JD Spicer Zeb Solicitors Banner Image

Useful Information

  • Home
  • Useful Information
  • Crime/Fraud
Services
People
News and Events
Other
Blogs

What do the police do with evidence from digital devices and what are the legal defences?

View profile for Philip Spicer
  • Posted
  • Author
  • Senior Consultant

Evidence from digital devices such as phones, tablets and laptops is becoming more important than ever for criminal investigations and prosecutions. If you have been arrested, are under investigation or are facing charges, it is essential to understand how police use digital evidence and what legal defences there are.

In Brief

In criminal investigations, UK police use advanced forensic software to extract data from digital devices, including encrypted and deleted content. Examiners search for specific keywords, file signatures, and "inaccessible" data that a standard user cannot see. Digital evidence is critical in cases involving drug dealing, terrorism, and sexual offences, but its interpretation is often a central point of legal dispute regarding knowledge and intent.

  • Data Recovery Capabilities: Police can retrieve "deleted" files—such as WhatsApp messages, SMS, and photos—provided the storage space hasn't been overwritten. They also utilize Cell Site Data to map a device’s location based on mobile mast connections.

  • Bypassing Passwords: While police typically request PINs, they use specialized tools to unlock older or less secure devices. Successful access often depends on the device model and software version.

  • The "Accidental Download" Defence: Many digital files (like thumbnails or browser cache) are saved automatically by software. A key legal defence involves proving that illegal material arrived on a device via "pop-ups," file-sharing "side-loading," or unsolicited group chat attachments without the user's knowledge.

  • Technical Ambiguity: Forensics can show a file exists but often cannot prove when it was deleted or if it was ever viewed. Defence specialists from firms like JD Spicer Zeb re-examine these reports to identify gaps in the prosecution's evidence.

  • Thumbnail Forensic Nuance: Thumbnails can remain on a device long after the original image is gone. Expert analysis is required to determine if the presence of a thumbnail actually implies intentional possession.

In this article, computer and network consultant Graham Dilloway explains:

How do the police search digital devices for evidence?

Police device examiners use similar techniques to examine devices such as Windows and Apple computers, mobile phones and tablets, in cases involving indecent images of children, sexual assault, drug dealing, terrorism and other crimes.  The techniques might vary slightly from case to case but are likely to include many of the same standard processes.

An automated process is used to compare all of the image files on the device with a huge collection of image files that are held by the police and known to be indecent images of children.  An image file can be a still picture or a movie.  Images can also be viewed and assessed manually by an examiner looking at a gallery of small versions of any images not identified during the automated process.

A list of about thirty words or phrases (or more or less) is often used during a device search to see if any of the words or phrases can be found on a device. The words or phrases are terms that the police often find on devices containing indecent child images.  The search is to locate words and phrases that occur in the names of files that contain indecent images of children or that are used in web searches for child images or appear in chat messages or emails or elsewhere.

Can the police retrieve deleted data from a device?

An image file is identified as “accessible” when the file is in a folder that a typical computer user might easily access including the “Pictures” and “Videos” folders on a Windows computer.

Image files can be saved on a device by an automatic software process.  For example, all of the pictures displayed as part of a webpage when web browsing are automatically saved.  Typical users of a device would not be able to locate pictures that have been automatically saved by web browser software.  These and other automatically saved image files are identified as “inaccessible” by a typical device user.

“Accessible” and “inaccessible” image files can also be identified as “deleted” or as “not deleted”.  Computers and other digital devices do not immediately delete a file when a device user requests that the file be deleted.  The space occupied by a deleted file is marked as available for re-use.  The content of a deleted file can be recovered until the space occupied by the file is re-used and the content of the file is overwritten.  It can be days or months before a deleted file is overwritten and the content cannot be recovered.

The police usually describe a file in the “trash” as “accessible” and “undeleted” because the content of the file can be easily recovered by a typical device user.

Police device examiners will produce reports listing the evidence that they find.  A report might show lists of files that are indecent child images showing the filename, the folder location and the date that the file was saved onto the device.  Other reports might list webpages viewed on screen, web browser searches or the text of emails or chat messages.

Can the police unlock your device without the password?

Mobile devices, including laptop computer, phones and tablets, are usually protected by a PIN code or a fingerprint or other means.  The content of mobile devices is often encrypted.  Typically, the police will ask for the PIN code or password or other means that protects or encrypts a device.  The police can use specialised devices and software that can access mobile devices when access and encryption codes are not available. Successful access to locked mobile devices typically depends upon the age of the mobile device and the version of the software that is running.  It is usually only the most recent models of a device that the police cannot access.

What other data can the police use as evidence?

The police often rely on chat messages and cell site data in cases including drug dealing and sexual assault.  It is sometimes possible to recover SMS text messages or chat messages in WhatsApp and other chat apps even after the messages or entire chats have been deleted.

A mobile phone stays connected to mobile phone masts at all times so that the phone is able to receive incoming calls.  Mobile phone companies retain a log of this cell site data that lists the masts that a phone connects to and the times of the connections as the location of the phone changes.

The police might use the content and the dates and times of SMS text or chat messages with cell site data to show, for example, who might have been meeting with who and the location of that meeting.

What are the legal defences in cases involving digital evidence?

Defence solicitors can instruct a computer specialist to examine the report evidence produced by the police and to re-examine devices.  A defence computer specialist can offer advice to solicitors regarding the examination of evidence by the defence.

A computer specialist might be able to identify gaps in the police evidence.  It might be that there is not good evidence of intent to display indecent child images on screen or to save image files on a device or not good evidence of knowledge that image files had been saved on a device.

Images displayed on a webpage

The police evidence might show that image files are on a device because the images were in a webpage that has been displayed on screen by web browser software.  It might be that the evidence does not show what was clicked or typed to cause the webpage to be displayed on screen.  The defence might say that the webpage could have popped-up automatically onto the screen. Alternatively, a webpage that includes child images might be displayed after a click on some text that indicated a link to legal adult material.

Images saved in a folder

Image files might be saved in a folder indicating that the files came onto the device via file sharing software.  There might be no evidence to show what was searched for or which files were selected to start the download of image files.  The defence might say that an attempt to download multiple files containing legal pornography had accidentally downloaded illegal images.

Files might be in folders indicating that the files have come onto a device as attachments to an email or chat message.  The evidence might not include emails or chat messages requesting that illegal images are sent to the device.  The defence might say that unsolicited illegal images have, for example, been sent to the device by an unknown stranger as part of a group chat.

Thumbnail pictures

It is often useful to have a computer specialist interpret evidence that includes thumbnail pictures.  Thumbnail pictures are the small pictures that are seen when multiple pictures are simultaneously displayed in a grid on screen in a gallery view.  A thumbnail is usually created automatically by software and is derived from an original large version of a picture.  The thumbnail can remain on a device after the original large version has been deleted.  The software that created a thumbnail image is usually indicated by the folder location of the thumbnail file.  The date that a thumbnail was created is often not available because of the way that some thumbnails are stored.

The defence might be able to offer an alternative interpretation of thumbnail image evidence.  For example, a thumbnail might be created automatically at the moment that an image is included in a display on screen of a list of files that have not been viewed.

Deleted files

It is usually not possible to find evidence showing when a file was deleted from a device.  The filename, folder location, creation date and other information is often lost within a few days or weeks after a file is deleted.  The content of the file can remain after filename and other information is lost.  The defence might be able to say that one or more deleted image files came to be on a device by accident if there is no evidence to show the folder location and creation date for the file.

The defence might be able to say that an image file could have been deleted moments after it came to be on a device because devices do not record the date and time of a file deletion.

Automatic saving of files

A computer specialist can research and test the operation of devices and software.  For example, some chat messaging apps automatically save pictures and videos onto a device while other chat apps require a user of the device to tap the screen to cause a file to be saved onto the device.

Chat messages

The interpretation of chat messages requires care because chat messages can be recovered from a device after messages and entire chats have been deleted.  The recovery of messages can be partial and a sequence of messages that is initially viewed as a complete chat might be incomplete.  For example, the defence might be able to say that a message that appears to be the answer to one question might actually be the answer to another question that has been lost after being deleted.

Police reports

A computer specialist can clarify the remarks of police officers used during interviews and in witness statements.  The reports prepared by police device examiners sometimes lack clarity.  The comments that officers make during interviews can suffer from this lack of clarity when, for example, officers describe deleted image files as being still accessible on a device.

Misunderstandings and omissions can occur with evidence from digital devices.  A solicitor can ask a specialist to look at evidence from phones and computers.  A specialist can help a solicitor to identify gaps and inaccuracies in the evidence.

A specialist can help to ensure that the lawyers and others in a case have a complete and correct understanding of the technical evidence.

Contact our criminal defence lawyers today

For a free initial consultation, urgent specialist advice, immediate representation, or to speak to us confidentially about allegations involving digital evidence, please do not hesitate to get in touch.

You can contact our dedicated criminal defence lawyers in London, Birmingham, and Manchester by telephone on:

Or email: solicitors@jdspicer.co.uk

Alternatively, you can fill out our quick online enquiry form, and we will get back to you as soon as possible.

24/7 legal representation for crimes involving digital evidence

Please get in touch for a free initial consultation with one of our expert criminal defence solicitors, as well as immediate representation and advice on dealing with allegations that involve digital evidence.

We are available to represent clients all over England and Wales at any time, so please contact our Emergency Number at 07836 577 556.