Telecoms Expert Witness

There are multiple ways in which a modern smart phone (such as an iPhone/Android device) and tablet (such as an iPad) can be 'downloaded' and the information from them presented.  What is meant by a modern "phone download" is not a set term like it is for computer forensics and although it is used by Courts/legal teams throughout the UK, it is an ambiguous term to use.   

Instead there are various parts to reviewing phones:

• The first part is that the data is extracted from the phone (and there are many different ways for this to occur which will influence the data available).
• The extracted data is then placed into a more manageable format via processing it via digital forensic software.   
• The forensic software can then be used to prepare a PDF report of the content of part of the phone.

There is various software/hardware that can be used to extract and process a phone which can affect the level of data available.   Likewise, it can be selected what information to include (and exclude) from reports.    This means that what is often referred to by Courts/legal teams, as a 'phone download' isn't actually the full phone - it is simply a PDF report of a partial view of some of the data (as presented by forensic software and picked by the analyst) on the phone.  

Sam can advise you what data will be required/need requesting and specialises in evaluating data in cases involving full extractions from phones including Graykey images.  She can liaise directly with Digital Forensic Units (DFU) within the police to obtain the correct data for your case.

Sam has spent over 19 years manually evaluating and reviewing raw call data records.   She is aware of the issues and anomalies to ensure that examinations performed are accurate and the data interpreted correctly.    She specialises in cases which require consideration of these raw records where it is essential to establish if calls were answered, how long the call rang prior to being answered (and the meaning of this), if an SMS message was delivered etc.  or where the connections need to be manually checked.    Manual checking of connections/cell site usage by an expert is recommended by software suppliers used to process and prepare connection tables/maps, particularly at critical times or issues in a case.

Sam usually combines this type of analysis with activity and communication present on mobile handsets, cell site analysis and/or attribution evidence (see below) and can also due to also being a computer expert she can consider complex network usage via routers/WiFi points/MAC addresses etc.   She can also provide behaviour analysis in cases where it is necessary for such usage data to be fully considered and the frequency of connections explored.    Sam can also compare use between attributed phones or the dataset as a whole.

SRC's further specialism is in the evaluation of where a device/vehicle/person or otherwise has been in a field known as location forensics. Such evidence may be obtained from information stored on telephone handsets or computers, vehicles (in the form of telematics and GPS systems, trackers and vehicle applications), sat nav units and also via and/or in combination with cell site analysis.  SRC can also assess the best source (or combining various types) of location evidence available in your specific case.  

Attribution evidence involves assessing all of the available evidence (such as connection behaviour (see previous), cell site analysis, handset usage and otherwise) in order to establish the full extent of the evidence to assist the Court with who may have been using a telephone in general or at a particular time.  This may be used to ascertain if the use of telephone(s) is consistent/inconsistent with use by certain parties and may involve complex analysis such as co-location assessments with other phones, ANPR, CCTV, vehicles (via telematic/vehicle forensics) and other evidence. 

Since 2nd October 2023, handset (iPhone/Android/tablet) forensics including at an expert witness level requires Compliance with the  Code of Practice from the Forensic Regulator (362 page PDF Document opened from an external site)    

SRC follows strict procedures in terms of securely reviewing mobile and tablet device cases including working to MOUs.   Sam also fully reviews raw data and otherwise to ensure all reports are prepared accurately and are not "push-button" forensics.   However, SRC is currently non-compliant with The Code of Practice, and does not have ISO17025 accreditation.   A full discussion of this will be provided prior to estimating, and where the instruction is accepted, the required non-compliance declarations made.   SRC can work within the ACPO Guidelines as is appropriate.

SRC can provide assistance in cases involving encrypted phones including Encro Phone (EncroChat) cases involved in Operation Venetic.    Sam was involved in the trial involving the lead def within R v A, B, D & C (sub-zero).  She has been examining Operation Venetic since 2020, and in that time she has performed more than 2000 hours of research, development and casework in the area.

Sam can also consider the call data records and cell site analysis involving alleged encrypted phones including Cloud9, Sky, EncroChat etc.