What Constitutes “Possession” of Child Pornography? Part III: Thumbs.db Files

Thumbs.db files are system cache files created by Windows that are associated with actual image files stored on the computer. Their purpose is to produce thumbnail versions of the image files so that the files can be readily previewed in their folders. These files are created without the user’s knowledge and the Windows Explorer default settings hide these files so the user cannot see them. They are separate from the image files, therefore, if the image file is deleted from the computer, the thumbs.db file will still remain—though it will be hidden from view.

Also, these files cannot be opened or accessed by the user unless the associated image file is also on the computer. Thus, if the actual image file has been deleted from the computer, the only way for anyone to view the image in a thumbs.db file would be with sophisticated computer forensics software such as Encase.

The problem is that the thumbs.db file contains the same picture that the image file contains—just in a lower resolution. So, if an image of child pornography is deleted from the computer, the associated thumbs.db file, containing that very same image, will still remain on the hard drive without the user’s knowledge.

Below is an example of how and why a user can unknowingly transfer thumbs.db files from one computer to another:

Say a file folder on Jane’s hard drive contained 4 pictures, 2 of naked children and 2 of other content. Jane deletes the 2 naked children pictures and then emails the folder to Joe. Joe receives the folder containing 2 legal pictures and copies it to his drive, but is unaware that thumbs.db files have also been transmitted and copied (since the system files are, by default, not shown in Windows directories). As it happens, the thumbs.db files transferred to Joe’s drive will contain small, lower resolution versions of all 4 of the photos originally in the directory on Jane’s drive, but he will only see the 2 thumbnails that correlate with the 2 picture files that were copied. If Joe’s hard drive is later seized and the data is analyzed using computer forensics software, these thumbs.db files will produce 2 additional thumbnails that Joe never knew existed, these being the thumbnails of Jane’s 2 naked children pictures.

Thumbs.db files are rarely knowingly possessed and, even if the user knew they were there, the files cannot be opened without the original image file or specialized computer forensics software. So, considering that “possession” requires that the person have the power to exercise dominion and control over the item, the presence of mere thumbs.db files on a computer will rarely be sufficient to establish possession of child pornography under Georgia law.