Child Sexual Abuse Material (CSAM) Investigation

CASE STUDY

Criminal Defense Case Study for CSAM Investigation

Tags
Digital Forensics, Forensic Examination, Criminal Defense, Child Pornography, CSAM
Child Sexual Abuse Material Investigation

Background

A criminal defense attorney contacted Maryman to perform forensic examinations for their client. Their client had been arrested for various crimes. During the search of his computer, a single video file containing CSAM material was discovered by the investigator. A single count of possession of child pornographic material was added to the list of charges for the individual.

The defense attorney informed us though their client was engaging in the downloading adult pornographic material he had never searched for, nor downloaded, CSAM material. The attorney informed us that their client was ready to accept a plea deal, only if the possession of child pornographic material charge was dropped, because the individual did not want to be on a sex offender registry.

Scope

The Maryman team was hired to review the reports provided by law enforcement. We were also provided with the forensic image of the computer system to conduct our own analysis.

Analysis

Our independent digital forensic analysis resulted in the identification of the single video file that was classified as CSAM. In this case, the context behind the possession was crucial for the client. The video file was contained in a compressed file in the downloads folder of a Peer-to-Peer filesharing application. The metadata for the filesharing application indicated that the description for the compressed file did not contain any language pertaining to CSAM, instead it was describing regular pornographic content. System analysis revealed that the user did not extract the contents of the compressed file after the download. The CSAM file only remained in the compressed archive, and there was no forensic evidence that the client was aware that the file contained CSAM material, nor did he ever open the file on his computer.

Outcomes

The defense attorney was armed with the information necessary to discuss the charges with the district attorney and the judge. The defense attorney was ultimately able to convince the district attorney to drop the charge of possession of child pornography, resulting in the client accepting a plea agreement for the remaining charges.
Scroll to Top