@BillRM,
Comment when you copies directories over from one computer to another you can indeed end up with thumbnails of pictures that was never on your computer.
http://www.forensicon.com/resources/casesummaries/cs_vosburgh.asp
United States v. Vosburgh
Court Upholds Thumbnail File as Sufficient Evidence602 F.3d 512 (3d Cir. 2010)
On an appeal of a conviction for the possession of child pornography, the Third Circuit held that a thumbnail file recovered during the government's forensic investigation was sufficient evidence to find that the defendant had previously possessed the corresponding full-size images.
The government's case began when an FBI Special Agent went undercover on a website known for the distribution of child pornography, advertising a link to a video that actually recorded users' IP addresses. After the defendant clicked on the link, the agent used his IP address to subpoena the defendant's Internet Service Provider for his name and home address. The agent then obtained a search warrant for the defendant's residence.
Upon executing the search warrant, FBI agents seized multiple pieces of computer equipment, including the defendant's external hard drive. When the FBI's computer forensics expert examined the hard drive, he did not find any full-size images of child pornography but instead recovered a thumbs.db file containing two incriminating thumbnail images. The thumbs.db file is created automatically by the Windows operating system when a user views thumbnail images of other image files contained within the same computer folder and is often hidden from the user.
The FBI proceeded to prosecute the defendant on the basis of the recovered thumbnail images. At trial, the government's forensics expert testified that the contents of the thumbs.db file indicated that the full-size images were once stored on the defendant's computer and had been accessed shortly before the seizure of the hard drive. The defendant's computer expert demonstrated that the thumbs.db file could have been copied from another user and would have retained the thumbnail images even if the full-size images of child pornography were not also copied to the external hard drive.
On appeal, the defendant argued that the thumbs.db file provided insufficient evidence that he had ever possessed the incriminating images. The Third Circuit found that this argument lacked merit and that "the jury could have reasonably inferred from this testimony that [the defendant] not only possessed, but knowingly possessed, those pictures." The thumbnail image, combined with the computer forensics expert's testimony, provided sufficient evidence to support the conclusion that the defendant had, at one time, possessed the full-size images required for conviction.
Download Case Summary [PDF]
Back to Resources...
powered by
Custom Search
Web
..
ResourcesArticles
Case Studies
Web Resources
ServicesInternal Investigations, Trade Secrets, and Employment Litigation.
Read about our services...