Scenario in a nut shell; suspect prints pics of CP, runs out of paper. We find in the Spool file the remaining, unprinted documents, which are also of CP.
The charge at this point, as given by the the AUSA, is to demonstrate that these images;
1. Originated from internet activity
2. Trace the IP of the host to another state, which would then allow for interstate commerce.
Now, the challenge…how to do this as efficiently as possible. First you should know that this suspect never cleaned his computer to any degree, MSIE Temp files are plentiful with literally 10's of thousands of remaining artifacts.
My theory on how to meet the challenge is to take one of the printed images, match it to an image within one of the cached html files. Shot in the dark, I know. Go to the index.dat, scour through to see if I can show the activity that created the document to be printed.
I reallty hope that there is a "find evidence" wink button to assist with that, but any other solutions or suggestions graciously accepted.