When is a login screen not just a login screen?
When is a router a clue to a crime?
Where is the thumb drive that someone plugged into the work computer atJosh Duggar’s car lot in 2019 shortly before someone — someone else? the same person? — installed a separate, password-protected operating system to hide evidence of child sexual abuse material that ultimately put the former19 Kids and Countingstar, 33,on trial in federal courtin Arkansas?
And what about thatotheriPhone, not Duggar’s, that was at his work when the search warrant was executed but never seized?
These were some of the questions, theories and suggestions Duggar’s defense raised Friday in day four of his trial on knowing receipt and possession of child pornography. This occurredas the prosecution’s key witness— James Fottrell, a top computer forensic analyst at the Department of Justice who examined Duggar’s devices — made his case,outlining extensive time-and-place linksbetween Duggar and the downloading and viewing of child pornography at his work.
While Duggar has not yet presented his defense (the prosecution is likely to rest on Monday), his attorneyshave homed in on two main argumentsin the course of their cross-examinations:
Center, from left: Anna and Josh Duggar leave federal court in Fayetteville, Arkansas.News Licensing / MEGA
Nowhere was this strategy more clear so far than on Friday, as Justin Gelfand, a noted former federal prosecutor whom Duggar hired earlier this year, combed back through Fottrell’s testimony to prosecutors.
Gelfand — with a habit of exhaustively reiterating, underlining and dissecting facts and analysis submitted in the prosecution’s case — most of all wanted Fottrell to explain what he had and had not done in his examination; what he did and did not know conclusively, linked to direct evidence; and what he could and could not rule out.
“I don’t want you to guess,” Gelfand repeatedly admonished Fottrell, the director of the DOJ’s High Technology Investigative Unit.
Want to keep up with the latest crime coverage? Sign up forPEOPLE’s free True Crime newsletterfor breaking crime news, ongoing trial coverage and details of intriguing unsolved cases.
“Details matter,” Gelfand likes to say in court (Also: “Let’s get our bearings” and “let’s be crystal clear” and “let me get this straight for a second”). The defense is expected to call a forensic expert of their own to show that “the equivalent of a trail of blood … does not lead to Josh Duggar,” Gelfand said in his opening argument.
Fottrell, for his part, acceded little on the stand on Friday during a roughly four-hour cross-examination.
A courtroom sketch of Josh Duggar’s attorney Justin Gelfand in federal court in Arkansas.John Kushmaul
No, he didn’t think the USB that was plugged into Duggar’s computer the day the Linux partition was created — which has not been located and which contained two word documents and a slide presentation — was ultimately relevant in a trial about child sexual abuse material found on the Linux side of the office computer.
No, he didn’t think that because there was a Covenant Eyes login prompt on the desktop, if a user clicked the icon, that it meant the program could simply be turned off. The program auto-runs when the Windows side is logged-on, he said (Covenant Eyes, an accountability program on Duggar’s devices, bolsters the prosecution’s argument that the Linux partition was in part to evade monitoring of objectionable content).
No, Fottrell did not think the router in the office — which was never seized or examined — contained valuable, unknown evidence. And no, he didn’t think there was a pattern of remote access for the office computer. It was possible, yes, “But I just don’t see evidence of that.”
If someone remotely accessed the machine, their activity would still be viewable on the monitor, Fottrell said — such as the mouse movements and keystrokes, or when switching from the Windows side of the machine with all of its business records and important work-related programs to a totally separate operating system with a different login screen and password. And when the illicit photos and videos were viewed, they were visible on the monitor in the office regardless if someone was accessing them remotely. People at the car lot, in the office, would have seen.
Fottrell acknowledged this: Neither he nor the federal agents had “perfect information” from which to draw conclusions or to “answer every possibility.”
Files can be deleted. Hard drives can be perfectly wiped. iPhones can be locked.
But, Fottrell said, “We have lots of good evidence.” Despite indications that the machine had been cleaned of the child sexual abuse material — for example, no video files were recovered in full — Fottrell said cached data and thumbnails auto-created when files are downloaded and accessed showed that the illegal photos and videos had once existed. It was “forensically challenging,” he said. But not impossible. He likened the case to the “Netflix effect” of recent years.
“Some offenders understand it’s dangerous to possess the material of this nature so they download it, view it and then delete it,” versus amassing a library. And, he said, he had found full-sized originals of one lewd collection of images in a part of the hard drive that retains deleted files.
“We are doing the best we can,” Fottrell explained.
RELATED VIDEO: Audio Revealed from When Josh Duggar Learned He Was Being Investigated for Child Pornography
“In every case, there’s always more analysis you could do … it’s certainly not perfect, it’s certainly not exhaustive,” Fottrell said.
“I would love to say I have five years to work on this case,” he said, later adding, “I’m trying to efficiently work on as many cases as I can.”
What’s more, Fottrell told prosecutor William Clayman a backup of an iPhone 8 that was found on Duggar’s personal MacBook contained timestamped text messages and photos with geolocation data that put him at or near the car lot repeatedly over four days in May 2019 when either the child pornography was accessed or the password-protected Linux partition and related programs were setup.
In one example, Fottrell said, Duggar’s phone was used to take a photo of a sticky note at the car lot — apparently on a desk — two minutes after evidence was created that the video file “pedomom” was accessed on the office computer.
The defense has continually suggested a handful of individuals who had access to the car lot, including an ex-employee, were the real perpetrators, though the prosecution says records show Duggar was the only employee at the lot that May.
Three of these men are on a list of potential witnesses but have not yet testified. Jeff Pryor, one of the Homeland Security agents who executed the search warrant at the car lot, said on the stand Thursday that as to the question of other devices on the property that day, “Not seized means cleared.”
Pryor and other prosecution witnesses, including Fottrell, have explained that agents and analysts on a scene use their judgment and can manually screen certain devices, choosing not to seize them if no red flags are found (Gelfand noted in his questioning these manual examinations can miss things).
Fottrell wasn’t present at the 2019 search of the car lot but said on the stand Friday that generally, “We’re trying to have sensitivity.”
“We don’t want to seize the paint off the walls,” he said. “We’re trying to find where the critical evidence is.” In a family residence, as an example, agents would screen a child’s computer at the scene before presumptively seizing it to minimize their intrusion.
A sketch of Josh Duggar’s trial in Fayetteville, Arkansas.John Kushmaul
At Duggar’s car lot, Fottrell said, agents had some preliminary indication they were looking for a Windows computer. And then they saw his HP work desktop.
“We’re not on a wild goose chase,” he said.
Gelfand pounced on one mistake during his cross of Fottrell on Friday.
Fottrell initially testified, repeatedly, that he didn’t connect to the Internet or make any notable software changes while he was using a visualization tool to help show Duggar’s work computer hard drive to the jury (the tool recreates both the Windows and Linux desktops). But Gelfand pointed out that the μTorrent program, which was used to access some of the sexual abuse material, had been updated on the Linux side of the computer. Fottrell noted that “does not make sense to me” and “would be significant” to him, but also stressed that the visualization tool didn’t alter any of the underlying forensic analysis of the hard drive itself. Still, argued Gelfand, “Something had happened to the evidence you can’t explain.”
“I made a mistake, I forgot,” he then told Gelfand, who hammered the inconsistency.
“Can you rule out a possibility that the files were streamed from this HP computer to another device?” Gelfand asked.
No, Fottrell said, not conclusively.
In some parts of his analysis related to how the computer was used versus what content was accessed, “I know what is likely but I don’t know what is certain,” he shared.
Gelfand, his hands tap-tap-tapping on the lectern, highlighted the loose end of the thumb drive that was plugged in and used shortly before the Linux partition was created on the work computer.
A sketch of Josh Duggar at his trial in Fayetteville, Arkansas.John Kushmaul
Perhaps, Gelfand also wondered, Fottrell had made another error in relying on readily available time-and-place metadata from the photos on Duggar’s iPhone backup rather than forensically extracting them with a specialized tool that Fottrell decided not to use.
When Fottrell said one photo was taken at Duggar’s Wholesale Motorcars, maybe it was actually taken at his other car lot, Champion? Maybe the times were converted wrong?
With his re-direct, prosecutor Clayman referred back to certain photos that seemed definitive as to their time and location. One key selfie was of Duggar at Wholesale, in front of the office, on the same day a sales document was created on the Linux side of his computer with his first name on it.
The metadata said the work selfie was taken at 4:47 p.m. A clock was visible on the office behind Duggar. It read 4:51 p.m.
Duggar’s trial continues Monday.
source: people.com
