Court Upholds Thumbnail File as Sufficient Evidence
602 F.3d 512 (3d Cir. 2010)
On an appeal of a conviction for the possession of child pornography, the Third Circuit held that a thumbnail file recovered during the government’s forensic investigation was sufficient evidence to find that the defendant had previously possessed the corresponding full-size images.
The government’s case began when an FBI Special Agent went undercover on a website known for the distribution of child pornography, advertising a link to a video that actually recorded users’ IP addresses. After the defendant clicked on the link, the agent used his IP address to subpoena the defendant’s Internet Service Provider for his name and home address. The agent then obtained a search warrant for the defendant’s residence.
Upon executing the search warrant, FBI agents seized multiple pieces of computer equipment, including the defendant’s external hard drive. When the FBI’s computer forensics expert examined the hard drive, he did not find any full-size images of child pornography but instead recovered a thumbs.db file containing two incriminating thumbnail images. The thumbs.db file is created automatically by the Windows operating system when a user views thumbnail images of other image files contained within the same computer folder and is often hidden from the user.
The FBI proceeded to prosecute the defendant on the basis of the recovered thumbnail images. At trial, the government’s forensics expert testified that the contents of the thumbs.db file indicated that the full-size images were once stored on the defendant’s computer and had been accessed shortly before the seizure of the hard drive. The defendant’s computer expert demonstrated that the thumbs.db file could have been copied from another user and would have retained the thumbnail images even if the full-size images of child pornography were not also copied to the external hard drive.
On appeal, the defendant argued that the thumbs.db file provided insufficient evidence that he had ever possessed the incriminating images. The Third Circuit found that this argument lacked merit and that “the jury could have reasonably inferred from this testimony that [the defendant] not only possessed, but knowingly possessed, those pictures.” The thumbnail image, combined with the computer forensics expert’s testimony, provided sufficient evidence to support the conclusion that the defendant had, at one time, possessed the full-size images required for conviction.
- Staff Recognized for Departing Employee Investigations - The first issue of Corporate Counsel Business Journal, CCBJ, includes an interview with our Director of Digital Forensics, Yaniv Schiff, and Solutions Architect, Curtis Collette, on the evolution of departing employee investigations. Departing Employee: When Do Investigations Become Necessary? appeared in the print publication, online edition, and on CCBJ’s In-House Tech website. For Increasing Numbers of Employers, Departing Employee Investigations[...Read More]
- Chicago Office Food Drive – The Results Are In - QDiscovery’s Chicago Office collected nearly 1,000 containers of food for the local food bank this Holiday Season! Our office competed with sister offices in Indiana and Connecticut. Alas, we came in third. Our sister offices each collected nearly 2,000 containers for their local food banks. Relatively new to the company-wide food drive, the Forensics Division[...Read More]
- QDiscovery Forensics Team Develops Award Winning App! - QDiscovery is winner of a 2017 Relativity Innovation Award. Presented at Relativity Fest, the award celebrates organizations that create apps or integrations that extend the functionality of Relativity’s eDiscovery software. Our development team created an application that makes the analysis of mobile collections much more manageable. Relativity users can now produce and review mobile device data[...Read More]
- Moving and Changing - Acquired by Connecticut-based QDiscovery in 2016, Forensicon’s capabilities multiplied overnight, both in forensics brain power and eDiscovery expertise. As part of a leading provider of end to end litigation support, moving to larger offices that are more central to the Chicago legal community was inevitable.
- QDiscovery Named One of the Top 20 Providers of Legal Services! - Leading industry publication, CIO Magazine, has named Forensicon’s parent company, QDiscovery, to it’s Top 20 Providers of Legal Services. The annual listing includes 20 companies that are at the forefront of providing legal solutions and impacting the marketplace. Read the whole article here. Featured in the publication alongside QDiscovery President, Dave Barrett, is Director of Digital Forensics, Yaniv[...Read More]