Child porn case delves into computer forensics

8-1-2012 Virginia:

A 43-year-old man convicted on 12 counts of possession of child pornography Monday in Circuit Court could face up to 115 years in prison.

After almost seven hours of arguments and testimony, Judge Michael E. McGinty found Joseph Alfonso Papol of James City guilty on all charges. To date, the case had dragged on for about 10 months.

Charges were brought againt Papol last May when illicit images were found on his laptop and an additional hard drive. Technicians at Office Depot discovered the images while working to repair Papol's laptop.

Johnie F. Meyers, technology department manager at Office Depot, testified that Papol took his Acer Aspire laptop to the store on April 30, 2011, because it would not boot up. He explained to Papol that they would copy the contents of his hard drive to a hard drive used for the storage of customer data to ensure his files were not lost while techinicians worked on his computer. He said Papol agreed and signed a work order stating he was the sole owner of the computer.

Computer repair technician Dustin Martin said he actually worked on the computer. He moved Papol's files to the storage drive, opening folders to ensure the files inside had transferred.

He explained opening the folders, while not necessary to repair the computer, is standard practice. He began checking the data while the transfer was still running.

"There's nothing worse than losing someone's family photo album," he said.

It was while checking files that he ran across something that concerned him. He said he saw about 20 photos that appeared to be of preteen girls, admitting he estimated the age based on their development. At that point he stopped the transfer and brought the issue to Meyers, his manager.

Meyers said on looking at what Martin had found, the images appeared to be of "naked girls who appeared to be underage." He testified that he also found files containing terms like "preteen girl nude."

He said he alerted his manager who called corporate to determine a course of action, but since it was a weekend there was no one in the office. Meyers said his manager told him to call the customer and explain that service could not be performed due to content on the computer, which he did. Papol came to pick up the computer the next day.

That Monday Office Depot's corporate headquarters gave the store the go-ahead to call police, according to Meyers. The same day, Ryan Oliver, owner of Computer Clinic, said he accepted Papol's computer into his shop for repairs. The computer wasn't booting up, and on closer examination Oliver realized the hard drive was failing.

Unlike Office Depot, Computer Clinic didn't open the files. Oliver said he "cloned" or made an exact copy of Papol's hard drive to gain access to the segment of the drive that contained recovery files he needed to fix the computer. He then put the new hard drive into the computer to test it and wrapped up the old one. Both the laptop with the new drive and the old drive were returned to Papol.

On May 5, 2011, police executed a search warrant for Papol's home on Allyson Lane in the Raintree subdivision. Investigator William Gibbs with James City Police Department's computer crimes unit said the warrant included computers, all computer equipment and external storage media.

Gibbs said Papol answered the door and he told Papol the search had to do with a computer he'd taken to Office Depot a few days prior. He said he asked Papol if they could have a conversation and he could tape record it and Papol agreed, following Gibbs out to his police car while officers continued their search of the residence.

Before beginning, Gibbs said he told Papol he was not under arrest and could terminate the conversation at any time. He asked Papol a series of questions McGinty found to be "tantamount to a confession" at trial.

Gibbs said he asked Papol if he had ever gone to a pornographic website containing images of someone who appeared to be younger. He said Papol replied: "I would say yeah, but I can't remember." He followed up by asking Papol if his computer was analyzed, if child pornography would be found on it, and Papol said yes, noting that he shoudl have deleted them and felt bad about not doing so.

Gibbs got the laptop and unattached old hard drive out of evidence and handed it off to Lt. Scott Little with Glouscester County Sheriff's Office, who is also the district coordinator for the Southern Virginia Internet Crimes Against Children, He testified an an expert in computer forensics.

"I ended up finding 14 total image files," he said, explaining that he previewed the files on the laptop to look for evidence that firther forensic analysis was necessary. "I pretty much stopped the preview at that point because I identified there was contraban."

Little said he belives, based on the last modified date of the files, that they appeared on Papol's computer in October 2010. He indicated that all the image files were on both the new hard drive in the laptop and the old hard drive that had been removed from the computer.

Defense attorney Patricia Nagel argued that evidence on the hard drives was altered between April 30 when it was taken to Office Deport and May 3 when it was seized by police, asserting that the files in question had not been opened prior to techs working on the computer. She brought in computer forensics expert Domingo Rivera, who heads up a tech company, to back up the argument.

He said he took issue with the fact that no precautions were taken to protect the original hard drive and keep technicians from moving data that did not belong to Papol on to his laptop, potentially contiminating the evidence. He explained that there is no guarantee the files weren't modified but there's no proof they were altered.

McGinty said he found the evidence to be sound and noted that he found Rivera "wholly unpersuasive." ..Source.. by Susan Robertson