Evidence in Michigan Child Pornography Cases Often Destroyed

Pornography has never been easier to access. Anyone with a smart phone can readily obtain all kinds of pornography. While porn sites are often clearly named, such as Pornhub, other platforms containing pornographic images are less obvious and include many kinds of social media, such as such common apps like Tumblr and Instagram, various chat groups like Kik, and video sharing sites like BitTorrent.  Regardless of the means used to access pornography one thing remains constant. No matter how careful a person in when trying to cover up their digital footprint, chances are a good forensic analyst will be able to uncover that which is meant to stay private.

Child pornography is always illegal to receive, possess, distribute, or manufacture.  Many people believe that if they delete images on their phone or computer, these images are really deleted. However, simply hitting delete rarely actually destroys the evidence. If this were true, then nearly all child pornography cases would be based on destroyed evidence.  One place such deleted images may reside is in a computer’s cache or temporary memory.

What is a cache?

A cache is an area of a computer’s memory that temporarily stores information about files viewed on a device. The purpose of cache is to allow webpages to load more quickly, and therefore, nearly all electronic devices- computers, phones, and tablets- have a cache.

A cache can exist both in the device itself and within apps on the device. For example, if you’re browsing the internet on your iPhone on the Safari app, both the iPhone and Safari could store data about what you’re viewing. Further, Safari (and other browsers like it) will typically store copies of any images viewed on the pages you visit.

The main purpose of a cache is to allow the computer, app, or software to quickly and easily access files so that the device, app, or software can run faster.

What is hash value?

Hash value is a unique set of numbers that is designated to a specific file and stored in a cache. Another way to put it is that a file’s hash value is its fingerprint (again, unique). In a child porn case, a forensics expert can identify images by finding its hash value in the cache.

How does law enforcement know that a file in a cache is child pornography?

If law enforcement searches a computer and only finds hash values in a cache, no pictures, it can still identify those files as child pornography by checking the hash values against the National Center for Missing and Exploited Children database. NCMEC maintains a database that includes millions of images of exploited children. The database includes the hash values for those images. Law enforcement can take the hash values found in the cache of a device of someone suspected of possessing, distributing, or producing child pornography. If they find a match, it will be used in prosecuting that person.

What if you accidentally downloaded images that are child porn?

Some people inadvertently get child porn and child sexually abusive material by accident. Child porn is frequently saved with generic file names (e.g. sunshine.jpeg). If you use torrent sites and other file sharing websites, it’s possible that you search for a completely innocent term like “Madonna” and download a folder of files related to that word. There have been cases in which many legal files are in the same download as only a few child porn images because of generic terms like “Madonna.”

In a situation like this, a forensics expert can look at the cache and the data logs and tell whether pictures stored on the cache were ever opened. If they were never opened and the ratio of legal files greatly outnumbers the child porn images, there may be a good case for an accidental download defense.

Having experienced counsel is crucial

Child pornography charges, whether charged at the state or federal level, are serious cases with serious potential consequences. Child pornography cases are made more difficult by the amount of technological expertise required to investigate, charge, prosecute, and defend. It is so important that specialized detectives, prosecutors, defense attorneys, and experts are assigned or hired for these cases. Many child porn cases involve a government electronic forensic expert searching an electronic device’s cache to find evidence of child pornography (called, Child Sexually Abusive Material (CSAM), in Michigan). Therefore, if you are hiring an attorney to defend child porn charges in Michigan, it’s crucial that attorney has an in-depth knowledge of how a cache works.

If you are being accused of possessing, distributing, or manufacturing child pornography, the Michigan sex crimes attorneys at the Barone Defense Firm can help. It is absolutely crucial that we intervene is early as possible in the investigation to give our clients their best chance at avoiding conviction and the life-changing consequences of a child pornography charge.