BCSThe Academy of Experts: Michael J L TurnerExpert Witness Institute: Michael J L TurnerUK Register of Expert Witnesses

Michael J L Turner MA FBCS CITP MAE FEWI

Michael J L Turner is an experienced forensic computer examiner and an established expert witness on computer evidence who has acted in over 200 cases.

A forensic computer examination is an investigation that:

  • complies with established computer forensic principles
  • uses appropriate computer forensic techniques
  • identifies data relevant to a case and
  • produces exhibits for the court

Independent expert evidence helps the court to assess whether data from a computer system used as evidence is:

  • original, authentic, accurate and or complete
  • corroborated by other computer evidence
  • correctly interpreted and
  • reliable as evidence

Experience in Court

Michael Turner has twenty-five years' experience as an expert witness (for both Prosecution and Defence) on computer data used as evidence in criminal cases heard in the Crown Courts at:

Aylesbury Chichester Nottingham
Basildon Croydon Peterborough
Birmingham Exeter Plymouth
Blackfriars Inner London Sheffield
Bristol Isleworth Snaresbrook
Caernarfon Kingston-upon-Thames Southwark
Cambridge Leeds Swansea
Cardiff Lincoln Winchester
Central Criminal Court Liverpool Woolwich
Chelmsford Merthyr Tydfil Worcester
Chester Newcastle upon Tyne York

He also has experience of :

  • Civil courts (for Claimant and Defendant and as Single Joint Expert)
  • Employment Tribunals (for Applicant and Respondent)
  • Care Standards Tribunal (Appeal against List 99 blacklisting)
  • Family Court (Review of computer evidence from previous criminal case)
  • Court Martial

Significant cases

Significant cases where Mr Michael J L Turner has given expert evidence include:

R v G Plymouth Youth Court 20 July 2016 DDoS attacks against Devon and Cornwall Police, Sea World and other animal rights target websites; Twitter bomb hoaxes to American Airlines and Delta Air Lines. Computer Misuse Act Section 3. Expert evidence for the convicted Defendant. Agreed Joint Experts Report.
E and F Patents. Extensive Historic Web searches for availability of documents. Strategy, Search terms, Search engine indexes, Cache, Mirror and Archive sites including Wayback Machine
Amira G Foods Ltd v RS Foods Ltd Contract. Integrity of the contents of versions of a document. Interpretation of Excel spreadsheet metadata, datestamps.

AFD Software Ltd v DCML Ltd [2015] EWHC 453 (Ch) 2 March 2015

Software licensing. Software copyright. What is a copy? When, how and how often are they made?
C and D Software Copyright. Expert Adviser to potential Claimant in software copyright infringement dispute. Pre-action Source code comparison
Royal Brompton & Harefield NHS Trust v S Contempt of court - Breach of Injunction. Harassment. Fake job applications to NHSJobs. Fake LinkedIn profiles; Defamatory material in emails and Wordpress Blogs
R v Paul Toland Belfast Crown Court 11 December 2014. Murder. ANPR sighting records
R v Andrey Ryjenko Central Criminal Court (for trial) Corruption. International banking. Emails - Absence of evidence. Integrity of evidence from multiple sources and jurisdictions. Historic development of Best Practice in computer forensics
R v John Ward St Albans Crown Court 17 October 2014. Murder. ANPR sighting records
R v Paul Ambrose Basildon Crown Court 7 January 2014 T20130405 Fraud. ANPR images and sighting records. Absence of evidence. S78 PACE Exclusion of Unfair evidence. Prosecution offer no evidence. Defendant acquitted of all charges. Expert evidence for the Defence
R v Stephen Augustin Southwark Crown Court 8 November 2013 T2013-0430 Possession of Class A Drugs with intent to supply. ANPR images and sighting records (Met Police and TFL Congestion Charge Zone). For the acquitted Defendant.
R v Ozkan Duyan Sheffield Crown Court 27 March 2013 Conspiracy to Import Class A Drugs (100kg of ecstasy). ANPR images and sighting records; Facebook messages, Gmail emails. For the convicted Defendant
R v Norman Idris Faridi Central Criminal Court 14 March 2013 T20120210 Possession of documents (Terrorism Act 2000, Section 58). Reliability of recovered deleted files. Truecrypt encryption. Corruption of evidence. Convicted on one of three charge files. For the Defendant.
Post Office Ltd v Kym Wyllie Newcastle Crown Court Theft relating to cash shortfalls on Post Office Horizon. Preliminary Review and Disclosure Requests. Prosecution discontinued. For the Defendant.
A and B Expert Adviser to potential Claimant in software copyright infringement dispute. Source code examination. Dispute settled.
Phaestos Limited and Mindimaxnox LLP v Peter Ho; IKOS CIF Limited, Phaestos Limited and Mindimaxnox LLP v Tobin Maxwell 'Sam' Gover [2012] EWHC 2756 (QB) 16/10/2012 Software copyright infringement. Bespoke Hedge Fund applications. For the Claimants.
R v Anton Benjamin Vickerman Newcastle Crown Court 27 June 2012 T20097188

Conspiracy to defraud the film industry, enabling access to copyright material. Private prosecution by FACT (Federation Against Copyright Theft) of the operators of linking website surfthechannel.com. For the convicted Defendant.

R v Kernjit Gill Dhillon Southwark Crown Court 19 June 2012 T20117046 £39m VAT fraud from trading EU carbon credits using Yahoo Messenger. Instant message chat logs. For the acquitted Defendant.
Caldervale Technology Ltd v Advanced Technical Systems Ltd Chancery Division

Software copyright. Literal similarities. Source code comparison. Single Joint Expert.

R v Yasmin Zinga Snaresbrook Crown Court July 2011 Conspiracy to defraud (£144m). Using Decryption to access subscription cable television channels. Private Prosecution (Virgin Media Ltd) of supplier of Eurovox set top boxes. For the acquitted Defendant.
R v Julia Richards Winchester Crown Court April 2011

Theft and Fraud relating to cash shortfall from Post Office Horizon system.

R v Bilal Zaheer Ahmad Nottingham Crown Court 13 May 2011 Soliciting to murder Members of Parliament. Posts on Revolution Muslim blog following attempted murder of Stephen Timms MP.
HM Advocate v Sheridan and Sheridan High Court Glasgow 23 December 2010

Perjury (Thomas Sheridan v News Group Newspapers Ltd 2006). Prejudicial pre trial publicity on the internet. Web searches for availability of documents. Strategy, Search terms, Search engine indexes, Cache, Mirror and Archive sites

Koger Inc and Koger (Dublin) Limited v James O’Donnell, Roger Woolman, David Gross, HWM Financial Solutions Limited [2010] IEHC 350 8 October 2010

Software copyright. Fund Managment application. Software comparison of source code and database design.

R v Mohammed Usman Saddique Inner London Crown Court 1 February 2010

Acts Preparatory to Terrorism (2006 Transatlantic aircraft plot). No Case to answer, case dismissed.

R v Renu Subramaniam Blackfriars Crown Court 14 January 2010 Conspiracy to defraud, furnishing false information. Darkmarket (FBI sting operation). For the convicted Defendant.
R v Nabeel Hussain Woolwich Crown Court 9 December 2009 Acts Preparatory to Terrorism (2006 transatlantic aircraft plot). For the convicted Defendant.
R v Donald Stewart Whyte Woolwich Crown Court 7 September 2009 Conspiracy to cause explosions on aircraft and conspiracy to murder (2006 transatlantic aircraft plot). For the acquitted Defendant.
R v Abrar Mirza Croydon Crown Court 15 May 2009 Conspiracy to recklessly damage property and endanger life (firebombing the London home of a publisher). For the convicted Defendant.
R v Waris Ali Leeds Crown Court 22 October 2008 Possession of The Anarchist Cookbook by teenager for a purpose connected with the commission, preparation or instigation of an act of terrorism. For the acquitted Defendant.
R v Mohammed Shakil and Others Kingston Crown Court (ReTrial) 28 April 2009 Conspiracy to attend terrorism training: Defendant convicted
R v Mohammed Shakil and Others Kingston Crown Court 1 August 2008 Conspiring to cause an explosion (July 7 plot London target reconnaissance mission). For the acquitted Defendant

R v Sabeel Ahmed Central Criminal Court 11 April 2008

Failing to disclose information about terrorism s38 (brother of Kafeel Ahmed Glasgow Airport attack suspect). For the convicted Defendant.

R v Mohammed Al-Figari Woolwich Crown Court 26 February 2008

Attending terrorist training camps, Possessing a record containing information likely to be useful to a terrorist (Terror camp plot). For the convicted Defendant.

R v Wahbi Mohammed Kingston Crown Court 4 February 2008.

Failing to disclose information about terrorism, assisting an offender, prior knowledge of July 21 terrorism plot. For the convicted Defendant.

Richard Paul Knowlden v Simin Nafis Tehrani and Ors [2008] EWHC 54 (Ch) Chancery Division 23 January 2008

Forged documents - Property fraud. Forgery of a large number of key financial documents. For the successful Claimant.

Gurpal Virdi v Associated Newspapers Limited Queens Bench Division August 2007

Libel. Article published in the Daily Mail (see Mr G S Virdi v Commissioner of Police of the Metropolis). For the successful Claimant.

R v Iqbal and Others Central Criminal Court 24 July 2007 and Zafar & Ors v R [2008] EWCA Crim 184 Court of Appeal (Criminal Division) 13 February 2008

Possession of Islamic literature by Bradford University students. Defendant convicted. No direct proof found that extremist material was intended to be used to plan terrorist acts. Appeal allowed, conviction quashed.

R v Q : Inner London Crown Court 22 January 2007. Re-trial Inner London Crown Court 6 June 2007

Systems administrator alleged to have deleted data on employer's system in revenge attack; losses estimated in hundreds of thousands. Computer Misuse Act 1990 S3. Trial collapsed after four days. At re-trial, Prosecution offer no evidence. Defendant acquitted of all charges. Expert evidence for the Defence in both trials.

Angus Sinclair v H M Advocate Appeal Court High Court of Justiciary Edinburgh [2007] HCJAC 27 Appeal No: XC903/06

Murder, Rape (the World's End murders). Prejudicial pre trial publicity on the internet. Web searches for availability of documents. Strategy, Search terms, Search engine indexes, Cache, Mirror and Archive sites

Point Solutions Limited v Focus Business Solutions Limited [2005] EWHC 3096 (Ch) Chancery Division. Point Solutions Limited v Focus Business Solutions Limited [2007] EWCA Civ 14 Court of Appeal (Civil Division)

Software Copyright infringement. Single Joint Expert

R v Paul Stubbs Isleworth Crown Court, T20047422 July 2005 and R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312. Case No: 2005/04469/C1

Conspiracy to defraud. £12M Online banking fraud. Password resetting. Expert evidence. For the convicted Defendant. Appeal rejected. Independence of an expert witness goes to weight not admissibility

Andrew Charles Mogford v Secretary of State for Education and Skills Care Standards Tribunal 2002. 11. PC Indecent Images of Children. Appeal against List 99 blacklisting of teacher after appeal against conviction allowed by the Crown Court. For the successful Respondent

Mr G S Virdi v Commissioner of Police of the Metropolis London North Employment Tribunal 2202774/98 (Computers and Law, Feb 2001)

Employment. Racial Discrimination - racist documents. For the successful Applicant

R v Nicol and Moore Bristol Crown Court, T19990561

Abuse of Process. Mishandling of computer evidence (Theft of insurance database). For the acquitted Defendant

R v Patel Aylesbury Crown Court (Computers and Law, May 1994)

Computer Misuse. Unauthorised Modification. For the acquitted Defendant

IBCOS Computers v Barclays Mercantile Highland Finance ([1994] FSR 275)

Software Copyright infringement - literal copying. For the successful Claimant

Experience - Cases

Michael Turner has experience as an expert witness in a wide range of cases including:

Blackmail

Confidential data from hard disk of recycled PC

Breach of contract

Sale of business, Property lease. Supply of computer systems (Compliance with contract specification)

Computer Misuse Act 1990 Sections 1, 2, 3, 3A

Time locks, Logic-bombs, and Hacking

Confidential information

Customer and Contact data, Databases, Designs, Drawings, Specifications

Divorce Recovery of over 50 versions of a deleted document. Fabrication of financial statements

Drugs

Mobile phone call records, ANPR images and sighting records

Employment

Internet abuse, Inappropriate Use, Racial and Disability Discrimination, Racist documents

False Accounting

Retail commission

Fraud

Investment, Insurance and Mortgage frauds. Online Banking (Theft of £12,000,000), Credit Card (Identity theft). Domain Slamming (Whois? Data Mining, Domain name registrations). VAT missing trader

Immigration People Smuggling - Immigration Act 1971

Internet libel

Web site and E-mail defamation

Intimidation of witnesses

Falsifying Witness Statements

Money Laundering

Internet Banking

Murder and Manslaughter

Serial killer, Contract Killing, Road Traffic Accident

Negligence

Legal advice

Perverting the course of justice

Editing, Amending, Fabricating documents in evidence

Police computer systems

Telephone call records (SPOC); security and system event logs

Sexual Grooming Online chat with minors

Sexual Harassment

Stalking (Indecent letters)

Software Copyright infringement

Literal copying of software specifications, design documents, database and program source code

Terrorism Act 2000 Sections 38, 57, 58

Possessing documents likely to be of use to a person engaged in instigating, preparing or committing an act of terrorism. Failing to disclose information

Data Examination Experience

Michael Turner has experience of the following sources of evidence and evidential artifacts:

Computing platforms

Mainframes, minis, LANs, WANs, POS networks, PCs, Mail servers, Database servers, Internet

Databases

Database (MS Access, SQLServer) tables, change history and database applications. Application databases (Thumbs, AOL PFC, Windows Media Player, P2P File-sharing, iTunes, Whois?)

Date and time stamps

File system date-stamps (File Created, Last Modified, Last Accessed), Software application (MS Word, MS Excel, MS Outlook) metadata, System clock settings, Timezones and Daylight saving (BST) settings

Deleted files

Recovery of deleted files, Recycle Bin, Norton Recycler. Certainty and Reliability

Documents

Document version history, revision history, print history, authenticity, authorship (MS Word, MS Excel, Lotus). Document fabrication, amendment, doctoring, forgery.

Domain Names

Domain name registration and transfer records

E-mail

Client-based E-mail and E-mail archives (Outlook, Outlook Express), Web-based E-mail and E-mail archives (AOL, Google, Hotmail)

Encryption Truecrypt encryption and decryption (with/without Truecrypt password)

Evidence Elimination

Anti-forensics secure deletion (Evidence Eliminator, Eraser, Sure Delete)

Forensic image copy formats

EnCase, dd, FTKI, SMART, ditu, DIBS, Vogon

Hard disk drives

Formatting, defragmentation, wiping of hard disk drives

Hardware configuration

History of changes to hardware configuration

Link files History of access to files on hard disk and removable storage media

Log files

Activity logs, Audit trails, Event logs, Internet Access logs

Media

Hard disk drives, CDs, DVDs, USB memory sticks, removable media, obsolete media formats

Messaging Chat logs (ICQ, IRC, MSN, NetMeeting, Skype, Yahoo Messenger)

Operating system

Windows installation, re-installation, upgrade history

Passwords

Logon and Account Password setting, changes, resetting; password recovery, cracking

Program source code

Program source code: C, C++, VB, Java, HTML, XML, MS Access, Basic, COBOL, DIBOL, command scripts

Registry settings

System settings (Configuration, Last Use, Last User, Last Shutdown) and User settings (IE Search terms, Typed URLs and Auto Logon IDs). Skype

Software version

Software version change control history

Telephone call records

Mobile traffic data - service provider call records (SPOC)

User Identity

User ID, Account ID, Logon ID, MAC, SID, GUID, IP address, Passwords, Shared Logons, Unattended Logons

Web archives

Web archive searches, Presence or absence of web-pages, web-page versions, News archives

Web browsing

Web browser (Internet Explorer - IE, Netscape, Mozilla, Firefox, Chrome) cache, history files (active and deleted). Bookmarks, Favorites, Cookies, Google searches

Applications Experience

Michael Turner has experience of software applications in a very wide range of sectors, including:

Accountants Government Publishing
Army Insurance Recruitment
Banking Internet Retail
Business information Motor Trade and Racing Software
Computer industry Police Solicitors
Construction Post Office Horizon Telecommunications
Financial Services Property Web Apps

Comments on his Expert Evidence

"undoubtedly an expert in computers and software"

Caulfield J, Kt in Richards Longstaff and Partners Limited v Lombard North Central plc

"eminently qualified"

HHJ Slack in R v Patel

"knowledgeable and fair"

HHJ Jacob QC in IBCOS Computers Limited v Barclays Mercantile Highland Finance Limited

"his written reports were models of clarity, brevity and balance and his oral evidence was always balanced and authoritative. I was able to rely on that evidence extensively"

HHJ Thornton QC in Open Systems Design v The British Millerain Co Limited

"well qualified"

HHJ Darwell-Smith in R v Nicol and Moore

"The timing of the file system activity is important, and we have carefully examined the evidence presented"

HHJ David Pearl in Andrew Charles Mogford v Secretary of State for Education and Skills

"an acknowledged computer expert" Lord Justice Richards in R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312

 

Qualifications

Michael J L Turner is:

  • a Master of Arts (University of Cambridge - Economics)
  • a Chartered IT Professional of the British Computer Society (BCS)
  • a Chartered Fellow of the British Computer Society
  • a Practising Expert of The Academy of Experts
  • a Fellow of The Expert Witness Institute
  • listed as an expert witness by UK Register of Expert Witnesses

Computer Forensics Training and Resources

  • AccessData: Intermediate Computer Forensics course
  • AccessData: Microsoft Windows Forensics course
  • AccessData: Internet Forensics course
  • ASR Data: Smart - Linux Forensics
  • X-Ways Software AG: X-Ways Forensics
  • F3 Training days and F3 Annual Conferences
  • AccessData forums
  • Digital Detective Forensic Forum
  • SmartForensics forum

Appointments

  • Assessor, BCS Expert Witness Register (1996 to 2001)
  • Convenor, Computer Evidence task group, BCS Legal Affairs Committee (1998 to 2001)
  • Alternate BCS representative on CRFP Digital evidence working group (2003 - 2005)
  • Expert Witness Institute representative on CRFP Digital evidence working group (2003 - 2005)
  • National Policing Improvement Agency (NPIA) Expert Adviser (2008 - 2012)

Publications

  • R v Vatsal Patel - the Computer Misuse Act 1990, s 3(1) (Computers and Law, April 1994)
  • Beware: Computer Evidence Quicksand (Computers and Law, February 2001, 36)
  • Co-author of the BCS Submission to Lord Justice Auld's Criminal Court Review (March 2000)
  • Co-author of the BCS Submission on the CRFP draft proposals on Digital evidence (January 2004)
  • Extracts from his Submission to the Metropolitan Police Authority were cited in the MPA's Virdi Inquiry Report
  • Registered Forensic Practitioner: A New Breed of Expert (Computers and Law, March 2006)
  • Recent Developments affecting IT Expert Witnesses (Computers and Law, October 2010)

Current Professional Interests

  • Authenticity, Accuracy, Certainty and Reliability of questioned documents, e-mails, records, audit trails and logs
  • Procedures for preserving, imaging, and verifying evidence: Pull the Plug vs Live Forensics
  • Validity of novel computer forensic techniques and interpretation - Junk Science?
  • Integrity of exhibits from police databases (Police National Computer (PNC), National DNA Database (NDNAD), ANPR)
  • Evidence in Computer Misuse Act prosecutions
  • Retrospective investigation - Cold Case Review. State of the Art
  • Expert Determination

 

 

Professional Services

Historic Case Reviews

Historic Case Review (Appeal, Independent Review, Public Inquiry) services:
  • Verification of the integrity of handling computer evidence
  • Verification of the findings of previous forensic investigations
  • Distinguishing between fact, speculation, assumption, inference and expert opinion in the interpretation and evaluation of computer evidence
  • Assessment of previous computer forensic investigations in the light of developments in computer forensic Best Practice - accepted, novel or junk science?
  • Assessing the Certainty of computer evidence
  • Validity of retrospective evidence produced using modern forensic techniques
  • Preparation of Expert's Requests for Information and Disclosure

Expert Determination

Expert determination of disputes about computer evidence, for example:

  • Questioned Digital Documents - authenticity, integrity, chronology of amendments, authorship
  • Contested Expert evidence - interpretation and evaluation of digital evidence
  • Software Copyright infringement - literal copying of software development material including source code

Independent expert assessor

Acting as an Independent expert assessor (Independent Review, Public Inquiry).

Legal Aid work

Undertakes work funded by Legal Aid Agency including Very High Cost (VHC) cases

Pro Bono work

Prepared to advise pro bono where the misuse of computer evidence may have resulted in a miscarriage of justice.

Instructing Solicitors and Organisations

Instructed as an expert witness in well over 200 cases including by:

Addleshaw Goddard DAC Beachcroft Linklaters
Ashurst Department for Education Mackrell Turner Garrett
Baker & McKenzie DLA Piper Newcastle City Council
Berrymans Lace Mawer Duane Morris Osborne Clarke
Bindmans Geldards Pinsent Masons
Bird & Bird Fieldfisher Powell Gilbert LLP
Brabners Freshfields Bruckhaus Deringer Russell Jones & Walker
Brett Wilson Hogan Lovells Saunders Law
Cartwright King Imran Khan & Partners Shoosmiths
Clifford Chance Irwin Mitchell Slaughter and May
Crown Prosecution Service (CPS) Kennedys Treasury Solicitor

Contact Details

Name:

Michael John Livingston Turner

Qualifications

MA FBCS CITP MAE FEWI

Address:

Computer Evidence, Dulas Mill, Hereford, HR2 0HL, UK

E-mail:

expert@computerevidence.co.uk

Web:

www.computerevidence.co.uk

© Copyright Michael J L Turner 2006 - 2017