A state witness in a case in which ex-Evelyn Hone College Head of Media Studies Department, Clayson Hamasaka, is facing charges of being in possession of obscene materials last Friday told the Lusaka Magistrate Court that there was evidence that files on his (Mr. Hamasaka) laptop were accessed in his absence.
Mr. Hamasaka’s laptops were seized during a search at his house on 9th July 2013, however Lovemore Cheelo, who is the Forensic Computer expert from Zambia Information Communications and Technology Authority (ZICTA) told the parked courtroom that according to his expert analysis, there was evidence the laptop and files in question with the alleged obscene materials were accessed on 21st July 2013 in the absence of the accused and his lawyers.
He said the last login date on the computer, possibly by the accused person Mr. Hamasaka was on 21st June 2013.On 9th July 2013 the computers were seized and yet the same computer and files in question were opened and accessed on 21st July 2013, when they were not in his custody.
[pullquote]Ordinarily, the laptops and other gadgets should have been sealed and I should have been the one to break the seal before analysis. The sealing is the common standards that are used everywhere to make sure there is no tempering with data and files on the computer and secure the chain of custody[/pullquote]
Appearing during cross-examinations before Lusaka Magistrate Obster Musukwa, Mr. Cheelo told the court that on 8th August 2013, he received four laptops from Zambia Police that were seized from Mr. Hamasaka’s house during the search and was told to carry-out a forensic analysis with a view to find any defamatory content to the Head of State or any other information relevant to the investigation.
Asked by Mr. Hamasaka’s lawyers Wilson Mweemba and Keith Mweemba on the state in which he received the laptops, Cheelo told the court that none of the laptops or flash disks that he received were sealed, which should have been the case.
“Ordinarily, the laptops and other gadgets should have been sealed and I should have been the one to break the seal before analysis. The sealing is the common standards that are used everywhere to make sure there is no tempering with data and files on the computer and secure the chain of custody,” Cheelo told the court.
After being shown the receipt that showed the laptop was bought in 2008, Mr. Cheelo said it was strange that the laptop in question was indeed first used in 2008, yet the file in question with obscene materials was created in 2006.
He said it was clear someone was manipulating the dates on the laptop because it was not possible that the file with obscene materials could have been created and saved in 2006 when the computer was bought and first logged-on in 2008.
Cheelo testified that with these anomalies coupled with the fact that the laptops were not sealed, the danger of injecting or inserting incriminating data could not be ruled out.
On 9th July 2013 Team of eight police officers from Drug Enforcement Commission (DEC), OP and regular police raided Clayson Hamasaka’s house in Woodlands around 02:30am.They confiscated all phones from Mr.Hamasaka and family members in the house. They grabbed his laptops, computers and were collecting all sorts of documents from the house while the family was held incommunicado.The police are said to have trashed the home.
Mr.Clayson Hamasaka said that his young children were traumatized after the group of police officers raided his Woodlands Chalala home in a gangster movie like fashion.
‘It has not been the same especially for our young children who were traumatized with the experience after being held hostage in their own home at such an awkward hour,’ Hamasaka stated.
Last year, a combined team of Zambian security officers from Zambia Police, Drug Enforcement Commission (DEC), and Zambian Intelligence services raided homes of some journalists they suspected of contributing to on-line publications.
Mr.Hamasaka was detained at the police station from the early hours of the 9th July 2013 and only released on 10th July 2013 after being warned and cautioned in relation to seditious practice offences contrary to the provisions under section 57 and 60 of the Penal Code Act Cap. 87 of the Laws of Zambian pending further investigations.
The case was adjourned to 30th January 2014 during which the arresting officer will be expected to give his closing testimony.
He had a virus.
People I am talking about a trojan because in zambia a virus is aids related
sorry for educating people again
Thanks
For the first time I will agree with Mushota.Obviously the Zambia Police have never heard of Trojans.But tell me why on earth did they go to his house with guns at 2.30am and traumatise his family?Surely if we searched 90% of Zambian mens computers we would find ‘obscene’ material. However my other theory is some dimwit OP officer downloaded p$#*! on the 21st July and uploaded it onto Hamasakas computer.
I guess the hard working Trafalgar Clinic staff have done all they can for you mushota that the virus has spread to your brain because you are now beyond redemption and psychotic
Why waste taxpayers money on such petty matters? Check all mens phones,a few of the would ecsape prison,whats the big deal if i want a stimuli,Zambia too behind!
Mwebantu a virus doesnt plant this kind of evidence. Nevertheless bakapokola ba mu Zambia ba tulo
Technologically challenged OP/police officers caught napping again……..this time they will have to pay Hamasaka heavily
ati ba expert. alepapa ifyaba so simple? if you put example a video file on DVD media, it will retain the date on which it was created whichever computer that file will be deposited. that picture or video file came from a dvd compact disk. it was created in 2006. even if you copy it to a computer in 2015, it will still retain that date of creation.
I know the guy he is indeed an expert in that field despite that that was a simple issue that anyone familiar to computers would know. In the courts they do not pick every Jim and Jack to analyze or give evidence in such issues hence they had to call some expert in the field.
these things are simple, you call this chelo cmputer expert? iliko bad pa zambia
simple osa nama boza. ndiye problem chifukwa sindiwe expert olo bululu wako. why are’nt you an expert of anything then
The thing here is not to discredit the forensic expert. He is not trying to please anyone. He’s just doing his job with interference from anyone Ba OP and the Zed-P are so useless. The can’t operate independently. Anyway, i can’t blame them, I can only blame the person who’s in charge of them because he can’t reason beyond the grade twelve level.
That’s not necessarily true. By default a computer allocates as date of creation the date a file was first saved on storage devices connected to it, or the date the file was last edited. This is especially true for multimedia files.
Are you people forgetting that this is the same “forensic expert” who was in fact found guilty of contempt of court after telling lies under oath. This prosecution is useless. They’re costing the people of Zambian tens of thousands pursuing cases that will go nowhere with these OP operatives who can’t even cover their tracks.
What kind of expert is this? when u acess a file on the pc, it retains that date. bad the date that has been retained is the date that the cops accessed the files. hasaka planted the files. nomba our cops are very dull. they went and accessed the same files. so the pc retained the same date
Quote: “…After being shown the receipt that showed the laptop was bought in 2008, Mr. Cheelo said it was strange that the laptop in question was indeed first used in 2008, yet the file in question with obscene materials was created in 2006.
He said it was clear someone was manipulating the dates on the laptop because it was not possible that the file with obscene materials could have been created and saved in 2006 when the computer was bought and first logged-on in 2008….”
I do not 100% agree with this computer expert’s conclusions. I think there are a lot of factors to consider before Mr. Cheelo can come to such a conclusion.
cont…
Factors which are not stated here! For instance factors such as the type of Operating Systems installed on the laptops: Is it Mac, Win8, Win7, Vista, Win XP, Win NT, etc. After these considerations, the kind of File System that is in use (FAT or the NTFS file system), and the partition (whether the action occurred on the same partition or across partitions). To the uninitiated, below are the basic definitions:
1) FAT stands for “File Allocation Table” and FAT16/32 is an extension which means that data is stored in chunks of 16 or 32 bits. These are older types of file systems that aren’t commonly used these days.
2) NTSF stands for “New Technology File System” and this took over from FAT as the primary file system being used in Windows.
cont…
Now, having defined what file systems are, below is the general file properties with regards to the DATE and TIME stamps (I use FAT16 as an example, but all FAT versions basically work the same way):
* If you COPY a file from C:\fat16 to C:\fat16\sub, it keeps the SAME MODIFIED DATE and TIME but it CHANGES the CREATED DATE and TIME to the current date and time.
* If you MOVE a file from C:\fat16 to C:\fat16sub, it keeps the SAME MODIFIED DATE and TIME and keeps the SAME CREATED DATE and TIME.
* If you COPY a file from C:\fat16 to D:\NTFS, it keeps the SAME MODIFIED DATE and TIME but CHANGES the CREATED DATE and TIME to the current date and time.
cont…
* If you MOVE a file from C:\fat16 to D:\NTFS, it keeps the SAME MODIFIED DATE and TIME and keeps the SAME CREATED DATE and TIME.
* If you COPY a file from D:\NTFS to D:\NTFS\SUB, it keeps the SAME MODIFIED DATE and TIME but CHANGES the CREATED DATE and TIME to the current date and time.
* If you MOVE a file from D:\NTFS to D:\NTFS\SUB, it keeps the same modified date and time and keeps the SAME CREATED DATE and TIME.
NOTE: In all the examples, the MODIFIED DATE and TIME of a file does not change unless a property of the file has changed. The CREATED DATE and TIME of the file changes depending on whether the file was COPIED or MOVED.
Cont…
So, basically, all Windows file systems record the same three values:
Time/Date Created:
When you create a new file or directory, this value is set and does not normally change (unless you deliberately change it). If you make a new copy of a file and save it to a different location, it is treated as a new file and a new creation time stamp is set. Moving a file or simply renaming it does not create a new file, and thus does not give the file a new creation time stamp. (Note: It is possible to end up with a file that has a modification time that’s earlier than its creation time when you make a new copy of a file.)
cont..
Time/Date Modified:
This is also called the Last Written date. Whenever the contents of the file are changed, or files are added to or deleted from a directory, this time stamp changes. Renaming the file doesn’t change the modification time stamp. Neither does opening the file without making any changes to it.
Time/Date Accessed:
This is supposed to show the last time the file was accessed, but there is generally a time lag and depending on the nature of the file it may not record it unless a change is made.
In short, Cheelo’s conclusion based solely on the date of the purchase receipt is misleading at best and erroneous at worst. The date (2006) of the file/s in question could be maintained if the files were MOVED to the new Laptop/s. So his conclusion is suspect!
@Yambayamba , THANKS FOR GIVING US A VERY ANALYTICAL WAY OF LOOKING AT THINGS IN THIS MANER. BIG UP
@Yambayamba, you know the stuff. I wish you were the expert in court. Brilliant explanation.
As much as I agree with Yambayamba the issue at hand is why didn’t the officials who confiscated the laptops/computers /flash discs/memory sticks seal them in the accused ‘s presence?????????