC1jb2x1bW46bnRoLW9mLXR5cGUoM24gKyAyKSB7IGdyaWQtY29sdW1uOiAyIH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gPiAudGItZ3JpZC1jb2x1bW46bnRoLW9mLXR5cGUoM24gKyAzKSB7IGdyaWQtY29sdW1uOiAzIH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gLmpzLXdwdi1sb29wLXdyYXBwZXIgPiAudGItZ3JpZCB7IGdyaWQtdGVtcGxhdGUtY29sdW1uczogbWlubWF4KDAsIDAuMzMzM2ZyKSBtaW5tYXgoMCwgMC4zMzMzZnIpIG1pbm1heCgwLCAwLjMzMzNmcik7Z3JpZC1hdXRvLWZsb3c6IHJvdyB9IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdIC50Yi1tYXNvbnJ5IHsgZ3JpZC10ZW1wbGF0ZS1jb2x1bW5zOiBtaW5tYXgoMCwgMWZyKSBtaW5tYXgoMCwgMWZyKSBtaW5tYXgoMCwgMWZyKTtncmlkLWNvbHVtbi1nYXA6IDVweDsgfSAud3B2LXZpZXctb3V0cHV0W2RhdGEtdG9vbHNldC12aWV3cy12aWV3LWVkaXRvcj0iNWFmMzExMjEwNzYxZWVhOTQwY2YxMTI4ZDg3ODVmN2QiXSAudGItbWFzb25yeSAudGItYnJpY2tfX2NvbnRlbnQgeyBwYWRkaW5nOiAwIDAgNXB4IDA7IH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gLndwdi1jb2xsYWdlIHsgZ3JpZC1jb2x1bW4tZ2FwOiAxNXB4O2dyaWQtcm93LWdhcDogMTVweDsgfSBAbWVkaWEgb25seSBzY3JlZW4gYW5kIChtYXgtd2lkdGg6IDc4MXB4KSB7IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdID4gLnRiLWdyaWQtY29sdW1uOm50aC1vZi10eXBlKDNuICsgMSkgeyBncmlkLWNvbHVtbjogMSB9IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdID4gLnRiLWdyaWQtY29sdW1uOm50aC1vZi10eXBlKDNuICsgMikgeyBncmlkLWNvbHVtbjogMiB9IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdID4gLnRiLWdyaWQtY29sdW1uOm50aC1vZi10eXBlKDNuICsgMykgeyBncmlkLWNvbHVtbjogMyB9IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdIC5qcy13cHYtbG9vcC13cmFwcGVyID4gLnRiLWdyaWQgeyBncmlkLXRlbXBsYXRlLWNvbHVtbnM6IG1pbm1heCgwLCAwLjMzMzNmcikgbWlubWF4KDAsIDAuMzMzM2ZyKSBtaW5tYXgoMCwgMC4zMzMzZnIpO2dyaWQtYXV0by1mbG93OiByb3cgfSAud3B2LXZpZXctb3V0cHV0W2RhdGEtdG9vbHNldC12aWV3cy12aWV3LWVkaXRvcj0iNWFmMzExMjEwNzYxZWVhOTQwY2YxMTI4ZDg3ODVmN2QiXSAudGItbWFzb25yeSB7IGdyaWQtdGVtcGxhdGUtY29sdW1uczogbWlubWF4KDAsIDFmcikgbWlubWF4KDAsIDFmcikgbWlubWF4KDAsIDFmcik7Z3JpZC1jb2x1bW4tZ2FwOiA1cHg7IH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gLnRiLW1hc29ucnkgLnRiLWJyaWNrX19jb250ZW50IHsgcGFkZGluZzogMCAwIDVweCAwOyB9ICB9IEBtZWRpYSBvbmx5IHNjcmVlbiBhbmQgKG1heC13aWR0aDogNTk5cHgpIHsgLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gID4gLnRiLWdyaWQtY29sdW1uOm50aC1vZi10eXBlKDFuKzEpIHsgZ3JpZC1jb2x1bW46IDEgfSAud3B2LXZpZXctb3V0cHV0W2RhdGEtdG9vbHNldC12aWV3cy12aWV3LWVkaXRvcj0iNWFmMzExMjEwNzYxZWVhOTQwY2YxMTI4ZDg3ODVmN2QiXSAuanMtd3B2LWxvb3Atd3JhcHBlciA+IC50Yi1ncmlkIHsgZ3JpZC10ZW1wbGF0ZS1jb2x1bW5zOiBtaW5tYXgoMCwgMWZyKTtncmlkLWF1dG8tZmxvdzogcm93IH0gLndwdi12aWV3LW91dHB1dFtkYXRhLXRvb2xzZXQtdmlld3Mtdmlldy1lZGl0b3I9IjVhZjMxMTIxMDc2MWVlYTk0MGNmMTEyOGQ4Nzg1ZjdkIl0gLnRiLW1hc29ucnkgeyBncmlkLXRlbXBsYXRlLWNvbHVtbnM6IG1pbm1heCgwLCAxZnIpIG1pbm1heCgwLCAxZnIpIG1pbm1heCgwLCAxZnIpO2dyaWQtY29sdW1uLWdhcDogNXB4OyB9IC53cHYtdmlldy1vdXRwdXRbZGF0YS10b29sc2V0LXZpZXdzLXZpZXctZWRpdG9yPSI1YWYzMTEyMTA3NjFlZWE5NDBjZjExMjhkODc4NWY3ZCJdIC50Yi1tYXNvbnJ5IC50Yi1icmlja19fY29udGVudCB7IHBhZGRpbmc6IDAgMCA1cHggMDsgfSAgfSA=

Operation Duma – £45 million Missing Trader Intra-Community (MTIC) fraud

£45 million Missing Trader Intra-Community (MTIC) fraud involving deals between many family owned businesses and losses to HMRC. Athena Forensics examined the Prosecution evidence and identified the presence of corruption within the data provided and absence of information relating to the original seizure of that data by a national anti-fraud agency.

The evidence produced formed the basis of the computer evidence for each of the 5 Defence teams during the 6 month Trial.

R -v- DC – Winchester Crown Court

Athena Forensics were instructed to conduct an examination of a server based in Bulgaria by the Solicitors acting for the Defendant who had been charged with conspiracy to murder.

The examination of the server was conducted by a computer forensic expert at Athena Forensics who confirmed that an initial ‘order’ for the murder of a target had been placed on an dark web website, however, it also identified that the various stages required to complete the ‘order’ for the murder of the target had not been made.

The Defendant was found not guilty after trial by Jury of all of the charges.

Terrorism – Plot to kill the British Prime Minister

The Defendant was accused of being involved in a plot to kill the British Prime Minister. The operation led by the North West Counter Terrorism Unit identified the defendant as being in possession of material that could be prepared to commit an act of terrorism.

Whilst a number of items included substances and equipment a large volume of material was identified on computer equipment that included instructions to commit terrorist acts.

Athena Forensics examined the computer based evidence and provided a report and attended court in response to the Prosecution findings.

As a result of our computer forensic experts report the Defendant was found not guilty of 5 of the 10 Counts on the Indictment which were in relation to the computer based evidence.

R -v- CF – DDoS Attack on the FBI, Home Office, Paypal and Mastercard – Birmingham Crown Court

Athena Forensics were instructed by the Solicitors acting for an individual who had been charged under the Computer Misuse Act 1990 and was alleged to have been involved in a conspiracy to carry out denial of service attacks on the FBI, Home Office, Mastercard and Paypal.

The evidence was examined and a keylogger log was identified for malicious software that had been installed onto the computer without the knowledge of the user and that it had recorded the text typed into the computer at the point that the DDoS attacks took place.

Operation Carbon – UK Largest Firearms Investigation – Liverpool Crown Court

Athena Forensics were instructed by the Solicitors acting for one of the co-Defendants who were alleged to have conspired to import large numbers of firearms into the UK.

An Athena Forensics mobile phone forensic expert conducted a review of the mobile phone evidence produced by the Prosecution and provided evidence at Court during the Trial at Liverpool Crown Court.

R -v- SW – VAT Fraud Investigation – Inner London Crown Court

Athena Forensics were instructed by the Solicitors acting for an individual who had been jointly charged with Fraud and was alleged to have concealed the true extent of goods imported into the UK, thereby evading the payment of VAT on those imports.

The Defendant was a Director of the company and a signatory to many important categories of documents, including VAT returns to HMRC.

The Defendant denied the allegations and claimed to be unaware of the activities that were alleged.

An examination of the company server was conducted by an Athena Forensic computer forensic expert and that examination resulted in the identification of email communication between 2 co-Directors of the company. Those emails included evidence to suggest that they had copied the Defendant’s signature from a document and then used that copy to be placed on various company documents, including financial records to HMRC. This evidence was then accepted by the Prosecution.

After three weeks of Prosecution evidence during a jury Trial, the Defendant was acquitted before the Defence opened their case, based upon the findings of the evidence produced within the Athena Forensics computer forensic examination report.

Probate – Deletion of Documents

An investigation was requested of a company laptop computer by a UK based design company for evidence to indicate the deletion of a file that contained the will of its deceased Managing Director.

The investigation recovered a relevant word document that had been deleted following the parties death.

R -v- WA – Harassment

The Defendant was accused of the harassment of an ex-partner on a number of occasions via the Internet over a 5 month period. Athena Forensics provided evidence that caused the charges to be reduced to activity over a 1 month period. The Prosecution eventually offered no evidence at Court on the date in which the Trial was due to commence at the Court of Appeal.

R -v- DO – Harrow Crown Court

Athena Forensics were instructed to conduct an examination of various computers and mobile phones by the Solicitors acting for a Defendant who was involved in a Trial and facing allegations of rape.

An Athena Forensics digital forensic expert conducted an examination of all of the devices for evidence of communication between the parties as well as evidence to support his Defence.

Various communication was identified on his and the Complainant’s phones as well as supportive evidence of activity on the computer.

The Defendant was found not guilty after trial by Jury of all of the charges.

R -v- KL – Preston Crown Court

Police seized a number of mobile phones and identified videos on his laptop that provided instruction to turn a mobile phone into a bomb trigger, also present were other guides including the “car bomb recognition guide” that provided instructions to blow up petrol using a shotgun cartridge and was downloading a video on making a suicide vest at the time Police attended his home.

Also seized were 71.8 litres of petrol and 2 kgs of potassium nitrate and a shotgun cartridge.

The Defendant had described himself as a “terrorist” and a “sniper” during Internet conversations.

The Prosecution alleged that the Defendant had downloaded a folder named “Hezbollah military instruction manuals” that contained videos in Arabicand consisted of instructional films on how to make various weapons including detonators, explosives, a missile and a suicide bomber belt as well as instructions on placing landmines and how to strip an AK-47 automatic rifle.

Three computers were also found to contain moving images of live beheadings by Islamic groups and a number of clips of groups with the Iraq, Afghanistan and Chechnya conflicts including US soldiers being shot and personel being blown up.

Documents on the computers included the The Mujahedeen Explosives Handbook.

After 4 weeks of Trial at Preston Crown Court, including attendance by an Athena Forensic Computer and Mobile Phone Forensic Expert for 4 days, the Defendant was acquitted on 5 out of 10 of the charges and found guilty on the remainder.

Criminal Cases - Previous Investigations

Criminal Cases – Previous Investigations