Description: Jane Doe and Richard Roe are divorcing, and both desire custody of their young son. During the two years the divorce proceedings have occurred, Richard Roe has not had any contact with the child.
Type of Case: Family Law
Court: Denton County in Denton, TX
Plaintiff: Jane Doe
Defendant: Richard Roe
Complication: Protegga extracted pornographic images from Richard Roe’s desktop and laptop computers and provided them to Jane Doe. While reviewing the production of pornographic data, Jane Doe became concerned as to the young-looking participants in several photographs and notified law enforcement. While Protegga did not feel any of the photos crossed the line into child pornography, a search for the well-known child porn term, “r@ygold,” was executed and yielded positive search results, whereupon Protegga ceased the investigation.
Law enforcement took possession of the copies of Richard Roe’s hard drives, and after incorrectly declaring that child pornography did not exist on either the desktop or the laptop computers, returned the copies to Protegga. Counsel for Jane Doe asked Protegga to continue the investigation into any evidence of child porn activity on the laptop computer. Protegga found data that pointed to child pornography having been searched for, downloaded, stored, and viewed.
Evidence Items Examined
Desktop computer: Current computer being utilized by Richard Roe. Provided under Protective Order.
Laptop computer: Old computer utilized by Richard Roe. Provided under Protective Order.
Parts computer: Old computer brought by Richard Roe when he married Jane Doe. Richard Roe called it his “Parts” computer. Computer retrieved from marital residence.
March 30, 2010: Protegga images Richard Roe’s desktop and laptop computers.
August 3, 2010: Protegga simultaneously discloses the findings of Richard Roe’s desktop and laptop computers to both parties’ counsel.
August 3, 2010: Protegga seizes the “Parts” computer, purportedly belonging to Richard Roe, from the marital residence.
August 3, 2010: Richard Roe relinquishes custody of three thumb drives, including a SanDisk U3 device, and states that he does not have any additional electronic media.
October 4, 2010: Protegga simultaneously discloses the findings of Richard Roe’s “Parts” computer and the three thumb drives.
November 5, 2010: Immigration and Customs Enforcement (ICE) Agents visit Protegga’s office and validate several videos found on the “Parts” computer as child pornography.
April 2, 2012: The bench trial begins in the matter between Jane Doe and Richard Roe.
April 3, 2012: The trial concludes, and the court issues its final orders.
May 2, 2012: Denton County Sheriff initiates an investigation into the child pornography found on Richard Roe’s computers.
Claims of Plaintiff
Richard Roe has had little-to-no interest in our son since his birth. I also found dresses for little girls in the closet of Richard Roe’s current home and fear that he may be a danger to our son. I want to know what kind of pornography Richard Roe downloads.
I don’t have a problem with pornography, and I don’t download child pornography. My ex-fiancée’s two teenage sons (who lived with me) downloaded the child pornography found on my computers before Jane Doe and I began dating in February 2008.
Computer Forensic Evidence Recovered
In United States v. Beatty, 2009 WL 5220643 (W.D. Pa. Dec. 31, 2009), the Court correctly concludes that “Common knowledge dictates that actual file content cannot be definitively determined from the file name alone.” Nevertheless, the court says that file names have some predictive value: “…oOne can also envision circumstances where the file name is so explicit and detailed in its description as to permit at least a reasonable inference as to what the actual file is likely to show. Many, if not most, of the files at issue here had titles that contained highly graphic references to specific sexual acts, including ejaculation, sexual intercourse, oral sex, and anal sex-involving children ranging in age from 7 to 13 years. Several of the files also reference terms such as ’child_sex,’ ’pedofilia,’ ’illegal pedo sex,’ ’incest,’ or ‘Lolita.’ The unmistakable inference which arises from such highly descriptive file names, is that the content includes material pertaining to the sexual exploitation of children, i.e., evidence of criminal activity, if not outright contraband. Given the number of files in question and the pointed references in their titles to specific sexual acts involving young children described in the most coarse and vulgar terms, this inference is a strong one.”
In United States versus Wilder, government witnesses testified that “pthc” was an abbreviation for “preteen hard core,” that “pedo” was short for “pedophile,” and that “r@ygold” referred to a set of videos of child pornography out on the Internet. United States versus Evans-Martinez describes the term “r@ygold” by saying, “…’r@ygold,’ a term commonly understood to refer to child pornography.”
A program named “Limewire” was used to download many of the pornographic video files determined to have existed on the laptop and “Parts” computers. Limewire is a peer-to-peer (P2P) application that allows users to connect to a network of peers without the use of a centralized server. Because people can share files without connecting to a centralized location, it has become a popular tool for sharing illicit material, especially child pornography. Protegga found evidence that Limewire was installed on the “Parts” computer on or before December 16, 2007, and that the commonly used child porn search term “PTHC” (preteen hard core) was used on or before January 8, 2008. Limewire was installed on the Laptop computer on or before June 25, 2008.
The Limewire program was running on the “Parts” computer for more than 900 hours and connected to the network (downloading files) in excess of 370 hours. The search terms utilized in Limewire on the “Parts” computer including “pthc, underage, schoolgirl, incest, dad, daddy, family fun, and foreign porn” are terms specifically employed to locate child pornography. Protegga found several explicit file names that Richard Roe previewed during the downloading process and then allowed the download to finish. Protegga also found that several files were downloaded and then intentionally moved to a directory structure located outside of Limewire.
Child Pornography on Laptop Computer
After law enforcement incorrectly declared that child pornography did not exist on either of the computers Richard Roe provided to Protegga, Protegga continued its investigation into any evidence of child pornography on the desktop and laptop computers. Protegga found data, some of which is listed below, that pointed to child pornography having been stored, accessed, and shared on the laptop computer.
- (Hussyfan) (Pthc) (R@Ygold) (Babyshivid) (Littlered) Russian Reality Kiddy 5Yr Old Carol Feeling Good_All Kinds Of Sex Fun Pipi Games !! (5yo) .mpeg
- (Pthc) 6Yo Babyj – Bedtime Rape Until Cum private pedo child girl 1yo 2yo 3yo 4yo 5yo 6yo 7yo 8yo 9yo 10yo vicky laura jenny sofie fdsa hussyfan russian korea.mpg
- Hc Vim04 – Babysitter And Girl 8Yo – 10Yo Having Sex With Older Sister (Anal Toys!!) Incest – Pedo Mom Helps Dad Fuck His Tiny Daughter(B) (Pthc – 20m15S).mpg
- Children sexually abused BEAUTIFUL_Venezuela-girls(3-4yo) part 2) pthc hussyfan_Pedo FuX Makes A Childs Cute Peepee Orgasm’s Hapen-Precious_!! Kids NEED Sex TOO_!!.mpg
- Pthc -G- Moscow – 06 (Peter Boil) Mossi 11Yo Dad Says I Come First 9Min (Mpeg).mpg
- (Hussyfan) (pthc) (r@ygold) (babyshivid) Babyj Child abuse dark secret~Very willing premature sexualized little girls 3yo to 7yo shamed in pedofamilies.mpg
- (pthc) Family 2- ReelFamilySex- entire clip-Hot Mother licks her 8yo Daughters sweet pussy as her brother fucks her- r@ygold – ddoggprn – incest REELKIDDYMOV.mpg
Given the exact nature of the file names discovered and the utilization of child porn search terms along with the Limewire application, there is no doubt that the laptop computer provided by Richard Roe to Protegga was utilized to download, store, share, and view child pornography.
Child Pornography on “Parts” Computer
Upon seizing the “Parts” computer from the marital residence, Protegga began its investigation into any evidence of child pornography existing or having existed on the computer. Protegga found that Limewire was used to search for, download, and view child pornography. Several filenames containing child porn search terms and belonging to the Limewire directory structure are listed below.
- T-60611584-German (lolita anal 7yo Boy and 10yo Girl)- pedo pthc preteen, NEW 2006!!!.avi
- Preview-T-2940928- (((Kingpass))) Liluplant, clip of 7yo getting face-fucked, eyes bulging, gagging , drooling. Rough suck and not for soft-core fans. Pthc, Pedo, Childlover, Babyshivid, Hussyfan.mpeg
- Preview-T-15979228-Xxx Pthc – Family Fun Pedo Parents Do Their 2 8yo Boy’s Little Libido’s) (Mom Sex Kiddie’s, They Child Peepeecum On Dads
- Preview-T-40523588-!!! NEW Pthc – 0607!!! kelly – 7yo backyard fuck & pedo kittycum.mpg
- Preview-T-54414336-14 yo son fucks mom while 12 sister watches incest porn preteen kiddy Sexy Teen Girl porno ass vaginal p 1.mpg
- Preview-T-59232016-Pedofilia -fucking 8 yr old daughter Alicia hard (r@ygold reelkiddymov underage kiddy pre-teen lolita) (1).mpg
In addition to the filenames listed above, Protegga found several files that Mr. Y had previewed and still allowed the download to complete. A few of these explicit file names are shown below.
- pedo – 11 year old kids having sex.mpg
- Pedofilia – Young Russian girl eats daddys cum for the first – 11yrs old girl.mpeg
- 13 year old girlfriend shows fuck If u want to know me email email@example.com and I show you free sexy photos. incest preteen child porn fucking sucking licking pussy.mpg
In addition to the files downloaded and viewed through Limewire, the NTUser and Software Registries indicated that several files were viewed in Windows Media Player and QuickTime Movie Player. For instance, the following file was viewed in Windows Media Player.
- Hardcore 7yo and 10yo twink preteen gay young boys fucking!!! – pjk kdv rbv pthc pedo preteen gay boy kids sex zadoom rizmastar r@ygold 6yo 7yo 8yo 9yo 10yo (1).JPG.txt.mpg
More than just filenames, Protegga recovered two videos from the laptop computer (provided by Richard Roe) that it believes may contain child pornography. The files both claim fifteen-year-old participants, and based upon a brief viewing and in absence of the typical legal warnings or copyright information, Protegga believes the age to be accurate.
Protegga also recovered ten videos from the “Parts” computer (seized from the marital residence) it believes may contain child pornography. Two files, DG32.mpg and DG78.mpg, refer to the same video in separate files and depict an older male having sex with what appears to be a preteen female. DG34.mpg and “Preview-T-28313051-Pedo-11 year old kids having sex.mpg” refer to the same video in separate files and depict exactly what the name implies.
Note: This file, as mentioned above, was previewed, and the download was still allowed to complete.
Given the exact nature of the filenames discovered, the recovered videos, the utilization of child porn search terms, and the Limewire application, there is no doubt that the “Parts” computer, in addition to the previous laptop computer investigated, was utilized to download and view child pornography.
Once Limewire completed downloading the child pornography, the video files were moved to external media. Based upon its investigation, Protegga believed the SanDisk U3 Cruzer Micro thumb drive contained the pornographic videos. In accordance with the agreement reached between the parties on August 3, 2010, Richard Roe provided Protegga with three thumb drives, including a SanDisk U3 Cruzer Micro thumb drive. This device was functioning when it was last plugged into the Desktop computer on March 29, 2010, and was accessed by all three computers (desktop, laptop, and “Parts”) belonging to Richard Roe from 2006 through March 2010. However, the device had been wiped clean of any data prior to Richard Roe providing the device to Protegga.
“But, I Didn’t Do It!”
Richard Roe claimed that his ex-fiancée’s teenage sons, who lived with him prior to his marriage to Jane Doe in May 2008, were responsible for downloading the child pornography on the “Parts” computer.
Throughout its investigation, Protegga found evidence that all user accounts utilized by Richard Roe were password protected, and that on or before August 9, 2007, the two teenagers had their own computers. Neither of the teenagers lived with Richard Roe when he married Jane Doe in May 2008. Protegga found multiple videos files that were downloaded and/or viewed as early as January 2008 and as recently as February 2010. Given the preponderance of the evidence, it is clear to Protegga that the same person downloaded and viewed child pornography before and after May of 2008.
During the bench trial, Protegga presented the evidence of child pornography having been searched for, downloaded, stored, and viewed on the laptop and “Parts” computers. During a failed cross-examination, Richard Roe’s counsel attempted to blame the existence of child pornography on a Trojan computer virus. Following Protegga’s testimony, Richard Roe was called to testify. Prior to Richard Roe’s testimony, Richard Roe’s criminal attorney informed the Court that his client would likely reserve his right against self-incrimination by pleading the Fifth Amendment to many of the questions.
At the conclusion of the bench trial, the court granted Jane Doe sole custody of the child. Richard Roe was ordered to pay child support (more than $1,000 per month plus medical insurance) and was denied any and all access to the child. The court also ordered Richard Roe to enroll in and participate in a sex offender treatment program that may require polygraph and/or penile plythesmograph testing. In addition to the orders regarding child custody and support, the court ordered Richard Roe relinquish all monies in his 401k retirement account to Jane Doe and pay for all of Jane Doe’s legal expenses, including those incurred for forensic investigation.
The court also asked that Jane Doe’s counsel contact the Denton County Sherriff’s Office to initiate a detailed investigation and pursue criminal charges against Richard Roe. Richard Roe did not appeal the court’s decision.
NOTE: Protegga LLC respects the privacy of all parties involved in each of our computer forensics investigation cases and, therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.