Crimes perpetrated just by having a particular content..

I'm with Tony on this….
There has to be "knowing possession" of the contraband. It is very possible that the person had a virus that downloaded this (or a dumbass friend downloaded it; or… many other scenarios) - the users recognizes that he/she should not have it and deletes it immediately. Absent any other corroborating proof - active files, registry entries, software logs, this would be a hard case to prove. On the other hand, if you find other proof, I would then use the deleted files to show that there were additional files on that drive at one point which were deleted.

While the staleness doctrine does apply for consumables (like drugs), if I recall correctly, it doesn't necessarily apply to records - which one could argue the CP images are. Finding these (again, in my opinion) on old storage devices would be enough PC to request a SW - as JSkier has mentioned - and possibly get charged for it even if it is old and on a storage device (depending on the Prosecutor that handles the case).

-=Art=-

Standard Disclaimers Not a lawyer; don't play one on tv; didn't sleep at a Holiday Inn last night etc etc etc )

In England and Wales this issue was dealt with in a reported case R v Ross Warwick Porter -

http//www.bailii.org/ew/cases/EWCA/Crim/2006/560.htm

Which essentially says you can't charge someone with possession of material they cannot access. i.e. if they had some pictures and deleted them so they can no longer access them then they do not at that time possess them.

This is interpreted badly by some people in that they will not charge pictures in unallocated. However if you can show that the pictures in unallocated got their intentionally then you can charge possession at some point in the past prior to them being deleted.

H

I will play devil's advocate here.

Do you routinely have things laying around your office which you don't know what they are? Discs, hard drives, computers, etc? SW isn't always the first line of defense, you have knock and confers and a lot of times if the person then is not cooperative a SW is obtained to look further and if he did nothing wrong there shouldn't be a lot of deleted files from the time the officers left and the time that the officers come back.

How does it look to a prosecutor or AUSA if you said I saw something bad and deleted it immediately. There are lots of people with cases right now asserting that claim. And actually some of them have logs, registry entries, etc. to prove it, but they are still looking at 10 years and a lifetime registry list.

I'm with Tony on this….
There has to be "knowing possession" of the contraband. It is very possible that the person had a virus that downloaded this (or a dumbass friend downloaded it; or… many other scenarios) - the users recognizes that he/she should not have it and deletes it immediately. Absent any other corroborating proof - active files, registry entries, software logs, this would be a hard case to prove. On the other hand, if you find other proof, I would then use the deleted files to show that there were additional files on that drive at one point which were deleted.

While the staleness doctrine does apply for consumables (like drugs), if I recall correctly, it doesn't necessarily apply to records - which one could argue the CP images are. Finding these (again, in my opinion) on old storage devices would be enough PC to request a SW - as JSkier has mentioned - and possibly get charged for it even if it is old and on a storage device (depending on the Prosecutor that handles the case).

-=Art=-

Standard Disclaimers Not a lawyer; don't play one on tv; didn't sleep at a Holiday Inn last night etc etc etc )

Hi Harry,

I find this interesting as we all know that deleted doesn't mean not deleted and with a freeware program those files can be back on the desktop or wherever they resided previously.

In England and Wales this issue was dealt with in a reported case R v Ross Warwick Porter -

http//www.bailii.org/ew/cases/EWCA/Crim/2006/560.htm

Which essentially says you can't charge someone with possession of material they cannot access. i.e. if they had some pictures and deleted them so they can no longer access them then they do not at that time possess them.

This is interpreted badly by some people in that they will not charge pictures in unallocated. However if you can show that the pictures in unallocated got their intentionally then you can charge possession at some point in the past prior to them being deleted.

H

There are cases on point where the issue of deleted files and the level of skill and knowledge of the user have addressed. The general theme of these cases is that prosecution would need to show that the user knew or had a sufficient level of skill that (s)he should have known how to undelete files before a finding of possession of unallocated files could be held. (Again, varies by jurisdiction, not a lawyer, not legal advice).

We in the CF profession know that deleting a file generally doesn't destroy the content, but rather makes space or a record (such as an NTFS resident file) available for future usage. The average user however doesn't have that knowledge or the skill to exploit this.

And whilst there are tools that can recover deleted content, it's highly doubtful that a user would intentionally store anything of value in volatile space that could be overwritten at any time beyond their control.

Don't take this as meaning that I'm suggesting that deleting files is an absolute cop-out. I have worked on successful cases where deleted files were put in the proper context to support a conviction. Generally though, pedos like to have their material accessible, and it's normally really easy to find good evidence that supports a conviction without trolling unallocated. (Low hanging fruit.) I worked a case once where we got the same guy 3 times in as many months for possession.

It's also generally quite provable if they try to delete the files after they find out they are a suspect since there's plenty of other links to those files that will survive, and as I said in my earlier post, deleted files which can be placed in context are very much actionable.

Tony covers the issues quite comprehensively in his last post, but I would just add that the particular case of Porter arose because the police charged Porter with possession of images in the ACDsee thumbnail database and deleted files on the date the police seized the equipment.

What the judge concluded was that Porter didn't "possess" them at that time but also "It should also be noted that the question before us would not have arisen if the appellant had been charged with possession during the period from the time when he viewed the images until he deleted them."

H