Computer Evidence

R v Paul Stubbs Isleworth Crown Court, T20047422 July 2005.

R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312 Case No: 2005/04469/C1.

Conspiracy to defraud. £12M Online banking fraud at HSBC. Password resetting. Expert evidence. For the convicted Defendant.

Appeal rejected. Held that the independence of an expert witness goes to weight not admissibility

Mr G S Virdi v Commissioner of Police of the Metropolis London North Employment Tribunal 2202774/98 (Computers and Law, February 2001)

Employment. Racial Discrimination - racist documents. For the successful Applicant

R v Nicol and Moore Bristol Crown Court, T19990561

Abuse of Process. Mishandling of computer evidence (Theft of insurance database). For the acquitted Defendant

R v Patel Aylesbury Crown Court (Computers and Law, May 1994)

Computer Misuse. Unauthorised Modification - "wrecking programs". For the acquitted Defendant

IBCOS Computers v Barclays Mercantile Highland Finance ([1994] FSR 275)

Software Copyright infringement - literal copying. For the successful Claimant

"undoubtedly an expert in computers and software"

Caulfield J, Kt in Richards Longstaff and Partners Limited v Lombard North Central plc

"eminently qualified"

HHJ Slack in R v Patel

"knowledgeable and fair"

HHJ Jacob QC in IBCOS Computers Limited v Barclays Mercantile Highland Finance Limited

"his written reports were models of clarity, brevity and balance and his oral evidence was always balanced and authoritative. I was able to rely on that evidence extensively"

HHJ Thornton QC in Open Systems Design v The British Millerain Co Limited

"well qualified"

HHJ Darwell-Smith in R v Nicol and Moore

"The timing of the file system activity is important, and we have carefully examined the evidence presented"

HHJ David Pearl in Andrew Charles Mogford v Secretary of State for Education and Skills

Lord Justice Richards in R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312

Blackmail

Confidential data recovered from hard disk of recycled PC

Breach of contract

Sale of business, Property lease

Supply of computer systems (Compliance with contract specification)

Computer Misuse Act 1990 Ss 1, 2, 3

Confidential information

Customer and Contact data, Databases, Designs, Drawings, Specifications

Drugs

Distribution (Telephone call records)

Employment

Internet abuse, Inappropriate Use, Racial Discrimination, Disability Discrimination, Racist documents

False Accounting

Retail sales commission

Fraud

Online Banking (Theft of £12,000,000), Banking, Credit Card (Identity theft)

Domain Slamming (Whois? database Data Mining, Spam, Domain name registrations, renewals and transfers)

Investment, Insurance and Mortgage frauds

Indecent Images of Children

Possession of and Making indecent photographs of children

Internet libel

Web site and E-mail defamation,

Intimidation of witnesses

Falsifying Witness Statements

Money Laundering

Internet Banking

Murder and Manslaughter

Serial Killer, Contract Killing, Road Traffic Accident

Negligence

Legal advice

Perverting the course of justice

Editing, Amending, Fabricating documents

Police computer systems

Telephone call records (SPOC); security and system event logs

Sexual Harassment

Stalking (Indecent letters)

Software Copyright infringement

Literal copying of software specifications, design documents and program source code

Terrorism Act 2000 Ss38, 57, 58

Failing to disclose information about terrorism.

Possessing documents likely to be of use to a person engaged in instigating, preparing or committing an act of terrorism

Computing platforms

Mainframes, minis, LANs, WANs, POS networks, PCs, Mail servers, Database servers, Internet

Databases

Database (MS Access, SQLServer) tables, change history and database applications

Application databases (Thumbs, AOL PFC, Windows Media Player, P2P File-sharing - Kazaa and IMesh, iTunes, Whois?)

Date and time stamps

File system date-stamps (File Created, Last Modified, Last Accessed), Software application (MS Word, MS Excel) metadata, System clock settings, Timezones and Daylight saving (BST) settings

Deleted files

Recovery of deleted files, Recycle Bin, Norton Recycler

Documents

Document version history, revision history, print history, authenticity, authorship (MS Word, MS Excel, Lotus)

Domain Names

Domain name registration records, domain name transfer records

E-mail

Client-based E-mail and E-mail archives (Outlook, Outlook Express), Web-based E-mail and E-mail archives (AOL, Hotmail)

Evidence Elimination

Anti-forensics secure deletion (Evidence Eliminator, Eraser, Sure Delete)

Forensic image copy formats

EnCase, dd, FTKI, SMART, ditu, DIBS, Vogon

Hard disk drives

History of formatting, defragmentation, wiping of hard disk drives

Hardware configuration

History of changes to hardware configuration/installation

Log files

Activity logs, Audit trails, Event logs, Internet Access logs

Media

Hard disk drives, CDs, DVDs, USB memory sticks, removable media, obsolete media formats

Operating system

History of Windows installation, re-installation, upgrades

Passwords

Logon and Account Password setting, changes, resetting; password recovery, cracking

Program source code

Program source code in C, C++, Visual Basic, Java, HTML, XML, MS Access, Basic, COBOL, DIBOL, command scripts

Registry settings

System settings (Configuration, Last Use, Last User, Last Shutdown) and User settings (IE Search terms, Typed URLs and Auto Logon IDs)

Software version

Software version change control history

Telephone call records

Communications traffic data - telephone service provider call records (SPOC)

User Identity

User ID, Account ID, Logon ID, MAC, SID, GUID, Passwords, Shared Logons, Unattended Logons

Web archives

Web archive searches, Presence or absence of web-pages, web-page versions, News archives, State of the Art

Web browsing

Web browser (Internet Explorer - IE, Netscape, Mozilla) cache, Browser history files (active and deleted)

Bookmarks, Favorites, Cookies, Google searches