The proceedings before the Magistrate
8The application was heard by Brown LCM on 18 February 2014. Ms Ferguson, police prosecutor, appeared. Dr Pecover appeared for himself. Dr Pecover handed up submissions but did not give evidence at the hearing.
9After some preliminaries, Ms Ferguson called Detective Senior Sergeant Lindner to prove that she had personally served Dr Pecover with a certificate pursuant to s 177 of the Evidence Act 1995 (NSW) that contained the expert evidence of Senior Sergeant John McCulloch. Dr Pecover had no objection to the certificate although he submitted that Senior Sergeant McCulloch was not independent. The certificate was admitted and marked as an exhibit.
10In the certificate Senior Sergeant McCulloch deposed that he was an electronic evidence specialist employed by the NSW Police Force. He addressed the complexity of data storage. He opined that, in order to be certain that prohibited data is completely removed from a hard disk, it is necessary to identify all prohibited data but that it was not technically feasible to do so. He explained that data can be deliberately hidden or obfuscated, and that such data may be recoverable only with specialised tools or with passwords and cryptographic keys known only to the person who hid the data. He said that it is possible to conceal child abuse material inside seemingly innocuous images and documents. He said:
"Not only is the person attempting selective removal at risk of breaching the law if data on a storage device is inadvertently missed, such data can potentially provide the owner a defence if he or she later commits a crime involving the possession of prohibited material using that device."
"In my experience, the presence of prohibited material in 'plain view' on a hard disk is often accompanied by other material of a similar or more severe nature which has been hidden."
11His Honour then indicated that he had read Senior Sergeant McCulloch's certificate. The balance of Detective Senior Sergeant Lindner's evidence in chief was follows:
Q. Detective Sergeant so in a nutshell you're relying on the expert's report in regard to this application for the disposal of property?
A. I'm relying on the experts report in regards to item 4 and 5. Items 11 and 13 we could not examine due to the age and item 12 is corroded which Mr Pecover told me when we took it, it was corroded anyway so as the Magistrate's quite rightly said there wasn't anything found on 11, 13 or 12 due to corrosion so the only items that are being contended are here are items 4 and 5 and there's child abuse material located on both of those. So I was seeking a court approval to have it forfeited to the Crown for that reason.
HIS HONOUR: Well that means that 11, 12 and 13 are to be returned to Mr Pecover.
FERGUSON: That's the evidence in chief of this witness your Honour.
12Dr Pecover confirmed that he did not want to cross-examine Detective Senior Sergeant Lindner, who was then asked to step down. His Honour then asked Ms Ferguson what in items 4 or 5 justified a refusal to return them. Ms Ferguson responded that they contained images of child pornography to which his Honour responded that the expert certificate was "less than persuasive" and that it was "primarily speculation". Ms Ferguson offered to recall Detective Senior Sergeant Lindner. His Honour then said:
"It's a matter for you how you run your case but it's not just going to stand up on the basis of what appears to me to be quite inadequate material."
13Ms Ferguson then reiterated her offer to recall Detective Senior Sergeant Lindner. The Magistrate confirmed that he accepted, as it was undisputed, that images found on items 4 and 5 amounted to child abuse material and refused leave to recall Detective Senior Sergeant Lindner. A discussion followed between the Magistrate and Dr Pecover that related to technical matters concerning computers that had not been the subject of evidence. An extract from the exchange is set out below:
HIS HONOUR: Well hang on, let's deal with the drives, rather than the division of space under NTFS on both systems. Ms Ferguson, we seem to have an issue, apparently, with there being multiple hard disk drives in the Compucom tower.
FERGUSON: Your Honour, my understanding is that we're talking about one contained box, the serial number for that being ANK1102662. Within that box there is the slave and the hard drive.
HIS HONOUR: Yes, well that's common, but there should be two hard disk drives; one master, one slave. In 2008, that would be a fairly normal arrangement.
RESPONDENT: Well if I can make a comment your Honour.
HIS HONOUR: Just hang on. Now we've got reference, as Mr Pecover says, to a Seagate 40 gig. External drive with a serial number 3HE0BPBC, but he says there's another drive with a serial number what, Mr Pecover?
RESPONDENT: Well the serial number you just quoted your Honour is an internal drive in that tower unit and there's a second internal drive in that tower unit which is 3HE0BJ60. Now, they operate as two independent drives. One is not a slave specifically holding the operating system. I know this because when the compute was originally built, it had two 40 gig. drives that were striped(as said) together to act as one.
HIS HONOUR: They were a RAID array [Redundant Array of Inexpensive Discs], were they?
RESPONDENT: Correct. Now, that RAID array failed some time - I lost the entire PHD as a result -
HIS HONOUR: Yes, I've done that myself.
14Later in the proceedings, Brown LCM proposed what his Honour described as a "fairly simple solution", namely that the files in allocated space on the drives be copied onto a medium that could be returned to Dr Pecover and the drives could thereafter be trashed. His Honour continued:
"They're not going to be worth anything and that solves everybody's problem. In my view the files are property and they've got to be returned. There's nothing wrong with them."
15Ms Ferguson reminded the Magistrate of the expert evidence that illegal material can be hidden within the files. The following exchange occurred:
HIS HONOUR: Well that argument would mean that every computer seized could never be returned because something could be hidden in it somewhere. That's ridiculous. If these are files which are open to access and they're not encrypted, the police are able to read them if they want to. If they haven't done so, that's not Mr Pecover's problem given that the police have had it for six years. It seems to me that the files are obviously important, they're of value if they relate to his business. Since they're clearly open to access, the decisions about whether they contain images and whether they've got concealed steganographic images in them is something which nobody's ever going to answer anyway. To simply claim that because there have been some inappropriate images found, all the other files are tainted is, frankly ridiculous. Files are files.
. . .
FERGUSON: Your Honour, the informant officer is maintaining that the police can't give that material back because we cannot guarantee that it doesn't contain --
HIS HONOUR: But you have absolutely no evidence to establish that it does contain anything.
FERGUSON: I would have to rely on that expert's report--
HIS HONOUR: But it doesn't tell me anything either.
16There was a further exchange about item 5 as follows:
FERGUSON: I'm told in item 5, the offending material was found in normal files.
HIS HONOUR: Well I expect it would have been. I don't imagine anybody would reconstruct it from unallocated space. It's not terribly easy to do, especially if there's been a lot of data input and output onto the drive, but we're not trying to copy unallocated files in any event. It's only going to be files whose names are listed in the file allocation tables that are going to be picked up, if you copy them, not the ones that have been erased, not partial files, not the blocks that have been left orphaned from files that have been erased and partly overridden. It's only the name files that are going to be copied and that appears to be one, clean from the prosecution's point of view and two, all that Dr Pecover wants. Dr Pecover, do you have any mans of determining whether anything is missing if you get copies of the named files?
17Later, Ms Ferguson said, of the actual computer tower, that the officer was not aware of where it was located. His Honour responded:
"Well, that's a police problem. It's his property and they've got to give it back to him."
18His Honour then made the orders set out above but did not give reasons.