“Possession” of Child Pornography, Deleted and Cache Files

In Utah, the possession of child pornography is prosecuted under  Utah code 76-5b-201(1) Sexual exploitation of a minor  makes it unlawful for any person to knowingly possess or control any material which depicts a minor or a portion of a minor’s body engaged in sexually explicit conduct.  Thus, when a pornographic image or video is discovered on a person’s computer, the State must prove not only that the person possessed the computer, but also that he or she knowingly possessed the image or video file in question.  In many cases, establishing whether a person “knowingly” possessed a particular child pornography file requires a full understanding as to precisely how computers store image and video files.

Deleted Files

The most common mistake that people make is believing that a “deleted file” is no longer on the computer.  Most of us know that when a file is deleted by the user, it goes to the computer’s recycle bin.  What many people do not know is what happens to the file after it leaves the recycle bin.

The amount of space in the recycle bin is determined by the settings on the computer.  The user can actually increase or decrease the amount of space in the recycle bin depending on his or her preferences.  Once the recycle bin reaches maximum capacity, it bumps older files out to make room for newly deleted ones.  The files that get bumped out of the recycle bin are now out of sight to the user but still well within the confines of the hard drive in what is called “the unallocated space.”

While files in the unallocated space are not visible to the user, they can be accessed using computer forensics software such as EnCase which is commonly utilized by law enforcement and defense experts to examine hard drives.  Many individuals may borrow a computer from a friend, or lend their computer to someone, without any idea as to what deleted files may be sitting in the unallocated space.  A person may accidentally download a file containing child pornography and delete it.  The deleted file, however, is still on the hard drive.  Under these circumstances, does the person still knowingly possess the file? The Barton case discussed below will help us answer that question.

Temporary Internet Files (Cache Files)

Anytime a website is viewed, all of the pictures and videos on that site are automatically downloaded to what are known as “cache files,” or “temporary internet files.”  This occurs without any specific action on the part of the user.  Depending on the amount of internet activity and the space allocated for cache files, these files can stay on your computer for weeks, months, or even years.  Even after the files are bumped out of the temporary folder, they may still be lingering in the unallocated space on the drive.  If a computer user regularly visits pornography sites, hundreds of image and video files will get stored in the temporary internet folder.  If any of these images or videos depict a minor (under the age of 18), the person will be in possession of child pornography.  Now the question becomes whether the user knowingly possessed these files.


Visit my web site to talk about your case with an attorney experienced in child pornography cases in Utah