What do the police do with evidence from digital devices and what are the legal defences?
Evidence from digital devices such as phones, tablets and laptops is becoming more important than ever for criminal investigations and prosecutions. If you have been arrested, are under investigation or are facing charges, it is essential to understand how police use digital evidence and what legal defences there are.
In this article, computer and network consultant Graham Dilloway explains:
- How do the police search digital devices for evidence?
- Can the police retrieve deleted data from a device?
- Can the police unlock your device without the password?
- What other data can the police use as evidence?
- What are the legal defences in cases involving digital evidence?
How do the police search digital devices for evidence?
Police device examiners use similar techniques to examine devices such as Windows and Apple computers, mobile phones and tablets, in cases involving indecent images of children, sexual assault, drug dealing, terrorism and other crimes. The techniques might vary slightly from case to case but are likely to include many of the same standard processes.
An automated process is used to compare all of the image files on the device with a huge collection of image files that are held by the police and known to be indecent images of children. An image file can be a still picture or a movie. Images can also be viewed and assessed manually by an examiner looking at a gallery of small versions of any images not identified during the automated process.
A list of about thirty words or phrases (or more or less) is often used during a device search to see if any of the words or phrases can be found on a device. The words or phrases are terms that the police often find on devices containing indecent child images. The search is to locate words and phrases that occur in the names of files that contain indecent images of children or that are used in web searches for child images or appear in chat messages or emails or elsewhere.
Can the police retrieve deleted data from a device?
An image file is identified as “accessible” when the file is in a folder that a typical computer user might easily access including the “Pictures” and “Videos” folders on a Windows computer.
Image files can be saved on a device by an automatic software process. For example, all of the pictures displayed as part of a webpage when web browsing are automatically saved. Typical users of a device would not be able to locate pictures that have been automatically saved by web browser software. These and other automatically saved image files are identified as “inaccessible” by a typical device user.
“Accessible” and “inaccessible” image files can also be identified as “deleted” or as “not deleted”. Computers and other digital devices do not immediately delete a file when a device user requests that the file be deleted. The space occupied by a deleted file is marked as available for re-use. The content of a deleted file can be recovered until the space occupied by the file is re-used and the content of the file is overwritten. It can be days or months before a deleted file is overwritten and the content cannot be recovered.
The police usually describe a file in the “trash” as “accessible” and “undeleted” because the content of the file can be easily recovered by a typical device user.
Police device examiners will produce reports listing the evidence that they find. A report might show lists of files that are indecent child images showing the filename, the folder location and the date that the file was saved onto the device. Other reports might list webpages viewed on screen, web browser searches or the text of emails or chat messages.
Can the police unlock your device without the password?
Mobile devices, including laptop computer, phones and tablets, are usually protected by a PIN code or a fingerprint or other means. The content of mobile devices is often encrypted. Typically, the police will ask for the PIN code or password or other means that protects or encrypts a device. The police can use specialised devices and software that can access mobile devices when access and encryption codes are not available. Successful access to locked mobile devices typically depends upon the age of the mobile device and the version of the software that is running. It is usually only the most recent models of a device that the police cannot access.
What other data can the police use as evidence?
The police often rely on chat messages and cell site data in cases including drug dealing and sexual assault. It is sometimes possible to recover SMS text messages or chat messages in WhatsApp and other chat apps even after the messages or entire chats have been deleted.
A mobile phone stays connected to mobile phone masts at all times so that the phone is able to receive incoming calls. Mobile phone companies retain a log of this cell site data that lists the masts that a phone connects to and the times of the connections as the location of the phone changes.
The police might use the content and the dates and times of SMS text or chat messages with cell site data to show, for example, who might have been meeting with who and the location of that meeting.
What are the legal defences in cases involving digital evidence?
Defence solicitors can instruct a computer specialist to examine the report evidence produced by the police and to re-examine devices. A defence computer specialist can offer advice to solicitors regarding the examination of evidence by the defence.
A computer specialist might be able to identify gaps in the police evidence. It might be that there is not good evidence of intent to display indecent child images on screen or to save image files on a device or not good evidence of knowledge that image files had been saved on a device.
Images displayed on a webpage
The police evidence might show that image files are on a device because the images were in a webpage that has been displayed on screen by web browser software. It might be that the evidence does not show what was clicked or typed to cause the webpage to be displayed on screen. The defence might say that the webpage could have popped-up automatically onto the screen. Alternatively, a webpage that includes child images might be displayed after a click on some text that indicated a link to legal adult material.
Images saved in a folder
Image files might be saved in a folder indicating that the files came onto the device via file sharing software. There might be no evidence to show what was searched for or which files were selected to start the download of image files. The defence might say that an attempt to download multiple files containing legal pornography had accidentally downloaded illegal images.
Files might be in folders indicating that the files have come onto a device as attachments to an email or chat message. The evidence might not include emails or chat messages requesting that illegal images are sent to the device. The defence might say that unsolicited illegal images have, for example, been sent to the device by an unknown stranger as part of a group chat.
Thumbnail pictures
It is often useful to have a computer specialist interpret evidence that includes thumbnail pictures. Thumbnail pictures are the small pictures that are seen when multiple pictures are simultaneously displayed in a grid on screen in a gallery view. A thumbnail is usually created automatically by software and is derived from an original large version of a picture. The thumbnail can remain on a device after the original large version has been deleted. The software that created a thumbnail image is usually indicated by the folder location of the thumbnail file. The date that a thumbnail was created is often not available because of the way that some thumbnails are stored.
The defence might be able to offer an alternative interpretation of thumbnail image evidence. For example, a thumbnail might be created automatically at the moment that an image is included in a display on screen of a list of files that have not been viewed.
Deleted files
It is usually not possible to find evidence showing when a file was deleted from a device. The filename, folder location, creation date and other information is often lost within a few days or weeks after a file is deleted. The content of the file can remain after filename and other information is lost. The defence might be able to say that one or more deleted image files came to be on a device by accident if there is no evidence to show the folder location and creation date for the file.
The defence might be able to say that an image file could have been deleted moments after it came to be on a device because devices do not record the date and time of a file deletion.
Automatic saving of files
A computer specialist can research and test the operation of devices and software. For example, some chat messaging apps automatically save pictures and videos onto a device while other chat apps require a user of the device to tap the screen to cause a file to be saved onto the device.
Chat messages
The interpretation of chat messages requires care because chat messages can be recovered from a device after messages and entire chats have been deleted. The recovery of messages can be partial and a sequence of messages that is initially viewed as a complete chat might be incomplete. For example, the defence might be able to say that a message that appears to be the answer to one question might actually be the answer to another question that has been lost after being deleted.
Police reports
A computer specialist can clarify the remarks of police officers used during interviews and in witness statements. The reports prepared by police device examiners sometimes lack clarity. The comments that officers make during interviews can suffer from this lack of clarity when, for example, officers describe deleted image files as being still accessible on a device.
Misunderstandings and omissions can occur with evidence from digital devices. A solicitor can ask a specialist to look at evidence from phones and computers. A specialist can help a solicitor to identify gaps and inaccuracies in the evidence.
A specialist can help to ensure that the lawyers and others in a case have a complete and correct understanding of the technical evidence.
Contact our criminal defence lawyers today
For a free initial consultation, urgent specialist advice, immediate representation, or to speak to us confidentially about allegations involving digital evidence, please do not hesitate to get in touch.
You can contact our dedicated criminal defence lawyers in London, Birmingham, and Manchester by telephone on:
- Brent & Camden London Office: 0207 624 7771
- Manchester Office: 0161 835 1638
- Birmingham Office: 0121 614 3333
- City of London: 0207 624 7771 (our senior Solicitors and Partners can meet by appointment in the City)
Or email: solicitors@jdspicer.co.uk
Alternatively, you can fill out our quick online enquiry form, and we will get back to you as soon as possible.
24/7 legal representation for crimes involving digital evidence
Please get in touch for a free initial consultation with one of our expert criminal defence solicitors, as well as immediate representation and advice on dealing with allegations that involve digital evidence.
We are available to represent clients all over England and Wales at any time, so please contact our Emergency Number at 07836 577 556.
How can we help?
Common questions
We always work with the most experienced and best leading UK barristers, KCs (Kings Counsel). We cover all criminal cases 24/7 at the police station and court. Offices in London, Birmingham, and Manchester cover cases across England and Wales. We can offer Legal Aid and affordable Private fee agreements. We can see you the same day, including virtually. Our Senior Partners supervise all of our cases.
How quickly do you respond?
We respond quickly even during out of hours. We do not get our work by paying for online adverts but based on the fact that few criminal law firms can match our 45 years of experience. Most of our cases are still from word-of-mouth recommendations from satisfied clients. We are called daily by dissatisfied clients from firms with less experience than us. We respond very quickly to new enquiries. We know what clients seek and so we update clients rapidly.
Can you get cases dropped?
Yes, read about the recent cases we've helped our clients with here.
We always keep you updated and give straightforward advice. We will get cases dropped early where the case is weak or should not be prosecuted. We will be upfront with you about where you can benefit from a good result with an early guilty plea, such as a discount on your sentence. As we work on cases across all levels with clients from all walks of life, we are excellent at giving clear, spot-on advice. As an established firm, we can allocate a whole team to your case often at short notice to secure evidence to minimise the damage to you.
Have you won any awards?
OUR PROFESSIONAL BODY THE LAW SOCIETY AWARDED US IN OCTOBER 2020 WITH THE EXCELLENCE IN CLIENT SERVICE AWARD AND STATED -
"JD Spicer Zeb demonstrated a clear commitment to client service through their work with vulnerable and diverse individuals in what can be severely traumatic circumstances".
Do you offer free consultations?
Where it is possible, we aim to provide an initial consultation to you. If we can speak to you, we can if required inform you about –
- Whether we can take the case on and our relevant experience.
- Public and private funding benefits.
- Assistance in applying for legal aid where we are likely to accept instructions.
- An outline of options in police interview only. We will not advise you on which option to adopt.
- Providing our free written guide explaining the police station process.
- The gravity of routine and day-to-day offences you face.
- Consequences of not attending the court or police station.
- Consequences of interfering with any witnesses.
- Retaining any evidence in support of your case.
- If possible an outline of the elements of the offence that the police or CPS must prove.
- This consultation will normally be by telephone or email and will only be for as long as we deem necessary to establish if we can act for you. If we cannot usefully give you any advice in this manner then we will not continue with the consultation. We will not discuss the case in depth for you to be able to decide on your plea or any significant aspect of the case, as this cannot be undertaken informally.
- Referring you, if possible, to other firms for matters out of our specialism or if we cannot help.
Consultations do not apply to the following cases –
- If we do not intend to take the case on.
- Road Traffic cases, drink driving, drug driving, driving bans, speeding, no insurance, mobile phone use, points etc.
- In all cases where we do not have the capacity to take your case or the availability of suitably qualified staff to provide an initial free consultation. This is applicable in all cases but especially where a more senior lawyer is required because of your personal needs or the complexity of the case.
- Harassment/stalking/ coercive behaviour/malicious communications or road traffic cases and most sensitive cases. These cases are often too complicated to assess in short consultations.
- The locations concerned may be too distant to represent you adequately or it may not be cost-effective for you or us.
- The case is too complicated to assess or raises various charges or facts, complexity, or history to be considered informally or in a short consultation.
- In most Legal aid transfers where legal aid is granted to another firm except in very grave cases, we may assess the case and merits for a transfer.
- If your relationship has broken down with your existing solicitor or several solicitors.
- If you have been released under investigation and have already had a police station attendance.
- If you hold legal aid with another firm and seek a second opinion.
- If you are calling on behalf of the client as a friend or family member unless you have full authority and full facts.
- To businesses.
- Advising whether you were given good advice by your other solicitor.
- Whether to decide to plead guilty or not guilty.
- Whether you have an arguable defence in law or factually complicated defences.
- Any advice you have had after your first court appearance.
- Any advice on appeal on conviction or sentence.
- If we feel we are unable to communicate with you.
- If we are likely to be conflicted or breach our professional rules.