Home | Data Examination | Expert Evidence | Case Experience | Services | Michael J L Turner | Contact

Computer Evidence

Michael J L Turner MA FBCS CITP MAE FEWI RFP

Home > Michael J L Turner
E-mail Michael Turner e-mail Michael Turner
Print friendly page Print-friendly CV
E-mail this site Tell a colleague!
 

Michael J L Turner is an experienced forensic computer examiner and an established expert witness on computer evidence.

Computer Evidence is data from computer systems that is used as evidence in legal proceedings.

A forensic computer examination is an investigation that:

  • complies with established computer forensic principles
  • uses appropriate computer forensic techniques
  • identifies data relevant to a case and
  • produces exhibits for the court

Independent expert evidence helps the court to assess whether data from a computer system used as evidence is:

  • original, authentic, accurate and or complete
  • corroborated by other computer evidence
  • correctly interpreted and
  • reliable as evidence

Experience - Courts

Michael Turner has extensive experience of data examination and eighteen years' experience as an expert witness on computer data used as evidence in a very wide range of cases in:

  • Civil courts (for Claimant and Defendant and as Single Joint Expert)
  • Criminal courts (White-collar and general crime, for Prosecution and Defence)
  • Employment Tribunals (for Applicant and Respondent)
  • Care Standards Tribunal (Appeal against List 99 blacklisting)
  • Family Court (Review of computer evidence from previous criminal case)
  • Court Martial

Significant cases

Significant cases where Mr Michael J L Turner has given expert evidence in court include:

R v Paul Stubbs Isleworth Crown Court, T20047422 July 2005

 

R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312. Case No: 2005/04469/C1.

Conspiracy to defraud. £12M Online banking fraud. Password resetting. Expert evidence. For the convicted Defendant

Appeal rejected. Held that the independence of an expert witness goes to weight not admissibility

Andrew Charles Mogford v Secretary of State for Education and Skills Care Standards Tribunal 2002. 11. PC Indecent Images of Children. Appeal against List 99 blacklisting of teacher after appeal against conviction allowed by the Crown Court. For the successful Respondent

Mr G S Virdi v Commissioner of Police of the Metropolis London North Employment Tribunal 2202774/98 (Computers and Law, February 2001)

Employment. Racial Discrimination - racist documents. For the successful Applicant

R v Nicol and Moore Bristol Crown Court, T19990561

Abuse of Process. Mishandling of computer evidence (Theft of insurance database). For the acquitted Defendant

R v Patel Aylesbury Crown Court (Computers and Law, May 1994)

Computer Misuse. Unauthorised Modification - "wrecking programs". For the acquitted Defendant

IBCOS Computers v Barclays Mercantile Highland Finance ([1994] FSR 275)

Software Copyright infringement - literal copying. For the successful Claimant

Comments on Expert Evidence of Michael J L Turner

"undoubtedly an expert in computers and software"

Caulfield J, Kt in Richards Longstaff and Partners Limited v Lombard North Central plc

"eminently qualified"

HHJ Slack in R v Patel

"knowledgeable and fair"

HHJ Jacob QC in IBCOS Computers Limited v Barclays Mercantile Highland Finance Limited

"his written reports were models of clarity, brevity and balance and his oral evidence was always balanced and authoritative. I was able to rely on that evidence extensively"

HHJ Thornton QC in Open Systems Design v The British Millerain Co Limited

"well qualified"

HHJ Darwell-Smith in R v Nicol and Moore

"The timing of the file system activity is important, and we have carefully examined the evidence presented"

HHJ David Pearl in Andrew Charles Mogford v Secretary of State for Education and Skills

"an acknowledged computer expert" Lord Justice Richards in R v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006 [2006] EWCA Crim 2312

Experience - Cases

Michael Turner has extensive experience of computer examination and as an expert witness on the reliability of computer data used as evidence in a very wide range of cases including:

Blackmail

Confidential data recovered from hard disk of recycled PC

Breach of contract

Sale of business, Property lease

Supply of computer systems (Compliance with contract specification)

Computer Misuse Act 1990 Ss 1, 2, 3

Time locks, Logic-bombs, and Hacking

Confidential information

Customer and Contact data, Databases, Designs, Drawings, Specifications

Divorce Recovery of over 50 versions of a deleted document. Fabrication of financial statements

Drugs

Distribution (Telephone call records)

Employment

Internet abuse, Inappropriate Use, Racial Discrimination, Disability Discrimination, Racist documents

False Accounting

Retail commission

Fraud

Online Banking (Theft of £12,000,000), Banking, Credit Card (Identity theft)

Domain Slamming (Whois? database Data Mining, Spam, Domain name registrations, renewals and transfers)

Investment, Insurance and Mortgage frauds

Indecent Images of Children

Possession of and Making indecent photographs of children

Internet libel

Web site and E-mail defamation

Intimidation of witnesses

Falsifying Witness Statements

Money Laundering

Internet Banking

Murder and Manslaughter

Serial killer, Contract Killing, Road Traffic Accident

Negligence

Legal advice

Perverting the course of justice

Editing, Amending, Fabricating documents in evidence

Police computer systems

Telephone call records (SPOC); security and system event logs

Sexual Grooming Online chat with minors

Sexual Harassment

Stalking (Indecent letters)

Software Copyright infringement

Literal copying of software specifications, design documents and program source code

Terrorism Act 2000 Ss38, 57, 58

Failing to disclose information about terrorism.

Possessing documents likely to be of use to a person engaged in instigating, preparing or committing an act of terrorism

Data Examination Experience

Michael Turner has experience of the following Data Examination sources of evidence and evidential artifacts:

Computing platforms

Mainframes, minis, LANs, WANs, POS networks, PCs, Mail servers, Database servers, Internet

Databases

Database (MS Access, SQLServer) tables, change history and database applications

Application databases (Thumbs, AOL PFC, Windows Media Player, P2P File-sharing - Kazaa and IMesh, iTunes, Whois?)

Date and time stamps

File system date-stamps (File Created, Last Modified, Last Accessed), Software application (MS Word, MS Excel) metadata, System clock settings, Timezones and Daylight saving (BST) settings

Deleted files

Recovery of deleted files, Recycle Bin, Norton Recycler

Documents

Document version history, revision history, print history, authenticity, authorship (MS Word, MS Excel, Lotus)

Domain Names

Domain name registration records, domain name transfer records

E-mail

Client-based E-mail and E-mail archives (Outlook, Outlook Express), Web-based E-mail and E-mail archives (AOL, Hotmail)

Evidence Elimination

Anti-forensics secure deletion (Evidence Eliminator, Eraser, Sure Delete)

Forensic image copy formats

EnCase, dd, FTKI, SMART, ditu, DIBS, Vogon

Hard disk drives

History of formatting, defragmentation, wiping of hard disk drives

Hardware configuration

History of changes to hardware configuration

Link files History of access to files on removable storage media

Log files

Activity logs, Audit trails, Event logs, Internet Access logs

Media

Hard disk drives, CDs, DVDs, USB memory sticks, removable media, obsolete media formats

Operating system

History of Windows installation, re-installation, upgrades

Passwords

Logon and Account Password setting, changes, resetting; password recovery, cracking

Program source code

Program source code in C, C++, Visual Basic, Java, HTML, XML, MS Access, Basic, COBOL, DIBOL, command scripts

Registry settings

System settings (Configuration, Last Use, Last User, Last Shutdown) and User settings (IE Search terms, Typed URLs and Auto Logon IDs)

Software version

Software version change control history

Telephone call records

Communications traffic data - telephone service provider call records (SPOC)

User Identity

User ID, Account ID, Logon ID, MAC, SID, GUID, Passwords, Shared Logons, Unattended Logons

Web archives

Web archive searches, Presence or absence of web-pages, web-page versions, News archives, State of the Art

Web browsing

Web browser (Internet Explorer - IE, Netscape, Mozilla) cache, Browser history files (active and deleted)

Bookmarks, Favorites, Cookies, Google searches

Applications Experience

Michael Turner has thirty-five years' experience of software applications in a range of sectors, including:

Accountants Fabrics PC maintenance
Agricultural equipment Film industry Police force
Civil Aviation Financial Services Post Office
Armed Forces Golf clubs Printing
Banking (Internet) Government Property
Banking (Investment) Home PC use Publishing
Banking (Online) Hotel Queue management
Brewing Insurance Recruitment
Business information Internet Retail
Chemicals Local Government Schools
Computer manufacturer Medical Repatriation Software development
Computer systems supply Motor racing Software publishing
Construction Motor trade Solicitors
Derivatives trading Number plate recognition (ANPR) Telecommunications
Estimating Parcel courier Travel

Services

Professional services include:

  • Expert Advice on computer evidence
  • E-Discovery - Requests for Disclosure (Discovery) of computer evidence
  • Investigation - Forensic Data Examination
  • Reinvestigation - Verification of findings of previous computer forensic investigations
  • Synchronisation and correlation of activity and event logs
  • Construction of event Chronology (Timeline) for alibi testing
  • Interpretation and evaluation of computer evidence
  • Expert Evidence - report for disclosure

Qualifications

Mr M J L Turner is:

  • a Master of Arts (University of Cambridge - Economics)
  • a Chartered IT Professional of the British Computer Society (BCS)
  • a Chartered Fellow of the British Computer Society
  • a Registered Expert Witness of the British Computer Society
  • a Practising Expert of The Academy of Experts
  • a Fellow of The Expert Witness Institute
  • a Registered Forensic Practitioner in the speciality of Computer Examination: Data Examination
  • listed as a checked expert witness by The Expert Witness Directory
  • listed as an expert witness by UK Register of Expert Witnesses

Computer Forensics Training and Resources

  • AccessData: Intermediate Computer Forensics course
  • AccessData: Microsoft Windows Forensics course
  • AccessData: Internet Forensics course
  • ASR Data: Smart - Linux Forensics
  • F3 Training days and F3 Annual Conferences
  • E-Evidence Electronic Evidence Information Center (Bibliography and Library)
  • AccessData forums
  • Digital Detective Forensic Forum
  • Computer Forensics Tools and Testing group
  • Security Focus Forensics mailing list
  • SmartForensics forum

Appointments

  • Assessor, BCS Expert Witness Register (1996 to 2001)
  • Convenor, Computer Evidence task group, BCS Legal Affairs Committee (1998 to 2001)
  • Alternate BCS representative on CRFP Digital evidence working group (2003 - 2005)
  • Expert Witness Institute representative on CRFP Digital evidence working group (2003 - 2005)
  • CRFP Specialty Assessor in the speciality of Computer Examination

Publications

Current Professional Interests

  • Authenticity, Accuracy and Authorship of questioned documents and e-mails
  • Forensic procedures for handling, preserving, copying and investigating computer evidence
  • Reliability of documents, records, audit trails, logs from computers and networks
  • Validity of novel computer forensic techniques and computer forensics State of the Art
  • Integrity of database records in Police National Computer (PNC), National DNA Database (NDNAD), DVLA, ANPR

Legal Aid work

Undertakes work funded by Legal Services Commission including Very High Cost (VHC) cases

Pro Bono work

Prepared to advise pro bono where the misuse of computer evidence may have resulted in a miscarriage of justice.

Instructing Solicitors and Organisations

Instructed as an expert witness in some 200 cases including by:

Addleshaw Goddard Department for Education Meldrum Young
Allen & Partners DLA Newcastle City Council
Ashurst Edwards Geldard Osborne Clarke
Baker & McKenzie Field Fisher Waterhouse Pinsent Masons
Beachcroft Wansbroughs Freshfields Bruckhaus Deringer Richards Butler
Berrymans Lace Mawer Irwin Mitchell Shoosmiths
Bevan Ashford Kennedys Slaughter and May
Bird & Bird Kidd Rapinet Taylor Wessing
Cartwright King Lester Aldridge Treasury Solicitor
Clifford Chance Lincolnshire Police Wragge & Co
Commission for Racial Equality Linklaters  
Davies Arnold Cooper Lovells  
Denton Wilde Sapte Maidments  

Contact Details

First Names:

Michael John Livingston

Surname:

Turner

Qualifications

MA FBCS CITP MAE FEWI RFP

Address:

Computer Evidence, Dulas Mill, Hereford, HR2 0HL United Kingdom

Phone:

(+44) 01981 241020

Fax:

(+44) 01981 241021

E-mail:

expert@computerevidence.co.uk

Web:

www.computerevidence.co.uk

 

 

Michael Turner

BCS Registered Expert Witness: Michael J L Turner

The Academy of Experts: Michael J L Turner

Expert Witness Institute: Michael J L Turner

Expert Witness Directory: Michael J L Turner

UK Register of Expert Witnesses

Council for the Registration of Forensic Practitioners: Michael Turner


   
© Copyright Michael J L Turner 2006 - 2008