The rapid growth of technology within the forensic side of investigations always means that there are newer and better bits of shiny new kit out there to play with, but its usage has to be closely looked at, as it can sometimes distort the truth.
In a recent case, I was asked to act for a company director who was facing an investigation into his business concerning allegations of fraud that had arisen during a file audit. As is usual, the computers used by this particular director were seized and subsequently analysed using the latest software. I was aware that the director had a previous conviction for possession of child abuse images, and the machine which was seized in that original investigation was precisely the machine which had been seized in the current fraud matter. I established that it had been restored to the business by the Police following analysis, and had been "cleaned" prior to its return.
When the technical analysts ran the new improved software on the machine for the fraud case, they discovered evidence that the machine again had been accessing illegal images. The director was duly arrested for that, mid-way into the fraud case, and was questioned about them. He denied completely that he had accessed such imagery and challenged the forensic findings stating that they must have remained buried in the machines hard drive following the cleaning. The newly discovered images were checked against the records of the ones found in the original case and they were different. My client however was sure. He had, he accepted, possessed them once but following charge for the original offences, he destroyed the remote hard drive upon which they were stored. They must, he contended, have been left on the hard disc by mistake when it was restored.
Nevertheless, the CPS duly authorised a charge. The client faced an inevitably long sentence if convicted. It looked rather bleak, as who would believe him?
I suggested to the case officer that he may wish to consider discussing our client's case with the technical team. Unusually, he confirmed he would.
An hour later, as I was on the train on the way home, I received an email asking me to call the officer. The client was correct. Apparently, between the original case and now, the analysis software had been significantly improved and it was likely that these images were missed in the first review. As such, the decision to authorize charge was wrong and that matter would be withdrawn.
Who would have thought?
