Analyzing PCs for evidence.
Discussion
Most units have about a 6 month backlog of work, though there are ways to do a quick "triage" test which can be used to produce material which helps at interview, if there's sufficient intel. to make it worthwhile. However, there are concerns about the validity of the triage tools under the new ISO 17025 regulatory regime which is coming in.
If it's anything like what happened to my uncle's computers when he was trying to be helpful, then they won't get them back for over a year, and they won't work when you do get them back.
He wasn't the person being charged with anything, but his son's friend was arrested (and let off with a caution after about 12 months) for taking photos of fully-dressed women in a 'pervy way' according to the shopping centre security guard who called the police. I wasn't there so don't know what pervy means in this context, but the photo's I saw were longish-range photos of in the shopping centre taken from head height (so nothing like up-skirt shots).
The lad - he was 20-something at the time, but mental age of a 12 year old - offered under questioning (without anyone there to support him - as the police asked his age and then promptly assumed he was old/clever enough to know his rights) that he sometimes used my uncle's computers when he was there with my cousin. Police asked my uncle if they could examine the computers, and my uncle had no problem with it...until he realised it wasn't going to be a quick look and return.
They could never give him an estimate of how long he'd have to wait to return his equipment, so had to go out an buy a new computer in the meantime.
When they 2 computers came back, they looked like they'd been sprayed with sewage - and they wouldn't even start up. Obviously they didn't give a s
t that they were someone innocent party's property.
He wasn't the person being charged with anything, but his son's friend was arrested (and let off with a caution after about 12 months) for taking photos of fully-dressed women in a 'pervy way' according to the shopping centre security guard who called the police. I wasn't there so don't know what pervy means in this context, but the photo's I saw were longish-range photos of in the shopping centre taken from head height (so nothing like up-skirt shots).
The lad - he was 20-something at the time, but mental age of a 12 year old - offered under questioning (without anyone there to support him - as the police asked his age and then promptly assumed he was old/clever enough to know his rights) that he sometimes used my uncle's computers when he was there with my cousin. Police asked my uncle if they could examine the computers, and my uncle had no problem with it...until he realised it wasn't going to be a quick look and return.
They could never give him an estimate of how long he'd have to wait to return his equipment, so had to go out an buy a new computer in the meantime.
When they 2 computers came back, they looked like they'd been sprayed with sewage - and they wouldn't even start up. Obviously they didn't give a s
t that they were someone innocent party's property.Greendubber said:
As said a huge workload and not enough people to do it.
A 6 month turn around is considered fast!
I'm retiring soon, and looking at forensic IT as a new pastime (I am experienced in this, though not policing stuff), but wonder about the effects that digging out hidden pics of child or nasty stuff has. A 6 month turn around is considered fast!
I always thought they did a random dip of stuff if there was thousands if not millions of files which ay be relevant to the case.
What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
velocefica said:
I always thought they did a random dip of stuff if there was thousands if not millions of files which ay be relevant to the case.
What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
Not sure if this is still current law, but may well be (or something similar):What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
The Regulation of Investigatory Powers Act (RIPA) has had a clause activated which allows a person to be compelled to reveal a decryption key. Refusal can earn someone a five-year jail term.
http://www.theregister.co.uk/2007/10/03/ripa-decry...
TurricanII said:
velocefica said:
I always thought they did a random dip of stuff if there was thousands if not millions of files which ay be relevant to the case.
What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
Not sure if this is still current law, but may well be (or something similar):What if a lot of the stuff involved in fraud etc is under 256k encryption which cannot be cracked, what happens then?
Unless the suspect gives them his password or voluntarily agrees to show them encrypted files.
They can't charge him with withholding evidence because they don't know if anything under encryption is relevant to the case.
The Regulation of Investigatory Powers Act (RIPA) has had a clause activated which allows a person to be compelled to reveal a decryption key. Refusal can earn someone a five-year jail term.
http://www.theregister.co.uk/2007/10/03/ripa-decry...
I have worked for a prosecuting authority and we had in house forensics which had a lead time of around 4 months - it was extremley frustrating. We could pay an external company £500 per time to turn around in 2-3 weeks but of course we never did that.
IMO if the state is doing to do investigations they should fund a reasonable turnaround in such checks - poentially prolongong a case is not really on.
Taking these 2 cases- we can only surmise, but they both essentially appeared to confess and would have pleaded guilty - if the computer forensics came back after even 1 month chances are the case could have been wrapped up. It seems likely though that the case would have been prolonged past 6 months due to waiting for forensics to come back. Not ideal for anyone really.
IMO if the state is doing to do investigations they should fund a reasonable turnaround in such checks - poentially prolongong a case is not really on.
Taking these 2 cases- we can only surmise, but they both essentially appeared to confess and would have pleaded guilty - if the computer forensics came back after even 1 month chances are the case could have been wrapped up. It seems likely though that the case would have been prolonged past 6 months due to waiting for forensics to come back. Not ideal for anyone really.
eldar said:
I'm retiring soon, and looking at forensic IT as a new pastime (I am experienced in this, though not policing stuff), but wonder about the effects that digging out hidden pics of child or nasty stuff has.
Advice : don't. The market's overcrowded and underfunded now, and contracting as regionalisation of services happens. Cuts in legal aid also mean there's far less chance of defence work, and corporates either do it in house, or don't do it at all. Unless you can do something other than volume drive or mobile device processing, you'll find it very hard to get work - and it is most definitely NOT a pastime.As for the effects - most units dealing with child abuse imagery require psychological evaluations at 6-12 months, with rotation out of the unit and counselling at the first signs of variance from the norm. I know a few people who've reported that it skews their view of the world, to the point where they start to suspect parents who are holding their kids' hands in supermarkets and the streets. Dealing with other types of material isn't particularly pleasant either - there are only so many videos of human beings doing unpleasant things to other human beings that a normal person can stand.
The lovely Mrs May had now introduced a 28 day bail limit. After making all her sound bites to the news, she hasn't yet explained how we keep checks on someone under investigation for such offences.
Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
Elroy Blue said:
The lovely Mrs May had now introduced a 28 day bail limit. After making all her sound bites to the news, she hasn't yet explained how we keep checks on someone under investigation for such offences.
Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
28 day limit - which can be extended to three months by a superintendent. And can be further extended by a court. This sort of case would not be affected. That is just scare mongering. Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
I agree it should be done more quickly.
This: http://www.bbc.co.uk/sport/0/rugby-union/33769706 is an example of what should be stopped. And before someone chimes up that they are waiting for blood tests I have reliable information that it's not the case... Over 3 months to 'further investigate' if someone had drank more than they are allowed. Ridiculous.
Edited by photosnob on Tuesday 4th August 11:22
Blood tests take two months. Drug/drive analysis is taking three months. Really sorry if these facts don't support your agenda. M
Bail is now a Political hot potatoes. We've been told in no uncertain terms not to expect extensions. So once again, your Google searches don't support actual reality
If you've got issues with time frames, why don't you write to your MP asking why Forensic services have been hacked, rather than moaning on here.
Bail is now a Political hot potatoes. We've been told in no uncertain terms not to expect extensions. So once again, your Google searches don't support actual reality
If you've got issues with time frames, why don't you write to your MP asking why Forensic services have been hacked, rather than moaning on here.
Edited by Elroy Blue on Tuesday 4th August 11:31
eldar said:
I'm retiring soon, and looking at forensic IT as a new pastime (I am experienced in this, though not policing stuff), but wonder about the effects that digging out hidden pics of child or nasty stuff has.
You'd have to be a certain type of person who can readily detach themselves from what they see.I have told this tale here before, in other contexts, but I'm happy to relate again if it helps. Many years ago, on a contract, I was asked to have a look through someone's laptop, because other staff members had said that they thought they had seen inappropriate material on his screen, which was quickly closed when anyone approached. It was thought that there was perhaps p0rn involved, and if you met the man, you wouldn't rule out gay p0rn.
However, whilst nobody would ever call me any sort of prude, or narrow-minded, I was ill-prepared for what I found, which turned out to be kiddie p0rn. I recall clearly, my office was in the basement and I literally ran upstairs and out onto the street, just needing to be outside and breathing fresh air. I phoned a good mate, who knew both the organisation and the individual, and he talked me down enough to go back in and advise the manager and the head of HR what I'd seen. Police were called and interviewed me, then arrested him, and I spent the rest of the day giving statements in the local nick. The offender was subsequently tried at Crown Court and jailed.
I'm trying to remember, it was probably over 10 years ago now but I still have images in my head of what I saw. There were several distasteful pictures, but I clicked on a video and shut it down after just a few seconds; that part in particular is still burnt into my memory. It was sufficiently unpleasant that I was offered victim support even though I wasn't the victim per se.
Perhaps some training and preparation might make it a little less difficult.
Elroy Blue said:
Blood tests take two months. Drug/drive analysis is taking three months. Really sorry if these facts don't support your agenda. M
Bail is now a Political hot potatoes. We've been told in no uncertain terms not to expect extensions. So once again, your Google searches don't support actual reality
If you've got issues with time frames, why don't you write to your MP asking why Forensic services have been hacked, rather than moaning on here.
I have no agenda. I'm against cuts to the police. I'm against the privatisation of essential services. I am broadly for restricting bail in most cases as it is/has been used to a form of punishment with no trial. Clearly I am wrong, the government are wrong and the whole system will collapse. I do not think having some oversight is a bad thing. Bail is now a Political hot potatoes. We've been told in no uncertain terms not to expect extensions. So once again, your Google searches don't support actual reality
If you've got issues with time frames, why don't you write to your MP asking why Forensic services have been hacked, rather than moaning on here.
Edited by Elroy Blue on Tuesday 4th August 11:31
But let's just think about this. You asked how you were going to control suspected peadophiles. You then said that you have been told you you couldn't ask for bail. But you can get bail extensions for a suspected drink driver... Can you see how that doesn't add up?
I'm not having a dig. And I can see why the Police are unhappy about many things. I don't think they should pick their fight over having to ask a magistrate to extend peoples bail though. In the grand scheme of things it doesn't really matter.
I work for a cyber security/forensics company. We stay away from stuff like this - not because of the content, but because of the justice system. Turning up for court etc etc is a right pain, dealing with evidence, dealing with lawyers, cross-questioning in court.. all very painful.
I have a few acquaintances and friends in many cyber security and forensic capable constabularies, they are very under equipped and have insufficient experience and knowledge. The technology has just accelerated away from their abilities - in a couple of friends cases, they are normal officers that have applied for the position as it has allowed them to get a foot on the ladder to move somewhere else.
I think someone has already mentioned the 6-12 months psychiatric evaluations and rotation of duties, and the the reasons why it is done.
As one good friend put it, they are brilliant with the detective work and interviews/chasing people down, crap at anything cyber related... and this is coming from quite high up :-)
I have a few acquaintances and friends in many cyber security and forensic capable constabularies, they are very under equipped and have insufficient experience and knowledge. The technology has just accelerated away from their abilities - in a couple of friends cases, they are normal officers that have applied for the position as it has allowed them to get a foot on the ladder to move somewhere else.
I think someone has already mentioned the 6-12 months psychiatric evaluations and rotation of duties, and the the reasons why it is done.
As one good friend put it, they are brilliant with the detective work and interviews/chasing people down, crap at anything cyber related... and this is coming from quite high up :-)
photosnob said:
Elroy Blue said:
The lovely Mrs May had now introduced a 28 day bail limit. After making all her sound bites to the news, she hasn't yet explained how we keep checks on someone under investigation for such offences.
Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
28 day limit - which can be extended to three months by a superintendent. And can be further extended by a court. This sort of case would not be affected. That is just scare mongering. Forensic services were privatised and are now very expensive abd take a ridiculous amount of time. The conflict between the two is obvious.
I agree it should be done more quickly.
This: http://www.bbc.co.uk/sport/0/rugby-union/33769706 is an example of what should be stopped. And before someone chimes up that they are waiting for blood tests I have reliable information that it's not the case... Over 3 months to 'further investigate' if someone had drank more than they are allowed. Ridiculous.
Edited by photosnob on Tuesday 4th August 11:22
Forums | Speed, Plod & the Law | Top of Page | What's New | My Stuff