|
Michael J L Turner is an experienced forensic computer examiner and an
established expert witness on computer evidence.
Computer Evidence is data from computer systems that is used as evidence
in legal proceedings.
A forensic
computer examination is an investigation that:
- complies with established computer forensic principles
- uses appropriate computer forensic techniques
- identifies data relevant to a case and
- produces exhibits for the court
Independent expert evidence helps the court to assess whether data from
a computer system used as evidence is:
- original, authentic, accurate and or complete
- corroborated by other computer evidence
- correctly interpreted and
- reliable as evidence
Experience - Courts
Michael Turner has extensive experience of data examination and eighteen
years' experience as an expert witness on computer data used as evidence
in a very wide range of cases in:
- Civil courts (for Claimant and Defendant and as Single Joint Expert)
- Criminal courts (White-collar and general crime, for Prosecution and
Defence)
- Employment Tribunals (for Applicant and Respondent)
- Care Standards Tribunal (Appeal against List 99 blacklisting)
- Family Court (Review of computer evidence from previous criminal case)
- Court Martial
Significant cases
Significant cases where Mr Michael J L Turner has given expert evidence
in court include:
|
R v Paul Stubbs Isleworth Crown Court, T20047422
July 2005
R
v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006
[2006] EWCA Crim 2312. Case No: 2005/04469/C1.
|
Conspiracy to defraud. £12M Online banking fraud. Password
resetting. Expert evidence. For the convicted Defendant
Appeal rejected. Held that the independence of an expert witness
goes to weight not admissibility
|
| Andrew
Charles Mogford v Secretary of State for Education and Skills
Care Standards Tribunal 2002. 11. PC |
Indecent Images of Children. Appeal against
List 99 blacklisting of teacher after appeal against conviction allowed
by the Crown Court. For the successful Respondent |
|
Mr
G S Virdi v Commissioner of Police of the Metropolis
London North Employment Tribunal 2202774/98 (Computers and Law,
February 2001)
|
Employment. Racial Discrimination - racist documents. For the successful
Applicant
|
|
R v Nicol and Moore Bristol Crown Court, T19990561
|
Abuse of Process. Mishandling of computer evidence (Theft of insurance
database). For the acquitted Defendant
|
|
R
v Patel Aylesbury Crown Court (Computers and Law,
May 1994)
|
Computer Misuse. Unauthorised Modification - "wrecking programs".
For the acquitted Defendant
|
|
IBCOS Computers v Barclays Mercantile Highland Finance
([1994] FSR 275)
|
Software Copyright infringement - literal copying. For the successful
Claimant
|
Comments on Expert Evidence of Michael J L Turner
|
"undoubtedly an expert in computers and software"
|
Caulfield J, Kt in Richards Longstaff and Partners
Limited v Lombard North Central plc
|
|
"eminently qualified"
|
HHJ Slack in R v Patel
|
|
"knowledgeable and fair"
|
HHJ Jacob QC in IBCOS Computers Limited v Barclays
Mercantile Highland Finance Limited
|
|
"his written reports were models of clarity,
brevity and balance and his oral evidence was always balanced and
authoritative. I was able to rely on that evidence extensively"
|
HHJ Thornton QC in Open Systems Design v The
British Millerain Co Limited
|
|
"well qualified"
|
HHJ Darwell-Smith in R v Nicol and Moore
|
|
"The timing of the file system activity is important,
and we have carefully examined the evidence presented"
|
HHJ David Pearl in Andrew Charles Mogford v
Secretary of State for Education and Skills
|
| "an acknowledged computer expert" |
Lord Justice Richards in R
v Paul Stubbs Court of Appeal (Criminal Division) 12 October 2006
[2006] EWCA Crim 2312 |
Experience - Cases
Michael Turner has extensive experience of computer examination and as
an expert witness on the reliability of computer data used as evidence
in a very wide range of cases including:
|
Blackmail
|
Confidential data recovered from hard disk of recycled PC
|
|
Breach of contract
|
Sale of business, Property lease
Supply of computer systems (Compliance with contract specification)
|
|
Computer Misuse Act 1990 Ss 1, 2, 3
|
Time locks, Logic-bombs, and Hacking |
|
Confidential information
|
Customer and Contact data, Databases, Designs, Drawings, Specifications
|
| Divorce |
Recovery of over 50 versions of a deleted document.
Fabrication of financial statements |
|
Drugs
|
Distribution (Telephone call records)
|
|
Employment
|
Internet abuse, Inappropriate Use, Racial Discrimination, Disability
Discrimination, Racist documents
|
|
False Accounting
|
Retail commission
|
|
Fraud
|
Online Banking (Theft of £12,000,000), Banking, Credit Card (Identity
theft)
Domain Slamming (Whois? database Data Mining, Spam, Domain name
registrations, renewals and transfers)
Investment, Insurance and Mortgage frauds
|
|
Indecent Images of Children
|
Possession of and Making indecent photographs of children
|
|
Internet libel
|
Web site and E-mail defamation
|
|
Intimidation of witnesses
|
Falsifying Witness Statements
|
|
Money Laundering
|
Internet Banking
|
|
Murder and Manslaughter
|
Serial killer, Contract Killing, Road Traffic Accident
|
|
Negligence
|
Legal advice
|
|
Perverting the course of justice
|
Editing, Amending, Fabricating documents in evidence
|
|
Police computer systems
|
Telephone call records (SPOC); security and system event logs
|
| Sexual Grooming |
Online chat with minors |
|
Sexual Harassment
|
Stalking (Indecent letters)
|
|
Software Copyright infringement
|
Literal copying of software specifications, design documents and
program source code
|
|
Terrorism Act 2000 Ss38, 57, 58
|
Failing to disclose information about terrorism.
Possessing documents likely to be of use to a person engaged in
instigating, preparing or committing an act of terrorism
|
Data Examination Experience
Michael Turner has experience of the following Data Examination sources
of evidence and evidential artifacts:
|
Computing platforms
|
Mainframes, minis, LANs, WANs, POS networks, PCs, Mail servers,
Database servers, Internet
|
|
Databases
|
Database (MS Access, SQLServer) tables, change history and database
applications
Application databases (Thumbs, AOL PFC, Windows Media Player, P2P
File-sharing - Kazaa and IMesh, iTunes, Whois?)
|
|
Date and time stamps
|
File system date-stamps (File Created, Last Modified, Last Accessed),
Software application (MS Word, MS Excel) metadata, System clock
settings, Timezones and Daylight saving (BST) settings
|
|
Deleted files
|
Recovery of deleted files, Recycle Bin, Norton Recycler
|
|
Documents
|
Document version history, revision history, print history, authenticity,
authorship (MS Word, MS Excel, Lotus)
|
|
Domain Names
|
Domain name registration records, domain name transfer records
|
|
E-mail
|
Client-based E-mail and E-mail archives (Outlook, Outlook Express),
Web-based E-mail and E-mail archives (AOL, Hotmail)
|
|
Evidence Elimination
|
Anti-forensics secure deletion (Evidence Eliminator, Eraser, Sure
Delete)
|
|
Forensic image copy formats
|
EnCase, dd, FTKI, SMART, ditu, DIBS, Vogon
|
|
Hard disk drives
|
History of formatting, defragmentation, wiping of hard disk drives
|
|
Hardware configuration
|
History of changes to hardware configuration
|
| Link files |
History of access to files on removable storage media |
|
Log files
|
Activity logs, Audit trails, Event logs, Internet Access logs
|
|
Media
|
Hard disk drives, CDs, DVDs, USB memory sticks, removable media,
obsolete media formats
|
|
Operating system
|
History of Windows installation, re-installation, upgrades
|
|
Passwords
|
Logon and Account Password setting, changes, resetting; password
recovery, cracking
|
|
Program source code
|
Program source code in C, C++, Visual Basic, Java, HTML, XML, MS
Access, Basic, COBOL, DIBOL, command scripts
|
|
Registry settings
|
System settings (Configuration, Last Use, Last User, Last Shutdown)
and User settings (IE Search terms, Typed URLs and Auto Logon IDs)
|
|
Software version
|
Software version change control history
|
|
Telephone call records
|
Communications traffic data - telephone service provider call records
(SPOC)
|
|
User Identity
|
User ID, Account ID, Logon ID, MAC, SID, GUID, Passwords, Shared
Logons, Unattended Logons
|
|
Web archives
|
Web archive searches, Presence or absence of web-pages, web-page
versions, News archives, State of the Art
|
|
Web browsing
|
Web browser (Internet Explorer - IE, Netscape, Mozilla) cache,
Browser history files (active and deleted)
Bookmarks, Favorites, Cookies, Google searches
|
Applications Experience
Michael Turner has thirty-five years' experience of software applications
in a range of sectors, including:
| Accountants |
Fabrics |
PC maintenance |
| Agricultural equipment |
Film industry |
Police force |
| Civil Aviation |
Financial Services |
Post Office |
| Armed Forces |
Golf clubs |
Printing |
| Banking (Internet) |
Government |
Property |
| Banking (Investment) |
Home PC use |
Publishing |
| Banking (Online) |
Hotel |
Queue management |
| Brewing |
Insurance |
Recruitment |
| Business information |
Internet |
Retail |
| Chemicals |
Local Government |
Schools |
| Computer manufacturer |
Medical Repatriation |
Software development |
| Computer systems supply |
Motor racing |
Software publishing |
| Construction |
Motor trade |
Solicitors |
| Derivatives trading |
Number plate recognition (ANPR) |
Telecommunications |
| Estimating |
Parcel courier |
Travel |
Services
Professional services include:
- Expert Advice on computer evidence
- E-Discovery - Requests for Disclosure (Discovery) of computer evidence
- Investigation - Forensic Data Examination
- Reinvestigation - Verification of findings of previous computer forensic
investigations
- Synchronisation and correlation of activity and event logs
- Construction of event Chronology (Timeline) for alibi testing
- Interpretation and evaluation of computer evidence
- Expert Evidence - report for disclosure
Qualifications
Mr M J L Turner is:
- a Master of Arts (University of Cambridge - Economics)
- a Chartered IT Professional of the British Computer
Society (BCS)
- a Chartered Fellow of the British Computer Society
- a Registered Expert Witness of the British Computer Society
- a Practising Expert of The Academy of Experts
- a Fellow of The Expert Witness Institute
- a Registered
Forensic Practitioner in the speciality of Computer Examination:
Data Examination
- listed as a checked expert witness by The Expert Witness Directory
- listed as an expert witness by UK Register of Expert Witnesses
Computer Forensics Training and Resources
- AccessData: Intermediate Computer Forensics course
- AccessData: Microsoft Windows Forensics course
- AccessData: Internet Forensics course
- ASR Data: Smart - Linux Forensics
- F3 Training days and F3 Annual Conferences
- E-Evidence
Electronic Evidence Information Center (Bibliography and Library)
- AccessData forums
- Digital Detective Forensic Forum
- Computer Forensics Tools and Testing group
- Security Focus Forensics mailing list
- SmartForensics forum
Appointments
- Assessor, BCS Expert Witness Register (1996 to 2001)
- Convenor, Computer Evidence task group, BCS Legal Affairs Committee
(1998 to 2001)
- Alternate BCS representative on CRFP Digital evidence working group
(2003 - 2005)
- Expert Witness Institute representative on CRFP Digital evidence working
group (2003 - 2005)
- CRFP Specialty Assessor in the speciality of Computer Examination
Publications
Current Professional Interests
- Authenticity, Accuracy and Authorship of questioned documents and
e-mails
- Forensic procedures for handling, preserving, copying and investigating
computer evidence
- Reliability of documents, records, audit trails, logs from computers
and networks
- Validity of novel computer forensic techniques and computer forensics
State of the Art
- Integrity of database records in Police National Computer (PNC), National
DNA Database (NDNAD), DVLA, ANPR
Legal Aid work
Undertakes work funded by Legal Services Commission including Very High
Cost (VHC) cases
Pro Bono work
Prepared to advise pro bono where the misuse of computer evidence
may have resulted in a miscarriage of justice.
Instructing Solicitors and Organisations
Instructed as an expert witness in some 200 cases including by:
| Addleshaw Goddard |
Department for Education |
Meldrum Young |
| Allen & Partners |
DLA |
Newcastle City Council |
| Ashurst |
Edwards Geldard |
Osborne Clarke |
| Baker & McKenzie |
Field Fisher Waterhouse |
Pinsent Masons |
| Beachcroft Wansbroughs |
Freshfields Bruckhaus Deringer |
Richards Butler |
| Berrymans Lace Mawer |
Irwin Mitchell |
Shoosmiths |
| Bevan Ashford |
Kennedys |
Slaughter and May |
| Bird & Bird |
Kidd Rapinet |
Taylor Wessing |
| Cartwright King |
Lester Aldridge |
Treasury Solicitor |
| Clifford Chance |
Lincolnshire Police |
Wragge & Co |
| Commission for Racial Equality |
Linklaters |
|
| Davies Arnold Cooper |
Lovells |
|
| Denton Wilde Sapte |
Maidments |
|
Contact Details
|
First Names:
|
Michael John Livingston
|
|
Surname:
|
Turner
|
|
Qualifications
|
MA FBCS CITP MAE FEWI RFP
|
|
Address:
|
Computer Evidence, Dulas Mill, Hereford, HR2 0HL United Kingdom
|
|
Phone:
|
(+44) 01981 241020
|
|
Fax:
|
(+44) 01981 241021
|
|
E-mail:
|
expert@computerevidence.co.uk |
|
Web:
|
www.computerevidence.co.uk |
|
|
|