What Will a Forensic Analysis of My Devices Show

Before a forensic examination takes place the police will first have a suspicion that an individual is in possession of unlawful material. This suspicion can arise in various ways for example; intelligence received by the National Crime Agency, Social media platforms such as KIK Messenger, Facebook and Snapchat, and in rare cases a witness. 

When in receipt of the information the police will usually apply to the Magistrates Court for a warrant to search and seize electronic devices belonging to the suspect. In some instances the police will not have a warrant and instead carry out a search and seizure using their powers under s.18 of the Police and Criminal Evidence Act 1984. The reason the police want to seize the devices is to turn the suspicion and intelligence received by external sources into evidence, to then go on and prosecute the suspect for a criminal offence/s. Such analysis can take a considerable amount of time, in some instances 12-18 months. Once results are obtained from the analysis they will be reviewed by the police officer in charge of the case. The suspect may then be invited to attend the station again for a further police interview, or their first interview in relation to the alleged offence. This will be to provide the suspect with an opportunity to provide an account as to why certain material has been found on their device. It is important you are represented by a solicitor at any such interview.  

Images are usually graded by the police using the database CAID. CAID holds millions of indecent images of children and they are referred to as “known images”, because they are known to law enforcement. Images in CAID are often regarded as graded reliably because of the processes they go through to be stored on the database. 

Two key questions which will automatically arise for us when we are contacted regarding an investigation or prosecution for indecent images of children, and questions which should always be put to a defence expert - could our client access the images in question? And/or did they have knowledge that they could access the images, the answers to these questions could significantly impact our clients case and the charges. We would consider the evidence in the case and ensure that the prosecution can prove the elements of the offence alleged, us and our experts would look at the following information: 

The location of the images on the device. 

How the images came to be located there. 

How accessible the images are in the location without specialist knowledge of software to retrieve them. 

Are there any search terms indicative of indecent material.

We often have forensic reports presented to us by the prosecution which relate to cached images. Our client would only be guilty of the offence of making or possessing images if they knew of the image in the cached file. This situation can often arise where torrents are used for bulk downloading of files or, a link is sent in a group chat which the client did not open and therefore had no knowledge of what material would be on the link, we see this regularly when apps such as KIK Messenger and What’s App are used. 

If a particular file has been deleted, depending on the size, this file transfers to the recycle sleeve if the device is a computer. Once this is emptied, the contents are no longer accessible to a regular user but still retrievable to the expert. However, data can and regularly does become overwritten by new material leaving only half of the document or picture being retrieved. The same applies to mobile devices and the time frame to retrieving these deleted files proves to be indefinite. 

Once the police have utilised their forensic examiner, a Streamlined Forensic Report (SFR) or a prosecution report will be produced. The report generated will include information on the quantity of images found, where they were found on the device, whether there has been any search terms indicative of child abuse material. Fundamentally, the property will determine whether any indecent material has been found. 

At Eventum Legal we regularly speak to clients who have had their computer equipment seized. In some instances they have been interviewed and some not, but most are waiting for the police to complete forensic analysis of their devices. Because of the wait they are enduring, sometimes referred to as being in limbo, they are left with uncertainty as to what is going on. 

We always advise that us making early contact with the police is beneficial to our client. We will confirm with the police the anticipated timeframe for the investigation and any disclosure of the suspected offences. Upon receiving as much information as possible at this stage we will consider it alongside our client’s circumstances which may have led to their material being seized. We will discuss how the investigation is impacting our client’s mental and physical health and try to assure them that we will deal with the investigation and the police and allow them to focus on their wellbeing. 

We will explain the applicable offences to our clients in a clear and logical way, minus the legal jargon and explain how we may be able to challenge any forensic evidence that may arising in their case. 

If you, a family member or friend is facing a police investigation and currently waiting for the forensic examination of devices, contact our specialist lawyers today for a free, no obligation chat. We will aim to put your worries at ease and discuss possible defences with you.