Deleted and Temporary Internet Files: Defending Child Pornography Charges

Child Pornography Defense Lawyers

In federal court, possession of child pornography is typically prosecuted under 18 U.S.C. § 2252 and § 2252A. These statutes require that a person “knowingly” possess an image depicting child pornography for there to be a conviction. State child pornography laws also typically require that the user knowingly possess the image or video in question. (See our page on Virginia’s Child Pornography laws).

Contact Johnson / Citronberg | 855-959-4003

In many cases, however, the Government’s evidence shows that the images in question were either deleted or stored in the computer’s temporary internet files. To determine if a person “knowingly possessed” such an image, we must first understand how computer systems create and store deleted and temporary internet files.

For a full discussion on potential defense to child pornography offenses, view our main page on child pornography cases here. You can also learn about thumbs.db files here.

Deleted Files

There is a common misconception that deleting a file from one’s computer removes the file entirely from the computer. The process of deletion is much more complicated. When a user deletes an image, the image is first sent to the computer’s recycle bin. If the user deletes the file from the recycle bin (or if the bin runs out of space), the image is moved to an area of the hard drive called “unallocated space.” Unallocated space (or “free space”) is the area where new files can be stored by the computer. In addition to images, the following types of files can be stored in unallocated space:

• Videos
• Emails
• Chats or instant messaging
• Browsing History
• Documents

The user won’t be able to see any images in the unallocated space portion of the hard drive, but a computer forensic expert can easily search this area with specialized software, such as EnCase. EnCase is a program favored by many law enforcement agencies when searching a computer for child pornography.

It should be noted that there are times when images or other files in the unallocated space can be fully overwritten (for instance, if the computer runs out of unallocated space, it can overwrite these files with new data). There are other times when the image or file may be partially overwritten and some evidence of it can remain.

When law enforcement only finds deleted files, the question becomes whether the user knowingly possessed the deleted files. While every case is different, innocent people may find themselves charged with a crime in these different scenarios:

Defense Scenario 1: A user unintentionally downloads child pornography and then deletes the file.

Defense Scenario 2: A user buys a computer not knowing that the original owner had downloaded and deleted child pornography.

Defense Scenario 3: A user lends his laptop to a friend who downloads and deletes images of child pornography before returning it to the user.

Temporary Internet Files or Cache Files

When a user views a website, the computer system automatically downloads all of the pictures and videos on the site to the hard drive’s “temporary internet files” or “cache files.” The number of images and videos stored in the temporary internet files is determine by the space allocated for these files as well as the amount of internet usage. It is very possible that an image might stay in the temporary internet files for months or even years after someone visits a website. It is important to note that even if the images or videos are bumped out of the cache or temporary internet files (due to a lack of storage), they may very well find themselves in the unallocated space portion of the hard drive.

Once again, if law enforcement only finds temporary internet files, the question becomes whether the user knowingly possessed such images. In addition to someone else the computer, there are other common defense scenarios that should be considered:

Defense Scenario 1: The user never intended to visit a website containing images of child pornography.

Defense Scenario 2: The user never saw child pornography on a website because the images were below the viewable screen or were hidden on the site.

What do the Courts say?

Courts generally recognize that a user may be innocent because possession was not knowing. The Ninth Circuit, for instance, stated the following: “Where a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images. To do so turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control.” United States v. Kuchinski, 469 F.3d 853, 863 (9th Cir. 2006).

Similarly, the Fifth Circuit reasoned: “courts have refused to find that a defendant constructively possessed child pornography located on his computer simply because the defendant exclusively possessed that computer, without additional evidence of the defendant’s knowledge and dominion or control of the images.” United States v. Moreland, 665 F.3d 137 (2011).

Building a Defense

Anytime the Government’s evidence only shows images of child pornography in unallocated space or temporary internet files, the defense should question whether the Government can prove that possession was knowing.

The defense lawyer should not simply take the Government’s forensic report at face value. It is often necessary for the defense to hire an independent computer forensic expert to evaluate the Government’s report and to conduct their own thorough investigation. An independent expert can poke holes in the Government’s report (including contradicting where the images are located), develop an alternative theory as to how the images came to be on the machine, and help the defense craft a list of thorough cross-examination questions for the Government’s expert.

By challenging the Government’s theory of the case with an independent expert, the defense can greatly increase its chances of winning a dismissal or reduction prior to trial. If the case proceeds to trial, the defense will have a credible and solid defense to the charges.

Contact Us

If you or someone you know has been charged with a child pornography offense, you should contact an experienced internet sex crimes attorney as soon as possible. Our law firm uses leading computer forensic experts to challenge the Government’s allegations and to prove our clients’ innocence.