An experienced forensic examiner can find evidence of such activity. The scenario you describe would be pretty easy to prove or disprove. If is was a botnet and was just using the guy's hard drive as a server, there would be no evidence that anyone actually opened the file on that system. When a file is opened, as opposed to being copied or downloaded, link files and other traces are created all over the place. That is just one fast way to tell, but there are others.
Trust me, if I was tasked to examine a case like that, I would make every effort to prove whether the pictures were deliberately downloaded and viewed. If I could not, I would say so, but I would try to validate any other possibilities as well.
How hard would it be for someone who was so inclined (and wanted to frame someone) to use a bot to make it look as though that person has deliberately viewed child porn?
Also, did you deliberately download a picture called zzzzz123.gif? Better check your cache! |