FAYETTEVILLE, Ark. (KNWA/KFTA) — In Thursday afternoon’s session of the Josh Duggar child pornography trial, the prosecution called a pair of government computer forensics experts as witnesses, and submitted dozens of exhibits of evidence.
During examination of the witnesses, prosecuting attorney William Clayman submitted over 30 exhibits into evidence.
These included files, documents, computer logs, spreadsheets, photographic images and videos obtained from the HP desktop computer seized from Duggar’s car lot.
Witness #6: Marshall Kennedy, HSI computer forensic analyst
The first witness called after lunch, and the sixth overall, was Marshall Kennedy, a computer forensic analyst (CFA) with Homeland Security Investigations (HSI). He also serves on the Internet Crimes Against Children (ICAC) task force.
Kennedy is a former University of Arkansas student and he found his position with HSI thanks to a special program for military veterans. He began there in 2017.
He explained the process that CFAs use to make “forensic images” of seized devices, which allows them to view the contents of electronics in a read-only mode that prevents the possibility of data corruption or deletion.
During cross examination by the defense, Duggar’s team introduced a total of five SD cards and USB flash drives into evidence. Kennedy also confirmed that his team’s investigation found no evidence of child pornography on Duggar’s iPhone or his personal Macbook Pro laptop.
There is a BitTorrent file sharing application on the Macbook, but the investigator stated that it had only been used to download a trio of Hollywood family movies.
Kennedy was unable to tell the court how many photographs or video images are contained on that computer.
Witness #7: James Fottrell, U.S. Department of Justice
The day’s final witness was James Fottrell of the United States Department of Justice.
He joined the agency in 2002 and is the director of the High Technology Investigative Unit (HTIU) and oversees analysts that handle child exploitation cases.
After documenting his lengthy history, training and certifications in the field for the jury, he was officially admitted as an expert witness in computer forensic investigations.
The prosecution questioned Fottrell at length, covering a variety of topics. The crux of their inquiries focused on exactly what he discovered when examining the HP, Macbook Pro, and iPhone.
During the course of Fottrell’s testimony, the government introduced their exhibits of evidence #28-#59.
These varied in nature from computer logs and spreadsheets to screenshots of computer desktops and graphic videos and images of prepubescent girls.
He noted that there has been “an explosion of younger ages” in child sexual abuse material, or CSAM, in recent years, including “even ages zero to five.”
A key piece of evidence was government’s exhibit #30, which showed a screenshot documenting that a Linux partition had been installed on the HP computer.
When asked why someone would do that, he stated it means that person is essentially saying “I want to hide my identity and appear like I’m coming from somewhere else.”
After a brief afternoon recess, Fottrell returned to the stand. He continued describing the sensitive material found in vivid detail. Gallery monitors were turned off again multiple times as the jury looked at these images and videos.
Computer logs he compiled included file names, descriptions, unique hash values and dates and times of downloads, which coincided with the period in May the prosecution has targeted.
Every single piece of child pornography/CSAM submitted as evidence thus far was found on the Linux portion of the HP computer.
Judge Timothy L. Brooks called a recess for the night at 5 p.m. The jury will return at 8:30 a.m. on Friday morning to hear more testimony from Fottrell.