It’s fair to say that in a world where dastardly deeds are played out in cyberspace through mobile phones and laptops Sherlock Holmes would need more than a daft pipe and deerstalker to make a living today. Steven Raeburn meets the men from which there really is no hiding place.

The subject of forensics might make you think of teams of slick investigators in white coats, peering into microscopes and scraping fibres from under the nails of dead bodies. Like other aspects of criminology, such as private investigation, this particular area of technical expertise comes loaded with a certain image. Much like the practice of law itself which, with its photocopying, office politics and time recording can be very different from the Ally McBeal lifestyle many a young lawyer thought they were entering into.
Tucked away in sight of the glorious Campsie Fells, Martin Bennett and Graham Brownlee are pioneering a branch of forensics previously unknown in Scotland, although you will have heard of it. And whether you like it or not, its reach is likely to be of direct relevance to you in your day-to-day working life, if it revolves in any way around a computer. As the BBC’s Andrew Gilligan found out when he revised his palmtop notebook after his meeting with David Kelly and as Chris Langham found out when he downloaded images of underage children, technology leaves traces as indelible as a fingerprint. And from a legal perspective they are just as solid. Integrity Forensics, the only practitioners of this art in Scotland, are open for business and if you are the type who spends longer than they ought to shopping online instead of revising that commercial lease, there is no way to cover your tracks that these hounds won’t sniff out.
Both men are disarmingly friendly and come firmly from the scientific rather than investigative background. Originally based in Southampton, where their skills tracking the phone and computer work of thieves and fraudsters was hugely in demand from Thames Valley police, the men decamped north, where Brownlee has family, when their former employers became keener on obtaining results quickly at the expense of thoroughness. Haste, Bennett says, simply cannot be applied to work as technically challenging as theirs.
The work itself marries technical expertise with a detective’s instinct. It is about understanding human weakness and what people are capable of. It is about detecting use and misuse of mobile phones and computers, actions which leave a trail that cannot be erased, by people who need to be furtive if they are to remain ahead of the law. It is about understanding how they might have behaved at a time of the day or night when you know they were active and they have tried to cover their tracks. It is patient, methodical and efficient.
“You are dealing with nasty people,” says Bennett. “And you can’t afford to rush it.”
Like their counterparts in the investigative trades, personal computer detective work can involve long hours, working late into the night. “You can’t put a time on things. It takes you as long as it takes you,” he says. “On deadlines, we have been here until three or four in the morning working away. It can depend on the hard drive and what needs to be done. You can set software off and running to trace what you are looking for. You have to wait for that. The information on the hard drive can’t stay in the office overnight. It must be locked up in the safe so we know evidence is secure.”
Specialist software packages can open the door to the treasures locked deep within the memory of a PC, but that is not the nature of the trade, which requires the very human skills of perception and analysis.
“The software does the data crunching,” Bennett explains. “What we then have to do is pick the bones out of it. There is a lot of analysis, and it is up to you what way you take it. Most people make some effort to cover their tracks, but they don’t understand the depth that we can go into it. We are not going in at a surface level, we go in very deep and it is very difficult for anybody to hide things to that degree.”
Bennett’s business partner Graham Brownlee says that no two inquiries will be the same and each will require a different approach. For instance, you might need to know if a Word document or a spreadsheet has been tampered with since its creation, or you may need to know what sort of uses an office PC has been put to. The approach adopted depends on the question that has been raised, and the outcome sought.
“We had a case in London that hung on the creation dates of documents, which needed to be proven,” says Brownlee.
“A layman can right click on a document and see what it says but a layman can’t look into it deeply. Sometimes we are given a sequence of events and they are looking to find out whether they actually happened or not. Maybe you find out that it wasn’t the case but then you find something else that actually did happen, so you look into that further. You start off with a question and move on from there.”
This is still an emerging science and a novel industry. With most firms fully embracing computer technology in the last ten years, the problems associated with their use, and the solutions to those problems, remain unknown to many businesses.
“People don’t even realise that they need your services,” says Bennett. “It is about making people realise that they do need us at some point. A legal firm may get a case every six months that requires hardware analysis. The prosecution may not be aware that we can then interrogate that information and find out if there are any holes in the continuity. Once they know that is there, I am sure we will pick up work from them.”
It is in the field of criminal law where Integrity Forensics has been most active prior to moving to Scotland, undertaking analysis for English police forces. Given the facts, the details of the alleged crime and the relevant PC or mobile phone, the team get to work.
“We deal with every facet of crime. From a police point of view, we get a slice of what they get,” he says. This includes sensitive criminal cases involving unlawful images of children. The PC trawl has now become a standard part of any associated investigation and a technical footprint has been left behind by those involved in such activities.
At the moment, Strathclyde police have not yet moved to contracting out this work, which is currently undertaken by their Computer Crime Unit. Bennett points out that there is no uniform approach to tackling this work across the various forces in Scotland, England and Wales, some of whom undertake the work while others will engage an outside specialist. Bennett is hoping that, as a relatively new area of business, the Scottish forces will overcome their unfamiliarity.
“We thought we would get police interested but they are not. At all. We are dealing with ultra conservative people in an ultra conservative industry. The Scottish police forces seem reluctant to put work out.” However, he remains convinced that it is only a matter of time before the police and private business will see the advantages.
“Once they know we are here, opportunities will come in the future. It is only now that we are beginning to target lawyers. And for lawyers and corporate clients, maybe it will be a similar story,” he says.
Like all emergent technologies, there is the hurdle of unfamiliarity to overcome. One hundred years ago, most people would not have found any need to go to a car mechanic. In the 1990s, how many of us knew what anti-virus software was? Bennett is confident that this area of technical expertise, whilst in its infancy, has a bright future. While privacy laws prevent the technology being used by jealous spouses to pry on loved ones, there are no such issues when the technology being examined is your own. Bennett mentions a client, south of the border, who harboured suspicions about the activities of one of their staff.
“They suspected someone was coming in at night and logging onto their computers and using the office computers to look at illegal content. As it is a corporate computer, we can do that job comfortably if the company has asked us to do that.”
Fortunately, few people engage in criminal activity on their firm’s PC, but for those of you who spend a little too much time on YouTube, or checking the sports results, it might be worthwhile re-reading the Internet use clause of your employment contract. Increasingly, Bennett believes, firms will seek to monitor the activities of their staff to ensure that the time they are being paid for is used productively. Bridget Jones said in her diary that she sometimes wondered if anyone in her office tapping away at their keyboard was actually working. Ten years on, your company can easily find out.
“It is definitely going to be a growth area. Now you can demonstrate that they have contravened the terms of their employment contract and the company saves themselves an awful lot of money, as well as unproductive time.”
They are, so far, the first and only practitioners of their kind in Scotland. In a sense, they are pioneers, both in business and technically. The ubiquity of computers in everyday life suggests that they are likely to be kept busy in the future, once people have come to know and trust the type of work they do.
“You only have one reputation,” Martin says. “And we want to base it on quality.”