Computer forensics services can include the review and categorising of photographic material. There is a constant striving for improved technology, efficiency and effectiveness, for more information visit http://www.cclgroupltd.com

1. Image Evaluation in Computer Forensics
A computer forensics service needs to be supported by a dedicated research and
development team for criminal cases, to ensure that law enforcement agencies receive
the evidence and intelligence they need to determine the direction of a case or to make
a prosecution.
Computer forensics services cover everything from the collection of exhibits – through to
analysis and presentation in court where required. Perhaps the most unpleasant aspect
of the digital forensic analyst’s role has to be the reviewing and categorising of indecent
photographic material. Leaving the emotional issues to one side for the moment, this
post deals with some of the technical issues.
The recent changes to the UK Sentencing Guideline Council’s Definitive Guideline, from
the previous five levels of indecency to three, has caused us to review our methodology
for such cases. A copy of the Guidelines can be obtained from
http://sentencingcouncil.judiciary.gov.uk/docs/Final_Sexual_Offences_Definit
ive_Guideline_content_(web).pdf
Many forensic laboratories maintain a hash database of known files, and we have our
own specific hash database for known indecent images. The recent changes made to the
sentencing guidelines have meant some reorganisation to our hash database. I expect
that other labs have also made similar changes.
The creation of a UK national image library can’t come soon enough. The benefits of such
a facility are well documented; such a repository will surely help speed up the
identification process, thus assisting in identifying victims and bringing offenders to
justice faster. There are obvious issues regarding the ownership, cost and administration
of such a facility but with buy in from the Prime Minister, national agencies, local police
forces and reputable private companies we can all help make this facility workable.
Image review is not just a feature of paedophile cases of course. It also forms part of the
computer forensic analysis in many different types of cases including; benefit fraud,
corporate computer misuse, harassment, drugs, etc.
With regards to image review methodology in computer forensics, we are constantly
looking at how we can remain efficient whist still maintaining a level of quality that our
customers expect, and technology obviously plays a key role in delivering this.
Early analysis technologies were prone to false positives however, improvements in
accuracy have been made and recent software, although not fool proof, performs well.
There will probably always be a need for manual review but surely the less time we, as
analysts, spend looking at such material the better.
For more information on computer forensics, please call us on 01789 261200 or email
contact@cclgroupltd.com, or check out http://www.cclgroupltd.com/digital-
forensics/corporate/computer-investigations.
Nathan is a computer forensics investigator and digital forensics specialist at CCL
Group - the UK’s leading supplier of digital forensics, including: Edisclosure Computer
Forensics, Mobile phone forensics and cell site analysis services.