Nothing else of significance…

Posted on July 31, 2011. Filed under: forensic | Tags: , , , , , , , |

This week I was approached to quote for a defence case. Helpfully, the solicitor sent me a copy of the prosecution statement so I could prepare a realistic quote. Unfortunately, for the “other side”, I’ve spent most of the week working on a couple of proposals for new ISO standards – including something on content of reports for various purposes – so was particularly sensitive to languages issues.

As soon as I saw the source of the statement, I knew I was going to find a phrase that troubles me – and there it was, near the end “Nothing else of significance was found”.

The report details the material upon which the case is based, but gives little in the way of context or other material found. It builds the case for the prosecution solicitor nicely, but doesn’t allow anyone else to form an opinion about the significance of the material because it doesn’t actually give any detail of anything except the “significant” material as determined by the report’s writer.

It’s a format and form of words that I’ve seen several times over the years, and every time I see it, it sounds an alarm.

I’ve always been told that my responsibility as an “expert witness” is to the court (or whoever is going to make a final judgment based on all the reports submitted), and is to state the facts and my interpretation as best I can based on the information available to me. If I find evidence of guilt, I should state it, if I find evidence of innocence, I should state that. I also believe that I should try to make as much information as possible available so that a proper judgment can be made.

To this end, I don’t just list things of “significance” but I try to give an indication of the context in terms which a non-practitioner can understand.

For example, if an email relates directly to the case, I don’t just list that email. I give the total number of emails found and the number found which involve the same people in the “significant” one. If illegal images are found, I try to determine how they have been downloaded, whether they’ve been deliberately saved or just cached, and whether there’s a pattern of searching or browsing that relates to them.

I try never to build a case directly myself but I will, quite happily, poke holes in someone else’s case – especially if they are concealing, deliberately or accidentally, useful information behind statements like “nothing else of significance was found”.

In my book, saying something like that is almost tantamount to dissembling. A digital evidence examiner rarely has the full facts and circumstances of the case available. A prosecution examiner or first responder will have no idea of possible defences or excuses. Limiting the report to the most damning evidence doesn’t help anyone.

Well – it doesn’t help anyone except the “other side”. A good independent examiner will read that sort of report and realise that there’s a lot more work they could do, and SHOULD do, to determine if a proper rebuttal can be produced – and that means more time and bigger fees. I’m not a fan of the use of Bayesian ratios in reports because I know how few people really understand them, but I know why some forensic disciplines use them – they force the reporting scientist to think about the evidence and alternative explanations, resulting in a closer examination of “insignificant” material at times.

At a time when pressure is on to reduce spending on legal aid, perhaps it’s time someone looked more closely at standard reports coming from both sides to see if they are really fit for purpose ? The better those reports are, the less work needs to be done performing re-examination, re-analysis and re-interpretation.

n-gate ltd.

Read Full Post | Make a Comment ( None so far )

Neglecting WordPress

Posted on August 1, 2010. Filed under: All | Tags: , , , |

Regular readers (do I have any ? ) will have noticed that I have completely failed to keep this blog up to date recently. There are reasons for this  – not particularly good ones, but there are reasons.

Starting this month, I’m aiming to set aside a couple of hours each month for an update. Meanwhile, don’t forget to look for my published ramblings in Digital Forensics Magazine and The Investigator (if the editor likes my latest idea, that is).

Read Full Post | Make a Comment ( None so far )

Reuse

Posted on April 8, 2010. Filed under: Education, forensic | Tags: , , , , , , , , , , , , , , |

or re-use ? Either way – this article (thanks for bringing it to my attention, Darren) expands on something that gets a mention in my next IRQ column in Digital Forensics Magazine – so that’s saved me a job (Oh! the irony!) for this week.

The regulator’s working group on digital forensics met for the first time in nearly a year yesterday – and the validation/verification debate kicked off again. Interestingly there was a clear split between the software engineers and the rest of the community – I’m going to ponder and reflect for a while longer and then post something here about it, I think. Meanwhile, if you haven’t seen the papers I’ve produced (with the support and help of some industry figures), you’ll find them here.

Read Full Post | Make a Comment ( None so far )

Writing for a living ?

Posted on February 2, 2010. Filed under: forensic, life | Tags: , , , , , , |

Well, it seems that at least two editors have been fooled into thinking I can write things that are either interesting or controversial. They might even pay me (a little) to do it.

Keep an eye on them :

* Digital Forensics Magazine (DFM) for my IRQ column (http://www.digitalforensicsmagazine.com/). This issue is about triage and whether or not it has a role in digital forensics.

* The Investigator Magazine for my series (Tech. Note) on how technology is involved in crime (http://www.the-investigator.co.uk/).

It’s an interesting experience being paid to have opinions – something which was actively discouraged in a former life 😉

The main topic for this week, apart from devising fiendish exam questions for my students at Ulster, has been preparing a presentation for the Forensic Science Regulator’s conference next week. I’ve been asked to speak some more about the issues related to software validation. Interestingly, there’s another session on method validation. Given that software, by its very nature, has to embody method, I think I may overlap a lot. However, the results from the workshop I arranged back in December will fit into this nicely and should provoke some discussion.

Here’s hoping that from the arguing we can reach a consensus about the way forward – ideally one that will work!

Read Full Post | Make a Comment ( 2 so far )

    About

    This is the weblog of Angus M. Marshall, forensic scientist, author of Digital Forensics : digital evidence in criminal investigations and MD at n-gate ltd.

    RSS

    Subscribe Via RSS

    • Subscribe with Bloglines
    • Add your feed to Newsburst from CNET News.com
    • Subscribe in Google Reader
    • Add to My Yahoo!
    • Subscribe in NewsGator Online
    • The latest comments to all posts in RSS

    Meta

Liked it here?
Why not try sites on the blogroll...

%d bloggers like this: