FAYETTEVILLE, Ark. (KNWA/KFTA) — On December 7, the Josh Duggar child pornography trial neared the end when the defense rested its case after only calling two witnesses around 3:00 p.m. Tuesday.
The fifth day of the trial began with the prosecution cross-examining defense digital forensics expert witness Michele Bush.
Cracks in the honesty of her testimony the day before became evident almost immediately.
In her introduction as the defense’s first witness, Bush categorized her ten years experience as a forensic examiner.
But this clearly included time as a college student, as prosecuting attorney William Clayman had Bush reveal that she didn’t actually graduate until 2015. She had also testified about the many times she has served in court as an expert witness.
When Clayman asked how many of those were federal cases like this one, she wasn’t certain. “I’d have to refer to my C.V.,” she explained.
Follow-up questioning led her to admit that this might be her first.
Further investigation shed light on the fact that her training has never included a Linux-specific course or any training on the Torrential Downpour software used by law enforcement.
Of the cases she has worked in her career, Bush estimated that perhaps 10 involved Linux.
Clayman turned the questioning to her 100-page report. She acknowledged that she was present for James Fottrell’s testimony and that her report included specifics based on what he said in court.
She stated that she has spent over 200 hours on this case, and her goal was to “summarize all relevant findings.” Clayman asked if she had omitted any relevant information from her report.
“I wouldn’t have known it was relevant at the time,” she responded.
Bush confirmed that she has never listened to the interview conducted with Duggar on the day the search warrant was executed at his Springdale car lot in November 2019.
She also wasn’t sure if she had seen the photograph showing a man’s reflection in the screen of the HP computer seized from the business. “I only saw photos of the router,” that wasn’t taken, she said.
Clayman moved along to discuss the installation of Linux on that computer, asking if it had to have been done by someone at the car lot on the May 2019, date in question.
“Most likely,” she confirmed.
He followed that up by asking how a thumb drive could have gotten plugged in if nobody was present. “There’s no other way?” he asked. “Other than physically being there.” She agreed with this.
JOSH DUGGAR TRIAL: THE LATEST
Clayman followed up by inquiring about why Bush had neglected to include a ubiquitously-used password out of her report entirely. The password was featured on multiple exhibits submitted by the prosecution, including on an Apple notes file on the defendant’s personal Macbook Pro computer.
She couldn’t recall if she had seen that during her investigation.
The cross-exam continued with pointed questions about the Tor browser, as well as some dark websites bookmarked on it. Bush confirmed that the bookmarked Hidden Wiki site is known for having the location of child exploitation material sites on it.
He asked specific questions about “The Marissa Series,” a ZIP file containing a collection of graphic photos of prepubescent girls found to have existed on the HP computer.
“I don’t know what The Marissa Series is,” she said when asked about it.
Thumbnails and EXIF data about the images were provided to the defense, and Fottrell testified extensively about them in court.
Clayman continued, eliciting testimony that corroborated multiple applications that were used and present on both the HP and Duggar’s personal Apple devices.
His questioning also led her to testify that there were no files or evidence of that device being accessed remotely. Bush contended that if it had been, those logs would have been overwritten by the time the device was seized.
But she was very reluctant to state under oath that she found no such log, but rather that “it doesn’t exist.”
Clayman asked again whether there was any evidence that the HP had been accessed remotely during the May 2019 dates.
“I did not find any evidence from what I have seen,” she replied.
Bush also confirmed that she has never been to the car lot, doesn’t know their business hours, and didn’t research those when conducting her examination of the seized electronic devices.
The router came up yet again, with Clayman wondering if she ever asked the defense to retrieve it for her to examine.
“I’m not going out to try to find additional evidence,” she said.
The cross-examination lasted for approximately 90 minutes straight until Judge Timothy L. Brooks called for a short morning recess.
Clayman finished up with a few more questions, asking Bush if she knew that the car lot was a “repository for thumb drives” because they were found so frequently on the property. She did not, as this was something stated during Duggar’s interview that she didn’t listen to.
He returned to the topic of the HP screen-reflection once last time, with Bush confirming that it was a picture of “someone likely behind the keyboard.”
Lead defense attorney Justin Gelfand then began a lengthy redirect that continued until the noon lunch recess.
He noted that the government’s reports on the devices were much more concise than hers, which had “an abundance of very detailed information.”
She also addressed the issue of not including the frequently-used password by noting she referenced its hash value instead, which is a unique value associated with it.
She also concurred with a point that the defense has made before, the fact that the videos were being streamed rather than played directly from the hard drive, stating “the chance that somebody else was watching that video is much greater.”
Gelfand also asked about the apparent switching of ports on the router during downloads, something that would provide “obfuscation,” in Bush’s words.
Another video played as a copy stream URL indicated the work of a “very advanced user” to the digital forensics expert.
When asked about seeing a face in the HP screen-reflecting photo, she made her opinion clear.
“I don’t see it, no,” she stated.
With some necessary business to address with the attorneys, the Judge called for an early recess shortly before noon. The jury will return at 1:20 p.m. to hear more of Gelfand’s re-direct of the witness.