The Case of the Deleted Incriminating Evidence
When I first started my current job, I also had some minor responsibilities in the schools Design Technology department. This involved very little, apart from keeping track of the digital cameras they used for photographing project work.
One day, a teacher lent one of the cameras to a student so he could take some photos of work he’d been doing at home. He was instructed to bring the camera back by the end of the week.
After more than two weeks, and several stern talkings-to by various members of staff, the camera eventually returned.
I then learned that this student had a history of being a delinquent little turd. When the camera finally found its way back to us, the student’s Head of Year immediately asked to see the photos of the work he had supposedly been doing at home, and asked me if it was possible to see exactly when the photos were taken. When we checked, we found a few photos taken two weeks previous, then a large gap in the file sequence numbers, then a few more photos taken the day before.
The student was in the room at the time, and claimed the gap was down to him deleting some that ‘weren’t very good’. The Head of Year was unsurprisingly suspicious, especially given the photos he did have were just as bad. Once the student left, I told the teacher it may be possible to recover the deleted files. He was extremely interested.
Digital cameras almost exclusively use the quite simple FAT format for their memory cards. FAT is very good at leaving deleted data hanging around for undelete programs to recover, and it didn’t take me long to find out what the missing photos were actually of.
The photos were of the student and his friends taking illegal drugs at a party.
The response of the Head of Year when I presented him with the files was that curious mixture of fury and glee that you see on a teacher’s face when they realise that they can finally nail the kid that’s been a thorn in their side for too long. I’m told you could hear the subsequent dressing-down from two rooms away.
And the student? He got off with a brief suspension in the end; the evidence was not conclusive enough for the police to press charges. He later went on to attempt to frame another student for defacing the school’s Wikipedia entry to question the Headmaster’s sexuality, and was finally expelled after beating another student while his friends held the victim down. It’s rare for teachers to actually cheer when students are ‘permanently excluded’, but it did actually happen on this occasion. In a final twist, some students actually tried to petition the government via the No. 10 website to overturn his explusion; it was rejected on the grounds that “it was outside the remit or powers of the Prime Minister and Government”.