We are one of the only firms in Georgia that specializes in the defense of child pornography cases. Over the years, we have obtained an overwhelming number of dismissals and acquittals for clients charged with these offenses. We work with the leading investigators and experts in the field and will use whatever resources are necessary to win the case.
Since child pornography cases are primarily based on computer-related evidence, attorneys who handle these cases should be well-versed in interpreting computer data and must be able to recognize and obtain the type of data that will prove the client’s innocence. It is vitally important for lawyers to know how to use and analyze computer evidence and, more importantly, when to retain a computer forensics expert.
Bernard has been recognized throughout the legal community for his success in defending computer-based offenses and is frequently called upon to speak at trial lawyers seminars to teach others how to understand and use computer forensics evidence in criminal cases.
In Georgia, child pornography cases are prosecuted under the sexual exploitation of children statute. Under Federal law, prosecutions are based on either the distribution, receipt or possession of child pornography. The federal statute provides for mandatory minimum prison sentences for distribution and receipt with no mandatory minimum sentence for possession. This distinction has been heavily criticized as it is virtually impossible to possess pornography without having also received it. Thus, the government has been able to arbitrarily decide which individuals will get prosecuted for receipt versus possession.
Peer-to-Peer File Sharing Programs
Most child pornography cases stem from the use of peer-to-peer file sharing programs such as Ares, BitTorrent, eMule and Shareaza that provide access to a vast network of files. Many people use these programs to download pornography and the majority of it is legal adult pornography. Occasionally, a person may accidentally download a file containing child pornography but may not realize this until the file is actually viewed. While deleting the file will keep it out of sight to the user, this does not remove it from the hard drive of the computer or device. Thus, a person who has accidentally downloaded child pornography will still remain in possession of the file well after it is deleted.
In order for us to prove that the file was accidentally downloaded, it is critical for us to analyze the file and folder properties on the computer. Many times, we can obtain the search terms used by the client to prove that the download was accidental. Since the police will never be looking for this type of evidence during their investigation, it is imperative for us to search for and obtain this evidence in order to prove our client’s innocence.
Cache and Deleted Files
Anytime a website is viewed, all of the pictures and videos on that site are automatically downloaded to what are known as “cache files,” or “temporary internet files.” These files are downloaded without the user’s knowledge and may remain on the computer for a long period of time. These cache files very often lead to the unknowing possession of child pornography.
Another type of cache file is a “thumbs.db” file. Thumbs.db files are system cache files that are created by Windows and are associated with actual image files stored somewhere else on the computer. These files are also stored without the user’s knowledge and are typically hidden from view. Even if the image file is later deleted from the computer, the thumbs.db file will remain on the hard drive. The problem is that the thumbs.db file contains the same picture that the image file contains—just in a lower resolution. So, if an image of child pornography is deleted from the computer, the associated thumbs.db file, containing that very same image, will remain on the hard drive without the user’s knowledge.
In Barton v. State, the Georgia Court of Appeals held that the presence of child pornography saved in a person’s cache files does not, by itself, constitute knowing possession of child pornography. The ruling in Barton also applies to deleted files found in the unallocated space of the computer. To prove that a person knowingly possessed cache files or deleted files in the unallocated space, the prosecution will have to prove that the person actively sought out and stored these files on the computer.
Computer Forensics Experts
With the assistance of computer forensics experts, we can usually prove when a user has accidentally downloaded or possessed child pornography. Using software such as EnCase or FTK, the expert can retrieve data from the hard drive that enables us to retrace the steps that led to the unwanted files entering the computer. For instance, an expert can assist us in locating search terms used with file sharing programs, internet history data, file properties that can show when files were downloaded or deleted, as well as extract data that will help create timelines surrounding the downloading of the unlawful files.
It must be stressed that very little of this data can be obtained from the hard drive without the use of a computer forensics expert. We are fortunate to be able to work with some of the best experts in the field and with their assistance we have successfully proven the innocence of many people.
For more information, please visit Georgia Sex Offense Law for our posts on What Constitutes Possession of Child Pornography, Part I: Deleted and Cache Files and Part II: Accidentally Downloading or Possessing Image and Video Files.