R -v- TW – Southwark Crown Court
61 Indecent Images of Children were identified by Police on a computer. The Defendant was charged with making and possessing the images . The Defendant denied the charges and denied any knowledge of them. He also believed that his co-defendant may have been responsible for the creation of them.
The evidence was obtained from the Police and examined by an Athena Forensics Computer Forensic Expert who found that the images were located within system files automatically generated by the operating system and were not visible or accessible to the normal user.
Further examination resulted in the identification of the original source of the images which were web pages.
The specific web pages were identified and it was noted that they had been created during an 11 minute period of Internet browsing during which over 1,000 other images had been created mostly including adult pornography.
Following Trial by Jury, the Defendant was acquitted of all Counts, the co-Defendant was found guilty.
R -v- AF – Oxford Crown Court
A public service worker was accused of possessing a number of unlawful images that were identified on a multi-access work computer.
The Defendant denied knowingly downloading the unlawful material. The presence of the images was confirmed, however, the actions taken by the organisation in the detection and investigation of the digital evidence prior to Police involvement were found to have significantly altered the reliability of the evidence.
The Defendant was found not guilty of the allegations following a 5-day Trial at Crown Court due to the procedures taken by the Audit department.
R -v- DT – Swansea Crown Court
The Prosecution identified 2 indecent images of children on an android tablet computer and the Defendant faced a trial charged with deliberately making those images on the device.
A mobile phone forensic expert at Athena Forensics was instructed by the solicitor acting for the Defendant a week before the Trial was due to start, however, the evidence was obtained from the Police on the same day and was examined and the report completed before the Trial began.
The mobile phone forensic expert found that the indecent images had been stored as a result of ransomware malware. The software had been automatically stored to the Downloads folder of the device by the Google Chrome Internet browsing software when the user had selected an innocuous link on the Pornhub website whilst browsing lawful adult pornography.
The Prosecution dropped the charges relating to the indecent images on the morning of the trial.
R -v- MP – Shrewsbury Crown Court
The Defendant faced 2 Counts of Making and 1 of possessing 26 indecent images of children, contrary to section 1(1)(a) of the Protection of Children Act 1978 and Criminal
Justice Act 1998 – section 160(1) respectively.
The 26 indecent images of children were identified on a Lenovo laptop computer by Police in 2017 and the Prosecution alleged that the images had been created by the deliberate and intentional actions of the Defendant. The presence of the images were also used to support other more serious allegations of sexual offences.
However, the Defendant denied the allegations and a review of the evidence and Prosecution findings was required to determine whether evidence was present to suggest the activity responsible for the storage of them or whether they may have been created inadvertently.
The computer was examined by a computer forensic expert at Athena Forensics in January 2019 and was found to contain over 200,000 files and folders that included over 400,000 static and moving images including the 26 that were identified by the Prosecution as indecent images of children.
The majority of the indecent images of children were identified within unallocated clusters, meaning that they had been ‘live’ at some point within an unknown location on the hard drive and had been deleted.
Another of the indecent images of children were identified within a Google Chrome Internet browsing cache file and had then been stored as part of a bulk backup of files. The investigation allowed for the identification of evidence to suggest that the Google Chrome folder contained 1,500 pornographic images, including only 1 that was identified as being illegal and that the image had been originally stored during the browsing of an almost entirely legal pornographic site.
The remaining indecent images of children were identified within the System Volume Information folder of the computer that was found to contain over 19,000 images that had been automatically stored by Windows and the source of them could not be established.
After disclosure of the computer forensic expert report by Athena Forensics, the Prosecution accepted the findings and then offered no evidence against the Defendant leading to the case being dropped at Crown Court the week before the Trial was due to commence in March 2019.
R -v- AK – Bristol Crown Court
In late 2017, the Defendant was investigated by Police in relation to another matter. In 2018 he was charged with making 15 indecent images of children, contrary to section 1(1)(a) of the Protection of Children Act 1978 when those images were identified on his mobile phone by Police during that investigation. The Defendant denied deliberately storing the images and a review of the device and the Prosecution evidence was requested by his Solicitor.
The device was examined by a mobile phone forensic expert at Athena Forensics in April 2019 a Samsung Galaxy S6 mobile phone and it was found to contain approximately 43,000 images including the 15 indecent images of children that had been stored on 5 dates during 2017 when web pages containing them had been encountered. Those images had not been manually stored by the user, they had been automatically stored by the Internet browsing software.
No Internet activity was available within the live or deleted areas of the device that related to the point of creation of the indecent images of children so whilst the path taken to access the respective websites could not be audited, the cache files contained sufficient evidence to allow for an assessment of the addresses of the indecent images of children.
It was found that the originating websites had comprised of gallery advertisement style pages that provided links to other pornographic sites and that they were consistent with being ‘pop-up’ advertisements encountered whilst the user browsed adult pornographic websites.
It was also noted that it was not clear whether the 15 indecent images of children identified by the Prosecution had been at the top of those pages and immediately visible to the user or whether they had been further down those pages and only visible id the user had scrolled down the page (even if they had not been displayed, the existence of them on the page would result in them being automatically stored).
It was also found that the Pornhub website had been regularly visited during the available Internet history and that the 15 indecent images of children appeared to have originated from the advertisement area of that site that caused the user to encounter popup adverts whilst they browsed different pages on that website.
Following disclosure of the forensic expert report, the Prosecution agreed with the findings and observations made within it and offered no evidence a few weeks before the case was due to be heard at Trial at Bristol Crown Court in May 2019.
R-v-SO – Newcastle Crown Court
The Defendant was charged with making 57 indecent images of children contrary to section 1(1)(a) of the Protection of Children Act 1978 that had been identified on his 2 computers by Police that the Prosecution alleged had been deliberately and intentionally stored by him. Internet history activity and Google searches were also identified that were of potential relevance to the presence of the indecent images of children.
The Defendant denied the allegations and claimed that he was not aware of the presence of the indecent images of children and had not deliberately stored them.
Athena Forensics were instructed to carry out a computer forensic examination of the computer evidence to determine whether the Prosecution observations and findings were correct and accurate and whether there was evidence to suggest that the Defendant had not deliberately stored the images.
A review of the computer evidence revealed that the indecent images of children were each within the deleted areas of the computers and that the creation or deletion of them cannot be determined making it impossible to identify whether they had been retained for a period of time or deleted immediately upon identified and that they were not accessible to a normal user.
Our computer forensic expert also found that there was no evidence to suggest that the user had conducted any searches that were likely to have resulted in the creation of indecent images of children.
Our computer forensic expert concluded that there was not sufficient evidence to indicate whether or not the indecent images of children had been created by the deliberate actions of the Defendant or stored inadvertently.
A joint forensic expert document was ordered by the court and the Prosecution expert witness agreed with the findings of the report by Athena Forensics which led to the Prosecution offering no evidence in the case and the proceedings against the Defendant were then dropped.
