Forensic, General & Medical
Expert Witnesses

Computer Forensics and Sentencing Criteria in Child Pornography Cases


Expert Witness: Trace Digital Forensics, LLC
In child pornography cases, attorneys often rely on computer forensic examiners to look for evidence that a suspect or defendant possessed or shared contraband material. The sentencing criteria in these cases can be complex so it is important that attorneys convey to the examiner what to look for and how to report it.

The charges against a defendant will depend on whether he is accused of possessing/accessing contraband material, sharing such material, or producing the material. In general, distribution and production carry heavier sentences than possession. But, for each charge, sentencing depends on how much material was possessed, shared, or produced, whether the material consists of still images or video, how long the videos are, how old the victims are, and possibly other factors.

One of the most important questions for sentencing is how many images were there? The answer turns out not to be so simple. The first complication, is that videos and video clips
FIND MORE ARTICLES
may count as more than one image, depending on the jurisdiction. Under federal law, for instance, a video or video clip counts as 75 images. The court can also find that a longer video justifies a higher count. It is imperative then that the forensic examiner report back not just the number of files but the number of still images and videos separately. For the videos, it may also be appropriate to list the lengths of the videos or at least a count of the videos longer than a certain threshold (e.g. five minutes).

The next major complication is duplicate images. Some courts have found it appropriate to count duplicates as separate images whereas others have not. From a technical perspective, however, not all duplicates are created equal. A duplicate can be created by the defendant if he downloads a file on two different occasions, or if he copies a file to a second location. A duplicate can also be created automatically when a picture is added to a cache or thumbnail database by the operating system or other software on the defendant’s computer or smart phone. These thumbnail images are smaller versions of the original image that are stored so that the user can scroll through his pictures without the software having to load the full-size versions of every image. Unless you believe these distinctions are irrelevant in your case, you should request that the forensic examiner provide separate counts for the number of pictures that were directly under the user’s control, the number that were not directly under his control (e.g. cached and thumbnail images), and the total number of unique images.

It is also important to review or grade the images to determine which images meet or likely meet the definition of child pornography. It is common for child pornography and adult pornography to be intermingled and a defendant may store the images alongside other files that are not related at all. If the examiner notes that a particular folder contains child pornography then simply reports back the total number of files or pictures in that folder, that count could be wildly inaccurate.

You should provide guidance to the forensic examiner, or other individual who will review the images, so that they know what to look for and what to report. I suggest grading the images as Definite, Maybe, and No with respect to whether they contain child pornography.

Definite: Images that should be categorized as Definite are ones that clearly meet the criteria and are unlikely to be disputed by either side. These would include pictures of prepubescent minors or known victims engaged in sexual acts or posed in a manner that meets the legal criteria for child pornography.

Maybe: Images categorized as Maybe could show nudity or sexual acts but with persons who are pubescent and may or may not be adults. Whether these images are ultimately categorized as child pornography could depend on whether the victims can be identified or whether other evidence can show that they are underage. Another expert might be needed to evaluate these images.

No: Images that should be marked No are images that are not pornography (e.g. a fully clothed person) or that depict people who are clearly adults (e.g. a nude model with tattoos, or a picture with a copyright notice from a legitimate adult pornography site). These images should be unlikely to be disputed by either side. Images categorized as No should be further divided into the sub-categories “No but Relevant” and “No and Not Relevant”. An image categorized as No but Relevant would be an image that is related to the case but that does not meet the definition of child pornography (e.g. a fully clothed image of a victim). Images categorized as No and Not Relevant should include images that are immaterial to the case (e.g. a dog running on the beach).

By asking the examiner to categorize images this way, you can help them enable you to make judgements as to how the evidence fits the charges and the sentencing criteria. And, by working this out in advance, you can avoid needing extra time to re-grade the images later.

The other criteria you should give your forensic examiner will depend on the case and the laws in your jurisdiction. Some jurisdictions provide for stronger sentences if the images depict children who are prepubescent or below a certain age. Others provide higher penalties if the images depict sexual penetration. If this is important in your case, make sure you convey that to the forensic examiner and ask them to include this information in their report.



ABOUT THE AUTHOR: Steven Alexander
Steven is the founder of Trace Digital Forensics, LLC and has over twenty years of experience in technology. He has examined computers and mobile devices in criminal and civil cases, and in numerous internal investigations. He has a master's degree in Computer Science, and several certifications including EnCase Certified Examiner (EnCE) and Magnet Certified Forensics Examiner (MCFE).

Copyright Trace Digital Forensics, LLC
More information about this article at Trace Digital Forensics, LLC

Disclaimer: While every effort has been made to ensure the accuracy of this publication, it is not intended to provide legal advice as individual situations will differ and should be discussed with an expert and/or lawyer.For specific technical or legal advice on the information provided and related topics, please contact the author.

Find an Expert Witness