Facts: Appellant, a former police officer was living in an apartment attached to his mother’s house. One day, Appellant’s ex-wife and children came over to the grandmother’s house to visit with a sick pet. An argument ensued with Appellant and the police were called. Appellant’s son (BN) reported to the police that when he was 14, Appellant had BN bring his 13 year old girlfriend (TP) to the house. Then he convinced them to play strip wrestling while taking pictures of them. Appellant also encouraged BN to have sex with TP in Appellant’s room with a video recorder. BN did have sex with TP but turned off the video recorder. A search of Appellant’s home resulted in the seizure of multiple media devices. A forensic search of Appellant’s computer revealed both the images from “strip wrestling,” and numerous other images of child pornography. There were several issues on appeal, but we address only one here, as the others were easily resolved.
Attack on Knowing Possession of CP: Appellant argued that the location of the CP images were not enough to prove knowing possession. The computer investigator testified that the CP images were “shadow copies,” in the computer’s system volume information. The System Volume Information folder is a hidden system folder that the System Restore tool uses to store its information and restore points. There is a System Volume Information folder on every partition on a computer. The creation of a shadow copy results in “two data images—the original volume and the shadow copy volume” with the “functional difference between the two [being] that the original volume maintains full read/write capabilities, whereas the shadow copy volume is read-only[,] … ensur[ing] that the shadow copy volume remains a point- in-time copy until its status is changed by the administrator for a specific purpose.
The images at issue were located in shadow copy volumes “that existed in January of 2010,” meaning that the images were backed up in January 2010. The examiner testified that she found several software wiping/erasing programs. She also testified that the computer had the P2P file sharing program LimeWire installed, and she testified regarding the logs of LimeWire. These logs identified files that were contained in the shared folder for the username “Matt,” what files were downloaded, and recent downloads. In the G.B.I. specialist’s expert opinion, the LimeWire log files indicated image and movie file names that were “likely to be associated with child pornography” downloaded to the user’s shared folder. Due to the nature of shadow copies, the examiner could not tell the court whether the images were downloaded via LimeWire or were simply viewed on a webpage. She did opine that it was likely a LimeWire download.
Law: Despite the complexity involved in determining exactly when a person is knowingly in “possession or control” of child pornography transmitted electronically, the bottom line is relatively straightforward: Was the evidence presented sufficient to sustain the conviction? In a prior case, this court has held that the mere existence of pornographic images in the cache files of an individual’s computer is insufficient to constitute knowing possession of those materials absent proof that the individual either: (1) took some affirmative action to save or download those images to his computer; or (2) had knowledge that the computer automatically saved those files.” Barton v. State.
Holding: In the instant case, the State presented the presence of the wiping software, the LimeWire logs which contained file names associated with CP, as well as the evidence of BN and TN “strip wrestling.” This evidence was sufficient to show that even if Appellant didn’t know he presently possessed those images, it was enough to show that he had “prior possession” of the images.
Judgment affirmed, sentence vacated and remanded for re sentencing (The Judge failed to follow the sentencing rules).