FAYETTEVILLE, Ark. (KNWA/KFTA) — On Friday morning, the prosecution continued their examination of an expert witness from the U.S. Department of Justice as the Josh Duggar child pornography trial continued in Fayetteville.
Beginning shortly after 9 a.m. Friday, computer forensics expert and High Technology Investigative Unit (HTIU) director James Fottrell walked the jury through a comprehensive examination of exactly what was found on the HP computer at Duggar’s car lot.
He also added a vast array of details obtained from a backup of Duggar’s iPhone, made on a Macbook Pro laptop, that place the phone at the car lot on the exact dates and at the precise times that illegal Child Sex Abuse Material (CSAM) was being downloaded, accessed, and shared on the HP computer.
Fottrell also dismissed the possibility of someone remotely accessing the HP computer in question, stating that the evidence he analyzed was “not fitting the pattern of someone connecting remotely. That’s not happening.”
He made it clear that the Linux partition side of the HP computer, where all illegal evidence was found, must be selected manually when the HP computer is booting up, as the more common Windows operating system is the default. He added that he did look for remote access tools and found none.
For the second straight day, the prosecution submitted dozens of exhibits of evidence to the court. Many of these included GPS and geolocation data pulled from the computer backup of Duggar’s iPhone, and the prosecution repeatedly made comparisons of dates and times with those when the illegal downloads occurred.
In some cases, the presence of the phone at the car lot was pinpointed to the exact minute that the HP was downloading CSAM, either by texts the phone sent or photos taken on it.
The exhaustive correlation of events went on for the entirety of the morning session before Judge Timothy L. Brooks called for a brief break.
Prosecuting attorney William Clayman continued his examination of Fottrell until the jury had been presented an abundance of files, logs, text messages, and photographs that all correlated directly to the exact dates and times the HP computer was accessing illegal material and eventually connecting with the Little Rock Police detective’s computer.
The prosecution’s final piece of evidence submitted this morning was a “timeline of exhibits of evidence” that put everything into a clear and understandable document for the jury to see all of the precise time and date correlations made by the computer forensic investigators.
Clayman finished by asking one last clear and simple question. “Who was present at the car lot every single time child pornography was downloaded?”
“Josh Duggar,” Fottrell replied.
Duggar’s lead defense attorney Justin Gelfand began his cross-examination of Fottrell immediately afterward.
The defense began with some introductory questions about Fottrell’s experience and the scope of his job. Fottrell explained he is involved in over 100 cases per year with HTIU and the department has far from unlimited time or resources for any one case.
“We do the best with what we have,” he said.
Gelfand also differentiated between the actual HP computer and the “forensic snapshot” taken of it through imaging. Fottrell explained the process, which allows him to work on an exact, virtual duplicate of the HP computer in question.
The defense made a point of questioning why the search and seizure team wouldn’t want to take every single electronic device present.
“We don’t want to come in there and seize the paint off the walls,” Fottrell replied. He went on to add that sensitivity is a factor, and agents often make a “determination of relevance on-site” with certain electronic items.
Fottrell again noted they work with limited time and limited resources.
His testimony also included statements that the SD cards and thumb drives seized from the car lot had “minimum investigative value” and that Duggar’s iPhone and Macbook laptop contained no illegal images.
Further questioning by Gelfand shed light on the fact that the Linux partition on the HP computer takes up a relatively small amount of space on the device, approximately 1/10 of the 1 terabyte (TB) hard drive (1TB is equal to 1,000 gigabytes (GB)). Fottrell confirmed that the Windows side of that computer is primarily for business use, including an application specifically used for car sales.
Fottrell testified that no child pornography was found on the Windows side of the HP computer.
Gelfand turned his questions toward the computer’s router, which wasn’t seized or investigated. After several queries about router-HP interaction and the possible existence of some sort of logs on the router, Fottrell had to respond.
“I think you’re starting to become a little misleading,” he told the defense attorney.
Gelfand moved on to some questions about the Covenant Eyes software installed on the HP computer before the judge called for a lunch recess at approximately 12:15 p.m.
The jury is set to return at 1:30 p.m. to hear more cross-examination of Fottrell by the defense.