Thumbs.db Files: Defending Child Pornography Charges
Child Pornography Defense Attorneys
When law enforcement searches computers for child pornography, they will often only find “thumbs.db files.” Understanding thumbs.db files is therefore critical to developing potential defenses to possession of child pornography charges.
Below are several points about thumbs.db files that anyone defending a child pornography case should know.
Point 1: Thumbs.db files are used by Windows to store thumbnail images of the actual files in a folder.
Point 2: Thumbs.db files are not intentionally created by the user. These files are cache files that are automatically created by Windows when an actual image is stored somewhere on the hard drive.
Point 3: A user is typically unaware when a thumbs.db file is created. Windows Explorer has a default setting which actually hides the file so that the user cannot see it.
Point 4: Thumbs.db files contain the same picture as the actual image containing child pornography. While the pictures are a much lower resolution than the actual images, law enforcement’s software will still detect the pictures.
Point 5: Thumbs.db files will stay on the computer even if the actual child pornography image is deleted.
Point 6: If the actual image is deleted from the computer, a user will typically not be able to access the thumbs.db file. A user would have to use specialized forensics software, such as Encase, to view the file. Encase is one of the preferred forensic tools used by law enforcement to search for child pornography on a device.
THE BEST WAY TO DEFEND YOURSELF AGAINST CRIMINAL CHARGES IS TO HIRE A LAWYER WHO IS AN EXPERT IN THAT FIELD.
CONTACT JOHNSON / CITRONBERG | 855-959-4003
What Do The Courts Say?
In one federal case involving the possession of child pornography, the Eleventh Circuit summarized thumbs.db files the following way:
“[The agent] explained that all of the images of child pornography on the laptop were contained in ‘thumbs.db’ files. A ‘thumbs.db’ file is a database that is automatically created when a user chooses to view all of the files within a particular folder in a thumbnail view. A user might do that ‘to quickly identify image files or other files inside that folder without having to open up every file that they come across until they find the one they’re looking for.’ Even if a user deletes all of the images in a folder, the ‘thumbs.db’ file remains unless the folder itself is deleted.” United States v. Schaff, 454 Fed. Appx. 880 (11th Cir. 2012).
Building A Defense
To convict someone of possession of child pornography, the Government has to prove that the user knowingly possessed the image in question. As seen above, a user will rarely knowingly possess a thumbs.db file as Windows automatically creates and hides these files.
This creates a difficulty for the Government in proving its case. The Sixth Circuit Court of Appeals, for instance, noted that “[w]hen images are only recovered from a computer system’s cache, rather than organized on a hard drive or other storage media in a more intentional manner, it is sometimes more difficult for the government to show that a defendant knowingly possessed the child pornography.” United States v. Johnson, 775 F. App’x 794 (6th Cir. 2019).
Other courts have found that the defendant must have “the knowledge and ability to access the images and to exercise dominion or control over them.” United States v. Moreland, 665 F.3d 137, 150 (5th Cir. 2011); see also, United States v. Flyer, 633 F.3d 911, 919 (9th Cir. 2011), finding that “our precedent relating to cache files suggests that a user must have knowledge of and access to the files to exercise dominion and control over them.”
So if the evidence only shows thumbs.db files, the Government will have a difficult time showing knowing possession. This creates a powerful defense to use at trial, or at the very least, provides the defense with leverage to work out a more favorable plea agreement with the Government. The presence of only thumbs.db files can also make it more difficult for the Government to prove the more severe charges of receipt and distribution of child pornography.
Hiring A Computer Forensic Expert
An independent computer forensic expert should always be retained to review the Government’s forensic reports. In some cases, the Government’s expert report may not detail that the images were in fact thumbs.db files. In other cases, an independent expert can help the defense to establish that any thumbs.db files were not knowingly possessed by the defendant.
In a Northern District of Georgia case, we represented a schoolteacher accused of possessing child pornography after law enforcement raided his home. The Government initially argued that there were images intentionally saved to his computer. Our independent expert disputed the Government’s contention, and as a result, the Government dismissed all charged two days before trial.
Contact Us
Johnson/Citronberg is one of the few criminal defense law firms that specializes in internet sex crimes like possession of child pornography. By using independent computer forensic experts and cutting-edge technology, we have amassed an overwhelming number of dismissals and reductions prior to trial. If you would like to see if we can help, give us a call 855-959-4003. We have offices in Alexandria, Virginia and Atlanta, Georgia, and we represent clients in federal court around the country.
