by ANDREW LISTER, consultant clinical psychiatrist
Attachment theory is very simple: it just describes the outcome of a mother’s and baby’s interactions.
Baby cries; mum acts. It is a perfect relationship for baby – if mum is able to recognise and respond to baby’s needs. This tiny sequence, which is so commonplace that it has become almost unnoticeable, is repeated possibly 10 times a day of the first couple of years of a baby’s life. That adds up to over 7,000 repetitions.
With the proliferation of technology, our notion of digital evidence and what constitutes sources of evidence are significantly changing. Traditionally, computer forensic examinations have been performed on systems that have been shut down, such as the content of hard drives extracted from inside computers. Investigators were advised to shut down live computers for fear that digital data might be erased, altered or lost – thereby contravening the guidelines issued in the UK by the Association of Chief Police Officers (ACPO).
However, in recent times there has been a requirement to perform live or ‘triage’ analysis on powered-on systems, to prevent loss of evidence. Many current attacks against computer systems leaving no trace on a computer’s hard drive; an attacker exploits information using the computer’s memory or RAM (random access memory). If data stored solely in RAM is not recovered before powering down, it may be lost forever. The answer is to collect volatile data from the computer at the onset of the response.
Some forensic practitioners state that the collection of RAM or volatile data is not an acceptable practice, due to its instability, lack of verification and inability to be reproduced. However, at the scene of an incident we need to preserve as much evidence as possible within the permitted timeframe. After all, you wouldn’t ignore a footprint in the snow at a murder scene, just because in due course it will change and disappear. Preservation, recording and exhibit integrity are cornerstones of any investigation.
With that in mind, forensic practitioners have to consider a response to the complexities of how to deal with investigations involving the volatility of online data centres known as ‘the cloud’. By centralising the storage of digital information, cloud computing promises to dramatically reduce data promiscuity. Cloud computing replaces the download with the stream, and that means that, as people come to use the cloud as their default data store, the proliferation of files and artefacts found on an individual’s hard drive is going to be greatly reduced.
Apple’s new iPad, which recently arrived with much fanfare, provides a good example of where computing is heading. The iPad is much more of a player than a recorder. It has a much smaller storage capacity than traditional desktops and laptops, because itís designed on the assumption that more and more of what we do with computers will involve streaming or accessing data over the net, rather than storing it on devices, coupled with the usage of online applications.
So, as forensic investigators we are going to have to get our heads into the cloud, and deal as first responders to incidents, giving consideration to the use of triage forensic tools to prevent loss of evidence.
4MAT Data Solutions provides a triage forensics service, and can supply first responders and legal services departments with incident response tools, review platforms, and training.
During March a number of inflatable colons (2.4m-high inflatable walk-through replicas of the human colon) were travelling across Europe to mark the 3rd European Colorectal Cancer Awareness Month (ECCAM).
Colorectal adenocarcinoma (colon 80%, rectum 20%) is the third most common malignant tumour worldwide, after lung and upper gastro-intestinal cancers, and the second most common in Europe after lung cancer. Despite modern treatment, 50% of patients are dead by five years, with around 16,000 deaths each year in the UK.
The symptoms include: • Bleeding from the back passage (rectum) or blood in the stools. • A lasting change in normal bowel habits towards diarrhoea or looser stools. • A lump in the right side of the abdomen or in the rectum. • A straining feeling in the rectum. • Losing weight. • Pain in the abdomen or rectum. • Tiredness and breathlessness due to anaemia caused by the tumour bleeding.
Age at diagnosis is around 70, but the symptoms have non-cancerous causes, so litigation often involves alleged delayed or missed diagnosis.
Prevention can be achieved by between 15-20% of all colorectal cancers which are familial. They are: • Hereditary non-polyposis colorectal cancer (HNPCC) • Familial adenomatous polyposis (FAP) People with two first-degree relatives with sporadic colorectal cancer or one first-degree relative diagnosed with sporadic colorectal cancer under 45 years should also be advised they have increased risk.
Screening using the faecal occult blood test occurs every two years for: • Adults age 50-74 adults (Scotland and Wales). • Adults age 60-69 adults (England and Northern Ireland).
Access to first treatment in England must be within two months of referral and agreed by a multi-disciplinary team. Staging is by ‘TNM’ staging, which determines prognosis and treatment and requires CT and MR scans (for rectal cancer) and the surgical removal of the cancer, a portion of the colon with the cancer and associated mesenteric lymph nodes.
Teams are audited for lymph-node harvests and total mesorectal excision (TME) for rectal cancers. Minimal access surgery and enhanced recovery programmes are best practice, reducing hospital stay and post-operative complications. Stomas are permanent (colostomies) in 15% of rectal cancer patients and temporary for around six months (ileostomies) in 30% of all patients.
Radiotherapy and chemotherapy are ‘ambulatory’ (outpatient). Pre-operative radiotherapy (with concomitant chemotherapy) is for patients with MR stages 3-4 rectal cancer. Stage 1-2 lower third rectal cancers are sometimes suitable for intra-luminal radiotherapy in supra-regional centres. Chemotherapy agents (including biologicals) are preventative (adjuvant) for patients with node-positive cancers and therapeutic (palliative) for patients with T+ (metastatic) disease.
Metastases occur most commonly in the liver, followed by lungs, bone and occasionally brain. Prognosis with metastases remains poor with a median survival rate of 50% at two years from diagnosis. Liver metastases are treated with liver resection or radio-frequency ablation (RFA) in specialist hepato-biliary centres following chemotherapy.
Research is active in colorectal cancer; there are currently 16 clinical trials recruiting in the UK.
Professor Roger James has 30 years experience as an NHS hospital consultant. He is co-author of over 140 peer-reviewed publications, including Governance and Revalidation: A Guide for Clinical Oncologists.
More and more frequently, solicitors are taking defence instructions where the prosecution evidence is computer based. It is often the case that a solicitor will engage an expert with only the vaguest notion of what the expert’s instructions should be. I have even, in the past, been asked to help draft my own instructions!
I have worked as a computer forensic expert for the defence in over 100 cases which involved creation or possession of indecent images of children on a computer. I have also worked in cases involving computer-based evidence relating to counter-terrorism, murder and fraud, although in these matters computer-based evidence tends to be peripheral rather than fundamental to the case. One of the factors in cases such as indecent images, where the prosecution case is based solely upon the findings of the prosecution computer expert, and which is almost universal, is the lack of in-depth investigation by the prosecuting authorities. Very often the prosecution case is based simply upon the assumption that: “The images are on your client’s computer, therefore he is guilty.”
In my experience, the truth is often very far from that. The language of the indictment usually tends to be somewhat emotive, using words such as ‘accessing’,‘making’, ‘downloading’ and ‘saving’, all of which imply a conscious action on the part of the computer user to select and keep images. However, many such cases involve the computer user being redirected to a child pornography website without his having any choice in the matter. Once a web page is opened the contents, including pictures, are written to the computer hard drive. The indictment will damningly read that ìhe downloaded them”.
A broader investigation of the computer evidence is always likely to help the court and can do the defendant no harm. How did the images get onto the computer? When? Why? Did anyone else have access to the computer? Could the images have got onto the computer without the client’s knowledge?
Even if they are on the computer, does the client have access to them? Are they viewable images or tiny parts of a web page? Are they adverts that popped up on their own? What are the dynamics of the case? What else is on the computer that the prosecution did not feel was relevant? As an example of the importance of the defence expert taking up these lines of enquiry, I recently acted in a case in the South where the defendant was charged with making and possessing indecent images of children. He flatly denied the charge.
The images were certainly on his computer, but I decided to approach the matter from a different angle. I was able to reconstruct the internet sessions, including the times, during which the images had been written to the hard drive. For some of those sessions the defendant had an alibi. Armed with this information his defence counsel elicited from his stepdaughter under cross examination an admission that she had downloaded the images herself to incriminate her stepfather.
On another prosecution, brought about as a result of the infamous ‘Operation Ore’, I was able to demonstrate that the client’s credit card details had been stolen and used to access a child pornography site from the USA when the client was clearly in the UK at the time. My client was lucky – 39 of those investigated in the UK under ‘Operation Ore’ committed suicide.
My advice, then, when instructing a Computer Forensic Expert is to choose an experienced expert who is not only accomplished in his field, but who can demonstrate a track record of creative investigation as well.
• Steve Lewer is a computer forensics consultant for Digifor Ltd. (steve.lewer@digifor.co.uk). He is a member of the UK Register of Expert Witnesses and the Society of Expert Witnesses. He is also a technical security analyst for the nuclear and merchant banking industries.
Scottish law firm Brodies LLP has reported a case concerning a fire in Paisley which destroyed two buildings and a gable wall. The seat of the fire was identified as an electricity meter cupboard.
The tenants and owners of the properties brought an action against Scottish Power, the electricity suppliers. The decision by the court was in favour of the claimants and clarifies when a failure to comply with a duty imposed by legislation can give rise to liability for damages.
The issue before the court was whether or not the claimants were entitled to rely upon the Electricity Supply Regulations 1988 as a basis for an action for damages or compensation. The regulations place various duties on electricity suppliers, including an obligation to ensure that works are installed and maintained so as to prevent danger (so far as is reasonably practicable).
In defending the claim, Scottish Power adopted what may be described as a traditional approach to statutory interpretation. Relying upon the earlier case of X (Minors) V Bedfordshire County Council, they argued that the regulations did not give rise to liability for compensation because they did not meet the relevant test. The essential requirements of the test are that: The legislation is for the benefit of a particular class of persons rather than the general public.
Parliament intended to confer on members of that class a private right of action for breach of the statutory duty.
In response the claimants argued, among other things, that the only rule imposed by previous case law was that the court should look for the true intention of Parliament by construing the particular legislative terms in question.
For a fuller explanation of the decision and its implications, visit www.lexology.com.
