What can you find out from a saved image?

[worriedtohell]

Difficult situation at work in which im currently suspended for an ' indecent' image of which i have never seen being found on my pc.

I am a pc user, not a technical person, i think the pc is being looked at, but, for my own knowledge i woiuld like to know:

Can they tell from a saved image, where it came from - ie work spam, FB, deliberatley downloaded?

How reliable are the ' created dates and times' and can they be tampered with?

How does an image end up in the downloads, if it hasnt been downloaded?

Why is none of my actual work in the downloads file, because i do download/ open attachements, but no actual work is in this file.

Thanks

[ItsAllGoingToBeFine]

Bump for OP, she really needs this info

[OpheliasWeepingWillow]

On phone but google 'image metadata'

[SquirtedPerfumeUpNoseInBoots]

I posted on your other thread but i must have missed the update. You are suspended! For that one image? Did you join a union?
Its shaky ground imo to class that image as indecent.
I'd see an employment solicitor if i were you.

Sorry this doesnt answer your question.

I assume you mean the image was found in a folder called Downloads. Well, any file can be moved to any other location.

As for the accuracy of date and time, is the date and time accurate on the pc you use? Are the PC's patched and updated?

[ItsAllGoingToBeFine]

Is the metadata likely to have anything relevant? I thought it was all about when/where picture taken, camera used etc as opposed to containing any info on how the image was used subsequently?

[SquirtedPerfumeUpNoseInBoots]

Does the account you use on the pc have the permissions to install software?
Or are you locked down and prevented from certain actions?

I recall you dont have an IT Department, so I assume you are all set up as administrators.

If the ability to install software exists, then its a simple matter to download a program that will change the date and time and then remove the program afterwards. Look at this for example

You need a union or a solicitor.

[worriedtohell]

Yep - been suspended. For the one image, or, as my letter says ' allegations aganist you, inlcuding downloading an indecent image'
No other allegations have been mentioned in my invertigation invite letter, or at the investigation itsellf, so i dont know what they are.

Ive not joined a union, pointless as they wouldnt be able to do more than advise me, which acas will be able to do.

cant afford a solicitor.

Yes, image was found in a file called downloads. Would there be a relevant point in evidence to say that files can be moved between any folders? i supose there might be?

I have no idea what patching and updating us? they arent networked really, just have a shared drive that is viewable on all pc's however, if someone wants to save something to there, they have to send it to me or the boss as we are the only ones that can do that. I dont know if that has any bearing. The image wasnt found in the shared area.

They have only told me the date and time that they have got from right clicking on the image.

[worriedtohell]

I no longer have access to the PC, so cant do anything like that, or wouldnt really anyway, as it might look suspicious. I dont know where the image has come from, but from what i understand they have to prove it was me, if they want to sack me. Not me prove it wasnt me.
BUT, i would like as much info as possible, so i can throw any ' evidence' they may have back in their faces.

[MrGin]

Can they tell from a saved image, where it came from - ie work spam, FB, deliberatley downloaded

It depends. If it's from the internet ( as opposed to copied off a memory stick ) and your company keeps a record of people's web history it may be possible to match the date of file creation to a web address.

But it's unlikely an image file will intrinsically have a record of where it originated or how it got to your PC.


How reliable are the ' created dates and times' and can they be tampered with

Fairly, but they can be tampered with yes, either by changing the date / time on the computer before downloading, or going onto the meta data and changing info there.

How does an image end up in the downloads, if it hasnt been downloaded

Just like any other folder, files can be moved in and out, they don't have to come from the web.

Why is none of my actual work in the downloads file, because i do download/ open attachements, but no actual work is in this file

You can define where a file is downloaded to. If your files don't go to the 'download' folder where do they usually go ?

[worriedtohell]

yes, the pc's arent locked down.

I didnt know a programme like that existed. However, i shall print it off, take it with me. Since all staff have access to my pc and know my log in, surely that shows that it could have been done at any time.
Surely that will be enough evidence to throw this out?

esp since the date it suposably was downloaded was 6 months ago, and i hadnt seen it, and noone had. Esp so since the image was found by my boss, after i woked a full day, she found the image that day, so must have jumped on my pc immediatley after i left to and checked, something that hasnt happened before... else the image wold have been found sooner.

[ItsAllGoingToBeFine]

If this picture has been in your download folder for months how come you didn't see it?

Did you know that the other pictures that you recognised were in your download folder?

[worriedtohell]

thanks mr gin. I , as course wipe my internet history daily. Always have done. we arent meant to use the pcs to save anything, and they can be used for sensitive info.

But what you have given me is great. That, to me, shows that any ' evidence' they may produce, will have to be thrown out, based on the fact that everyone else in the office knows my login and at somepoint during the day, uses my pc.

:)

That, is fucking fantastic.

[worriedtohell]

there were lots of images in the download file, i recognised about 4 i think.

Hadnt seen any of the others before.

[HeathRobinson]

Don't unions have solicitors/pay for a solicitor as part of the union 'package'?

[worriedtohell]

possily, but i think they wont do anything other that offer me advice, because the action started before i joined.

[ItsAllGoingToBeFine]

Whe you download things do they automatically go into the downloads folder, or is it the default, or do you specify it?

[ItsAllGoingToBeFine]

Just wanted to double check: the incriminating date attached to picture - was that date created or date modified?

[worriedtohell]

They havent told me which date, they told me, it was found by right clicking properties, and had the date and Time. And that I was the only one in. However, I now know it can be modified or changed, so essentially that means nothing. Also files can me moved about. And everyone has my login.

I don't.Download stuff as such, as open attachments, and files on our own website. These open on the desktop by themselves, or a pop up box, named downloads appears and I view them from there..then delete. I don't ever save stuff, unless its word files from an email, in which case I save to my desktop, then file in the relevant place.

[ItsAllGoingToBeFine]

In which case I'm pretty sure you didn't do it accidentally.

I've just had a long text conversation with my geeky DP. This will be long and may or may not be of any use.

Date/time created: when that particular file was first saved on your computer (in any location) It could be downloaded from internet, transferred on disc/usb stick, saved from email etc. Doesn't matter if you move or alter the file, date of creation remains the same. It is possible to falsify this date, but not accidentally.

Date/time modified:when changes were last saved to file.

Downloads folder: you need to actively do something for things to end up in here e.g if you visit a website it won't download any images etc there without asking. Opening attachments is may be actively doing something so if you opened flaccidpenis.jpg attachment it may end up there.

Am slightly confused about downloads pop-up box. This may be because you have an unusual system setup, but I believed that this was merely a shortcut to your downloads folder. Ie it shows the current contents of downloads folder plus current downloading item(s)

In which case I cannot understand how you were unaware of all these images in your downloads folder as they would have shown up (as filenames) in your downloads popup box.

And if you delete items every time so pop up box is empty your downloads folder should be empty too.

Do you have any idea how the images you did recognise ended up there?

[worriedtohell]

No, I have no idea, never seen the image before, apparently it's been.there 6 months. Never come across it. Incidentally found after a random check,by my line manager who dislikes me intensly which has never happened in my 2.8 years there, as there were images held in there that pre date me.

[SquirtedPerfumeUpNoseInBoots]

I've said this before, but it needs repeating. All of the people in your office log onto and use "your" pc. There are no technological controls on what users can and cant do, and no logs kept of activities.

Anyone could have saved that image to that machine, and altered the date and time (either by installing software for that purpose or by changing the pc date and time). I am really surprised that they have suspended you. I would also be querying the use of the term "indecent" to describe that image.

Hopefully the independant IT people will be able to describe all of this to your employers and you will get a big apology.

Forensically they dont have a leg to stand on either, as they allowed the image to stay on the machine and for the office to continue to use the machine after it was found. There are Best Practice papers available for the collection of digital evidence the principals of which have not been followed.
The machine should have been imaged (copied) immediately to preserve the evidence it contained. ACPO guidelines

[worriedtohell]

they did a screen shot, would that class as evidence?

if not, just on those facts alone, should it come to gross misconduct, i would be able to appeal and take it to tribunal, yes?

[ItsAllGoingToBeFine]

Screenshot in no way is useful evidence. It merely proves the existence of that picture on the pc when the screenshot was take.

So useful only if picture now deleted.

In no way does is start to answer any of the issues we have all brought up with this case.

If this comes to anything, you can definitely appeal and you will almost definitely win.

Even if you had been deliberately downloading porn they seem to be screwing up the investigation so badly that nothing can stick.

You might want to get them to phone ACAS, so ACAS can tell them to stop being so silly.

[SquirtedPerfumeUpNoseInBoots]

It should be remembered that in a workplace investigation, they have to Be able to demonstrate on the balance of probabilities that you carried out the actions. It's not a criminal case where they have to prove the case against you.

You keep mentioning this shared drive that everyone can access. It's unfortunate you don't know more about it, as I would wonder if the image could have been saved from someone else's machine.

I really hope OP that these independent IT people are worth their salt, as there's just too many variables IMO to say it was probably you.

Good luck.

[YouBloodyWolf]

When you say 'indecent', is it just adult porn?

I agree with SquirtedPerfume about it being very thin from a forensic point of view (I suspect we work in the same field!) Have they retained a professional forensic analyst? If not, given the condition of the PC, it sounds as if they'd be staring down the barrel of a lawsuit if they sacked you. If they're gathering their evidence from the live PC rather than a forensic copy, and the person who's doing it has no forensic training or awareness then on the information you've given, an appeal would eat them alive.

It might be worth getting a forensic expert to read an honest and thorough summary of the investigation so far, and write a statement on their opinion of the admissibility of the evidence. It'd be cheaper than getting a full forensic exam done, but would fire a shot across their bows.