What Constitutes “Possession” of Child Pornography? Part I: Deleted and Cache Files

In Georgia, the possession of child pornography is prosecuted under O.C.G.A. 16-12-100 (Sexual Exploitation of Children).  O.C.G.A. 16-12-100(b)(8) makes it unlawful for any person to knowingly possess or control any material which depicts a minor or a portion of a minor’s body engaged in sexually explicit conduct.  Thus, when a pornographic image or video is discovered on a person’s computer, the State must prove not only that the person possessed the computer, but also that he or she knowingly possessed the image or video file in question.  In many cases, establishing whether a person “knowingly” possessed a particular child pornography file requires a full understanding as to precisely how computers store image and video files.

Deleted Files

The most common mistake that people make is believing that a “deleted file” is no longer on the computer.  Most of us know that when a file is deleted by the user, it goes to the computer’s recycle bin.  What many people do not know is what happens to the file after it leaves the recycle bin.

The amount of space in the recycle bin is determined by the settings on the computer.  The user can actually increase or decrease the amount of space in the recycle bin depending on his or her preferences.  Once the recycle bin reaches maximum capacity, it bumps older files out to make room for newly deleted ones.  The files that get bumped out of the recycle bin are now out of sight to the user but still well within the confines of the hard drive in what is called “the unallocated space.”

While files in the unallocated space are not visible to the user, they can be accessed using computer forensics software such as EnCase which is commonly utilized by law enforcement and defense experts to examine hard drives.  Many individuals may borrow a computer from a friend, or lend their computer to someone, without any idea as to what deleted files may be sitting in the unallocated space.  A person may accidentally download a file containing child pornography and delete it.  The deleted file, however, is still on the hard drive.  Under these circumstances, does the person still knowingly possess the file? The Barton case discussed below will help us answer that question.

Temporary Internet Files (Cache Files)

Anytime a website is viewed, all of the pictures and videos on that site are automatically downloaded to what are known as “cache files,” or “temporary internet files.”  This occurs without any specific action on the part of the user.  Depending on the amount of internet activity and the space allocated for cache files, these files can stay on your computer for weeks, months, or even years.  Even after the files are bumped out of the temporary folder, they may still be lingering in the unallocated space on the drive.  If a computer user regularly visits pornography sites, hundreds of image and video files will get stored in the temporary internet folder.  If any of these images or videos depict a minor (under the age of 18), the person will be in possession of child pornography.  Now the question becomes whether the user knowingly possessed these files.

Barton v. State

In 2007, the Georgia Court of Appeals held that the presence of pornographic images of children saved in a person’s temporary internet folder did not, by itself, constitute knowing possession of child pornography.  Barton was convicted of 106 counts of possession of child pornography based on the discovery of pornographic images in his temporary internet folder.  The Court of Appeals vacated his conviction holding that the State failed to show that Barton knowingly possessed these files.  The Court held that even if he intended to look at these photos on the internet, he still had no knowledge that the files would be physically placed in his temporary internet folder on his computer.  The Court noted that the concept of “possession” contemplates that the person knows that the unlawful images are being stored on a disk or other tangible material in his possession.  Thus, while it may have been clear that Barton knowingly viewed child pornography on the internet, he was never in knowing possession of the files containing the unlawful images.

The ruling in Barton is made possible by the fact that the statute does not criminalize the viewing of child pornography–only the possession of it.  The knowing possession of child pornography in this context requires the prosecution to show that the defendant intentionally sought out and viewed the pornographic materials with the knowledge that the images would be saved on his computer.

The ruling in Barton also applies to deleted files found in the unallocated space.  To prove that a person knowingly possessed deleted files in the unallocated space, the prosecution will have to prove that the person actively sought out and stored these files on the computer before they were deleted.  The only difference is that even if the person had no knowledge that the deleted files would still be stored in the unallocated space, the prosecution may be able to charge the person with knowingly possessing the files prior to their deletion. Click here for a discussion on a recent Court of Appeals decision that distinguishes the possession of files in the recycle bin versus files found in the unallocated space.


In Part II, we will examine the accidental downloading or possession of child pornography and the type of data we look for on the hard drive to prove our client's innocence. For more information, please visit our website to learn how we successfully defend individuals with child pornography charges in Georgia.

Topics: Child Pornography, Investigation