Forensic analysis of electronic devices

In this article we consider analysis of electronic devices in the context of indecent image offences.

What happens to files when they are deleted?

Computer operating systems allocate space on the hard drive as adjacent groups of sectors known as allocation units or clusters. When a new file is created, the operating system locates available space and allocates that space to the file. ‘Unallocated space’ relates to space which is not allocated to active files within an operating system.

Computers and laptops with HDD hard drives move deleted files to the ‘Recycle Bin’. This is a location where deleted files are temporarily stored and allows users to recover these files easily.

Once the Recycle Bin has been emptied, the operating system unallocates the space originally allocated to the files and makes that area of the hard drive available for new files.

The deleted files will now have been moved to unallocated space by the operating system. This does not mean that the data has been deleted fully, just that it sits in the unallocated space until the operating system stores another file in the same space i.e. the data is overwritten. The unallocated space therefore contains files that have been deleted, but not yet overwritten.

Can the police recover files once they have been deleted?

In the case of HDD hard drives, the police and forensic entities can recover the data moved to unallocated space as long as it has not been overwritten. They will however be unable to both date and time stamp the data as this information, the metadata, would have been stripped out.

Many newer computers and laptops have SSD hard drives. These are faster and more efficient, and strip themselves of deleted data to make space for new data. It can therefore be problematic for deleted data to be recovered from these devices and the police and forensic entities may not be able to do so.

Mobile phones also have SSD hard drives so, if these have been cleansed, the police and forensic entities will struggle to recover any deleted data.

What happens if I do not provide passwords to my devices?

The police may have requested passwords to your devices upon searching your property or during interview at the police station. At this stage, you are under no legal obligation to provide your password and, in many cases, it may be advisable not to do so.

The police can only require you to provide passwords if they have served a notice under section 49 of the Regulation of Investigatory Powers Act 2000. Non-compliance with such a notice could result in you committing a criminal offence and facing prosecution with a potential custodial sentence. See ‘Do I have to give the police my phone password’ for more information on section 49 notices.

Can the police access my mobile phone without a password?

If you have an iPhone, the police cannot access this without your pin code. However, if the device is such that they feel it necessary to have access, they can engage the services of a provider who can bypass the pin code. This is unlikely to happen in typical cases involving indecent images, as it is an expensive service for the police to procure.

With Android devices, the police have greater success in bypassing security. If you do not provide your password, it does not necessarily mean that the police will not be able to access you device.

How long will it take for my devices to be analysed? 

It is worth being aware that analysis of your devices by the police can take some time. A typical case with no surrounding factors could take anywhere between 6-12 months for results to be obtained. Once this has happened, they still have to be reviewed by the officer in the case and a decision made as to how the material will be graded. Note that this could result in inconsistencies given the scope for human error. Following this, you may be re-interviewed if new evidence has come to light, or interviewed for the first time, usually on a voluntary basis.

Do the police outsource forensic analysis work?

Many police forces outsource indecent images cases to forensic analysis companies who then generate a Streamlined Forensic Report (SFR). This is usually in circumstances where the police have a huge caseload and are struggling with a backlog of cases.

How do they receive the information from the analysis of devices?

The police will obtain a Streamlined Forensic Report (SFR) which will include information on:

• The quantity of images found;
• Whether they were accessible on the device; and
• Any indicative search terms.

These reports are not hugely in-depth but clearly set out whether any illicit material has been found.

My devices have been seized – can Olliers help me?

At Olliers we regularly speak to clients who have had computer equipment and phones seized by the police. On the one hand it is a waiting game but there is still a lot that can be done. We always ensure that we make early contact with the police. We will confirm the anticipated timeframe for the investigation with the police and obtain an assurance that any further contact will be through Olliers, ensuring that there is no embarrassment caused by a police visit to home or workplace.

We can discuss with our clients the circumstances that may have led to their material being seized. We will give our clients an opportunity to discuss any anxiety they may feel. Many want to discuss worst case scenarios and we can advise on the different offences of possessing, distributing and producing indecent images. We can also explain the different categories of offences as well as current sentencing guidelines. We can also attend a voluntary interview with our client if this has not already taken place. Click here to read more if you are under investigation for indecent images offences.