As we continue our Meet the Experts series, we’re interviewing Simon Nash, one of our Forensic IT Expert Witnesses. Simon has been working in Forensics since 2000, beginning his Digital Forensics career in 2002. With 17 years’ experience in the industry, his expertise has uncovered valuable evidence for a variety of defence and prosecution cases.  

What initially drew you to a career in Forensic IT?

When I first started my career, I hadn't even heard of Digital Forensics. I had just completed a degree in Biological Sciences and graduated in 2000. Not knowing what I wanted to do, I joined a recruitment agency for scientists which placed me at LGC Forensics, providing DNA profiling for the DNA Database. Whilst there, I attended an internal seminar about a new department they were opening, examining computer and phone devices.

As I have always been a bit of a ‘geek’ and have even built my own computers - pulling them apart in my own time - it really seemed like my ideal job. After an enthusiastic chat with the Head of Department, I became one of the two founding members of the unit. The field was hugely different back then, as the mass adoption of the internet was in the early stages and dial-up was the most common way to connect. Police forces really didn't know what to do, and the investigation and Digital Forensics field was pioneered by a few tech-savvy police officers around the country.

Is there an area of Forensic IT that you specialise in?

Over the course of my career, I have examined a huge range of different devices, and would consider myself a specialist in the examination of any digital storage device. Most commonly, these will be computers, hard drives, and mobile phones, however, some of the more interesting and challenging examinations have been the more overlooked items such as game consoles and sat-navs.  

Have advances in technology made your job harder or easier? 

The Digital Forensics field is constantly evolving as technology changes. The quantities of data that most of us carry on a daily basis is huge. The mobile phone in my pocket has more than 20-times the storage of the average computer I was examining early in my career. To put that into context, one Terabyte (a common hard drive size) is the equivalent of 916,259,689 pages of plain text (1,200 characters) or 4,581,298 books (200 pages per book). Fortunately, the forensic tools we use have advanced to allow experienced examiners to navigate this data easily to identify the relevant information. The challenge for the field now revolves around encryption and data stored in the cloud.

How have advances in technology made crime easier or harder?

As technology has evolved, so has the use of that technology for criminal purposes. The speed technology has been adopted has perhaps left older generations more vulnerable to some criminal activity. However, we as a society are gradually becoming more aware of cybercrime and how to detect and avoid it. Schools and parents have educated future generations on e-safety, as well as the responsible usage of media and devices, which should hopefully make some digital crimes harder to commit going forward.  

Could you provide an example of how your expertise has helped to secure and challenge convictions in the past?

During my career, I have carried out investigations for the prosecution and defence, corporate investigations, civil cases and fraud cases for the DWP (Department for Work and Pensions) and ICO (Information Commissioner’s Office). There have been a few standout cases that stick in my mind.

1. I was involved in a large-scale fraud case where I recreated an office network using virtual computers generated from the original evidence. This showed software usage and permissions of different members of staff - proving the knowledge and involvement of the management team. 

2. There have been numerous defence cases where the prosecution has offered no evidence or dropped the case subsequent to my report. In particular, one case involved a young defendant accused of making indecent screenshots of his girlfriend during a Facebook video chat. In producing my report, I was able to show that the screenshots were in fact created by the other party and sent to the defendant - these were then cached automatically to the phone memory without the defendant choosing to save them. As a result, the very traumatic case against a young defendant was dropped.

3. I have been involved in cases where we have revealed an employee attached a USB storage device on the day that they left the company and at the same time accessed sensitive company documents that were not required for their job role. I was able to produce a timeline of activity which helped secure a court order to allow investigation of his devices at his new employer - this identified matching files on his new computer. 

What is a typical day on the Foresight Expert Panel like?

​Many enquiries initially involve liaising with the team at Foresight to ensure we have everything we need to best advise the client on the most effective investigation. Often, when reading the case papers or listening to the requirements, we can advise of other data or investigation types that may assist the case that they perhaps hadn't considered. This could be social media accounts or cloud data. Once the case is underway, we will ensure we have access to the required evidence - whether that be copies of digital evidence or attending onsite to examine mobile devices. 

How has working with Foresight benefitted your career?

As Foresight deals with a wide range of enquiries from a variety of clients, I’m able to keep working on investigations that challenge me and allow me to research new and different data.

What do you find most challenging about your work and how do you overcome this?

The main challenge is ensuring that I remain up to date with emerging technologies and equipment. Fortunately, I am a gadget hoarder and love my technology, which makes research an enjoyable hobby.

What do you enjoy most about your work, and why?

I really enjoy the challenge and the investigation - making sense of the data and corroborating or refuting a particular version of events. I also really enjoy being part of the criminal justice system - whether that be explaining evidence to a jury, or advising counsel about the facts of the case. I really believe in our justice system, and that proper review and explanation of any digital evidence is vital to ensure a fair trial.

Would you recommend joining the Expert Panel to others? If so, why?

​Foresight’s team is passionate about what they do. They allow me to get on with the work that I love and am best at, which means together we get the best for the client. I can’t think of any reason I wouldn't recommend anyone joining the panel.

If you’re interested in joining our panel, we’d love to hear from you. Click here to learn more.