A frequent issue that a computer forensics expert may encounter is the forensic examination of a hard drive containing child pornography.  Although a statute forbids receiving the evidence, a defendant challenged this in a case involving computer forensics in Virginia, specifically in the Eastern District of Virginia.  The case was U.S. v. Knellinger.

The United States argued that it afforded an adequate opportunity for inspection, viewing, and examination by offering to provide a private room in the Richmond, Virginia offices of the Federal Bureau of Investigation where counsel for the child pornography case and his forensics experts can access the hard drive. Knellinger disputed this. An evidentiary hearing was held to resolve this factual dispute. While the experts have minimal experience in child pornography cases, they had extensive experience in the sort of analysis that would be conducted in a child pornography case. The experts were therefore qualified to assist the Court in understanding the type of analysis that the defense was seeking to undertake.

A computer forensic expert who already had conducted an analysis testified that he does not need to view images of child pornography to conduct the sort of analysis in which he specializes, so, while he expressed some frustration with the strictures of s 3509(m), the statute apparently did not prevent him from doing his job. Another issue was that a defendant who is not charged with violating obscenity laws, may argue that the child pornography he possessed was not produced using real minors and required child pornography analyzed by experts in order
to determine whether or not the children depicted were real, such an analysis is “absolutely essential” where a defendant intends to pursue that line of defense.  This was important since the charges involved transporting, attempting to transport, receiving, and possessing child pornography made only with real minors. See 18 U.S.C. s 2256(8)(A). That, of course, does not foreclose the defense that the images are not real minors but, instead, are computer-generated images.

The witnesses established that assessment and presentation of a viable legal defense in Knellinger’s case requires expert analysis and testimony, and that qualified experts could not reasonably be expected to agree to conduct the required analysis given the extremely burdensome practical effects of Section 3509(m) on the reliable discharge of their obligations.
Of note is also that Congress amended its child pornography statutes in a manner that still proscribes certain computer-generated images of child pornography. See 18 U.S.C. 2256(8)(b). The Court ruled that under the terms of s 3509(m), it is necessary to order production of acopy of the hard drive to the defense. Production is necessary to ensure an ample opportunity to conduct the examination and to give his counsel an opportunity to participate in that examination in order to evaluate its ramifications for the legal defenses Knellinger might raise.

This computer forensics example has been presented by AVM Technology, LLC,
a Computer Forensics,
E-Discovery, and Computer Security consulting company located in
Richmond, VA and serving clients throughout the United States. AVM
technology can be reached at (804)
332-5752.