±Forensic Focus Partners
New Today: 1
New Yesterday: 6
±Forensic Focus Partner Links
· SQLite Database Forensics – ‘Sleep Cycle’ Case Study
· Data Recovery As A Medium For Email Forensics
· Carving out the Difference between Computer Forensics and E-Discovery
· Forensic Analysis of SQLite Databases: Free Lists, Write Ahead Log, Unallocated Space and Carving
· How Secure Is Your Password? A Friendly Advice from a Company That Breaks Passwords
· Using SQL as a date/time conversion tool
· Forensics and Bitcoin
· Investigation and Intelligence Framework (IIF) – an evidence extraction model for investigation
· Extracting data from dump of mobile devices running Android operating system
InterviewsBack to top Back to main Skip to menu
Lindy Sheppard, F3 (First Forensic Forum) Secretary
My vital statistics are: divorced, two children (son and daughter – in that order), one grandson and three granddaughters (not in that order)!
My working life has been in administration and management and since my late teens I have worked in some interesting industries and with some (let’s call them) quite unique people! Prior to working in digital forensics I think the job which offered the most ‘surprises’ was whilst I was working as a relief manager for two breweries. It involved my taking over hotels and public houses in London and across Southern England whilst the landlords took their holiday or whilst there was a gap between tenancies. I looked after some amazing places; one funny incident was to arrive at a big hotel/public house in Salisbury to find that there were not only paying guests staying and two bars to run, there was also a beer garden, a restaurant and the landlord’s two dogs, two cats and his children’s rabbits to care for. “Oh!” says the landlord as they are about to drive away, “one of the dogs had puppies the day before yesterday, you’ll be OK won’t you?” And then off they went. What you might call, a varied occupation.
I have worked at Cranfield University since February 1999. I will be leaving there on November 30th, the University having offered voluntary severance. The role I play is unlikely to be pertinent in the near future so it was more beneficial for me to accept that offer than to wait until I was surplus to requirements, so to speak. This is not without sadness as I will miss the students greatly and after almost 14 years I find myself back in the job market.
My entry into the fascinating world of forensic computing was as a result of my becoming PA to Professor Tony Sammes. I assisted Tony in 2003 when he set up the Centre for Forensic Computing at Shrivenham.
Tell us something about the cases you have been involved in. Have you ever been required to appear in court?
I have been involved in quite a variety of cases, from counter terrorism to the importation of drugs, fraud, missing children and sadly, far too often, the abuse of children. Working alongside Tony Sammes has meant that I have been involved in many high profile and often ground breaking cases. It has always been good to see the outcome of a trial in the news and feel a sense of satisfaction at a job well done. Although not working on the technical side of the industry I have been the link between Tony and the case officer and/or OIC in far more cases than I can number - I do know that I have handled well in excess of 600 exhibits. One of the more ‘famous’ cases was the disappearance of Milly Dowler (subsequently found to have been kidnapped and murdered). There was also the case involving the disappearance of Shannon Matthews, who thankfully was found safe and well. There are numerous counter terrorism cases, including the infamous case which now involves all passengers having to carry a plastic bag containing their toiletries, through airport security.
Although I have been called to Court on numerous occasions, I have only had to give evidence once. This was a case involving a young man who was apprehended downloading terrorist information in a Belfast library. Those who know me will know, only too well and sometimes to their cost, that I am very rigid in my evidence handling and continuity and as far as I am concerned, there is a right way and there are far too many wrong ways. The reason I was called to give evidence on that occasion was because there was a ‘dispute’ over the number of items in an evidence bag marked ‘numerous CDs’. As this was a terrorism case it was heard under the Northern Ireland ‘Diplock Court’ rule. There was no jury, just the judge presiding, so that alone made it an interesting visit to Belfast.
You've worked for a long time with one of the founding fathers of digital forensics, Professor Tony Sammes. Tell us about that experience.
Working with Tony has been a phenomenal experience. I have learnt a great deal from him, probably more than I actually realise. Tony is a good friend, as was his wife. He continues to be my mentor and I will no doubt receive a ‘telling off’ when he reads this!
My first role with Tony, as I have said previously, was as his PA. I soon started handling exhibits for his casework and as it was an area of real interest to me I developed, with Tony’s agreement of course, my involvement. Many of his cases have been extremely complex and required me to sit in on lengthy case conferences - most cases lasted several months, some in excess of a year. Managing Tony’s casework was not always easy, especially when it came to prioritising the cases. My involvement commenced from first approach by the OIC of a case through to final Court appearance. Tony, being the natural teacher that he is, can explain the most complex subject and in such a way that someone of a non-technical nature can understand.
Tony is very unassuming and has, as those who know him well will know, a great sense of humour. He learnt very early on that I have a very quirky sense of humour and that I like ‘winding people up’. Imagine my surprise when after a very few weeks he turned the tables on me. I had not been looking after Tony’s cases for very long when an OIC rang and advised that he needed to collect an exhibit, a digital camera. As it was not in the exhibits cupboard I asked Tony for it, “It’s on the bench in the lab” he said. We went in and there it was…..in pieces. He scooped all of the small pieces up, put them onto the camera, tightened the screws and handed it to me asking me to seal it in an evidence bag. I was horror struck that I was going to have to hand over an exhibit which was quite obviously broken. He kept me in suspense for quite some time and then eventually admitted that the camera had been used by a witness to take pictures of an assault and that the police force involved had already replaced it for her. He certainly got his own back!
So working with Tony is not without its moments of humour and even surrealism. Tony’s nickname for me is ‘Stanley’ as in Laurel and Hardy’s ‘Here’s another nice mess …..’ If I advised him of a new case I had just taken on, with the words “You will like this one, it is really interesting, very different”, he was left in no doubt that it was going to be complex and most likely a piece of equipment which he had not had to deal with before. Hence the name.
In addition to your work at Cranfield, many people know you through your role as the F3 (First Forensic Forum) Secretary. What does that role involve?
I was elected to the F3 committee in 2004 and became secretary at the first committee meeting after that election. I enjoy this role and have made many friends through F3. My role involves liaising with potential new members and of course the current ones. I do everything that a secretary of any organisation has to do. When other committee members have organised the speakers for a one day workshop I take over the liaison with the venue and promote it to the members and take their bookings. I attend the majority of the workshops, usually dealing with the administration.
I would suggest that the biggest task I undertake is the Annual Workshops in November. I deal with the majority of the liaison, dealing with the venue and all other relevant parties, I also organise and book the after dinner entertainer; and the last part is the thing I worry the most about. Choosing a comedian who everyone will enjoy is not easy! Once asked on the first evening if I felt I could now relax, my response was “No, I will relax when the comedian gets a standing ovation”. Then when all is organised I ‘put out the call’ to the membership and then take the bookings.
All F3 work is done in my own time, which is why emails are often sent at an interesting hour of the night! The period in the run up to the Annual Workshops is the busiest and the treasurer, Steve Buddell, and I are often in email contact well into the early hours of the morning.
What are your own technical skills like? Are you a computer wizard?
The short answers, when I have finished laughing, are none and no.
I am what would be called ‘an end user’; I can, of course, use a PC, even set up a small home network but I would not call myself a wizard and certainly would not say that I am technically skilled. Having said that, no-one who worked with Tony Sammes for as long as I have could fail to pick up some knowledge. So all beware...I do understand much more than I admit to!
What are you most proud of as far as your time in the forensic field is concerned?
Being involved in my small way in the cases I have dealt with, especially those where child protection has been the issue. I have a great aversion to the terms ‘child pornography’ and ‘kiddie porn’. Children arrive into the world on the whim of adults, it is therefore my belief that we, as adults, should do all that we can to protect them.
I am also proud of my small involvement in the cases involving counter terrorism. The successful prosecution of several of these cases has assured the safety of thousands of lives.
I was honoured in 2009 to be the first non-law enforcement, non-practitioner to be granted associate membership of IACIS (International Association of Computer Investigative Specialists). This was granted in recognition of my work with the UK Law Enforcement community.
Tell us about your fundraising efforts with `Fingerprints & Footsteps´. Are there any plans for further walks?
I set up Fingerprints & Footsteps with the intention of carrying out just one walk, to raise money for research into non-alcohol related liver damage. This research involved using the patient’s own stem cells to repopulate the liver’s damaged cells. My friend Helen and I carried out the walk in 2006 and we had a great time whilst raising the money. Having enjoyed it so much, I had intended doing more but Helen moved into other areas of sport and then moved away. This made training a chore, with no-one to talk to it becomes a very boring exercise.
I did set out the following year on my own but was injured at the end of the first day which resulted in my having to abandon the walk after three days. I have tried to organise at least one other, with Helen taking part, but sadly it soon became apparent that the much needed on road support (hotel accommodation etc) was almost impossible to achieve once the recession set in. I still donate to different charities in the name of F & F but I am not planning any more walks, unless there is someone out there who would like to join me in the training etc, I am always ‘game’ for one more.
If you had not ended up working in forensic computing, what other path would you have chosen?
Well the sensible answer is child protection...the not so sensible answer is driving fast cars!
Lindy is available to take up a new position in December and would like to hear from potential employers who are interested in learning more about her extensive experience within UK forensics. She can be contacted by email on firstname.lastname@example.org.