FAYETTEVILLE, Ark. (KNWA/KFTA) — The entirety of Monday afternoon’s post-lunch testimony in the Josh Duggar child pornography trial was spent with the defense examining their own digital forensics expert.

Defense attorney Justin Gelfand spent hours questioning Arizona-based expert Michele Bush, trying any avenue that could lead to the slightest bit of discrepancy.

The specific circumstances of the installation of a Linux partition on Duggar’s HP computer remained a point of contention. With the use of an installer ruled out, Bush narrowed the options down to the use of a Linux app store or a form of command line code.

She explained that she used a website called archive.org to investigate the state of that store on the relevant dates in May, 2019.

She testified that the uTorrent application wasn’t available in that store until the following month.

“I didn’t find any evidence that they could download it in May, she said. “It led me to believe everything would have been done by command line.”

The examination of the witness continued with specific questions about BitTorrent and Tor browsers. Bush clarified that BitTorrent “allows users who have files to share little bits and pieces,” as opposed to the way entire files are shared on other peer-to-peer sharing software. “It’s very quick,” she said.

According to Bush, not all of the downloaded torrent files were actually streamed. Her forensic research indicated that someone entered a URL in order to stream a video and that it potentially went to a different device. This was something that “jumped off the page” for her because it was so uncommon in similar investigations.

After a short afternoon recess, Gelfand moved on to the topic of remote access. The defense submitted a series of exhibits of evidence, all screenshots taken by Bush during her forensic imaging investigation.

She explained that changing ports on a router “can be a way to mask your identity.” There are certain vulnerabilities involved with doing this, she said.

A key point of her testimony was that a user did not need to be physically present to download the illegal files, contradicting previous statements by James Fottrell, the Department of Justice expert witness called last week. She also told the jury that one of the videos downloaded was deleted within 30 seconds. She stated that this “follows the patterns and characteristics” of a remote user accessing the computer in a “hit and run.”

Gelfand steered the topic to Torrential Downpour, the proprietary software that a Little Rock detective used to first detect the illegal activity in question.

Bush made it clear that the police’s software only identifies an IP address, not a specific device. There were also logs of repeated, failed attempts by the police to connect to the IP address in an attempt to download a different file.

She also said that she couldn’t tell if a person was actually at the HP computer at the time of the downloads, contrary to Fottrell’s testimony. Additionally, duel boot systems can be started remotely, she said.

“I disagree,” with Fottrell, she said. “There are probably a couple of ways to do it.”

When Gelfand began to inquire about the metadata of a photo recovered from Duggar’s personal MacBook Pro computer, the prosecution objected when Bush called that data “unreliable” in the form that the government used to inspect it. This led to a nearly 15 minute sidebar.

After testimony restarted, Bush explained that her investigation encompassed the “totality of digital evidence seized in this case.”

The defense concluded their examination of the witness. At 4:48 p.m., in another sorely-needed light moment, Judge Brooks asked the prosecution’s attorneys a question he clearly knew the answer to: whether they planned to take “considerably longer than 12 minutes” in cross-examination of Bush. After a laugh, William Clayman confirmed that they would.

“I do, your honor,” he said.

The judge gave the jury their recess instructions and released them about ten minutes early. They are set to return on December 7 at 8:30 a.m., when the prosecution will ask their questions of the defense’s first witness.