Replies

Thanks for quoting that. Maybe you can tell me what it means.

If it's true, it makes it less likely that the pictures were something that got onto his computer without his knowledge. There may be porn sites that plant pictures on your computer that you don't know about, but they don't usually store those pictures in the same file where you keep naked pictures of your wife.

..but they don't usually store those pictures in the same file where you keep naked pictures of your wife.

I usually have one "file" per picture. The agent said the kiddie porn was stored in the same computer file where partially nude images of his wife were also stored.

One file with numerous pictures in it? I don't think so.

There may be porn sites that plant pictures on your computer that you don't know about, but they don't usually store those pictures in the same file where you keep naked pictures of your wife.

Depends. If the program just saved the file into the default "My Documents" or "My Pictures" folders in Windows, it's entirely possible that they could have ended up together without his knowledge (I doubt it, but anythings possible).

As to whether or not it's planted: A decent computer forensics application should be able to easily reveal the origins of the file. The files creation date and its last accessed date should reveal when it was placed on the computer and the last time someone looked at it. Programs used to view the files, from Kazaa, to Paint, to Media Player, also leave footprints in the system registry and various files making access tracing relatively simple for people who know what they're looking for. If he downloaded it off the web, there's probably still incriminating images sitting in his browser cache, or that may be recoverable from previous deletions unless he hashes his free space after clearing his browser (highly unlikely unless he was the extremely paranoid type).

In other words, if he put the images there and looked at them, there should be additional supporting evidence to show where and how. Can this type of evidence be faked as well? Yes, but court recognized computer forensic processes require that timestamped sector by sector disk images be pulled and maintained to show an "unaltered" baseline version (in fact, many LEO's pull the original HDD, do a hardware dupe of the drive, and then do their investigation using the duplicate so that the original data remains "untainted"). If none of this was done, the guy has extremely strong grounds to show that the chain of evidence may have been violated and that the data may be totally inadmissible.