I am aware of a case, not that I'm working on but that a colleague is involved in, where the suspect is indeed a professional photographer and master retoucher - it is clear from looking at some of his professional legitimate work that he does have an ability for photo manipulation at what some would say to be high quality. For example he can render photos of a man transforming into a werewolf that, if you didn't know werewolves were not real, you may well believe what you were seeing was the real thing.
This individual has subsequently come under investigation for possessing a large cache of indecent images of children. Some images found to depict the suspect abusing children in South East Asia.
His 'defense' is an interesting one; effectively that said indecent images are the result of photo manipulation, that no child was harmed in the making of any of the images, and that he created the images so that he could engage in some kind of undercover operation to penetrate pedophile networks for journalism and then pass the acquired information onto the police.
The opinion is that regardless of whether the images were manipulated or not, the possession of any image depicting child abuse (real, simulated or 'retouched') is illegal and this does not amount to a defense for possession of child pornography.
Now here is the big issue - as I'm sure anyone is aware the penalties for possessing child abuse images are not even close to the penalties to if such images can prove an individual themselves has engaged in child abuse.
As it is not possible (at this time) to identify the foreign victims depicted in the child abuse images, the images themselves are what need to be relied on in court to prove that he has engaged in child abuse.
As is common practice among prolific child pornography users, much of the metadata has been swept from the images.
How to prove that the images are originals and have not been retouched?
PS his work computer is an iMac encrypted with FileVault that has been unable to be examined, adding difficulty to the case in being unable to examine his internet browsing, chats, and signs of any of his retouching work actually showing the images as works in progress. The bulk of the evidence has come from a USB drive.
I am aware the 'defense' is a laughable one, but where he has engaged in contact abuse with children it is essential to bring a strong case for this, and not simply settle on much lesser child pornography charges.
Depending on the case jurisdiction, the production and depiction of contraband images, even photoshoped, can be prosecuted.
Easiest - NSRL Hash or CP Hash library comparison for known contraband file hashes.
Any memory cards or cameras recovered?
Keyword/Index search of the Unallocated for camera/memory card metadata which can lead to unallocated pictures.
I think Camera Ballistics may come into play here if any cameras were seized during the search?
The photographs would have meta data and even if all the meta data is removed, you may still be able to prove that the 'edited' photos on the USB were taken with the same camera that was seized.
We use Amped Authenticate for this very purpose, but you would need a camera that was in possession of the suspect to start with.