COURT OF APPEALS OF VIRGINIA 

Present: Judges Beales, Alston and Senior Judge Haley 

Argued at Richmond, Virginia 

MICHAEL FORREST KOVACH 

 MEMORANDUM OPINION

 BY 

v. Record No. 2013-15-2 JUDGE ROSSIE D. ALSTON, JR. 

 DECEMBER 6, 2016 

COMMONWEALTH OF VIRGINIA 

FROM THE CIRCUIT COURT OF WESTMORELAND COUNTY 

Harry T. Taliaferro, III, Judge 

David B. Hargett (Hargett Law, PLC, on brief), for appellant. 

Rosemary V. Bourne, Senior Assistant Attorney General (Mark R. 

Herring, Attorney General, on brief), for appellee. 

Michael Forrest Kovach appeals his convictions of possession of child pornography in 

violation of Code § 18.2-374.1:1(A), two counts of possession of child pornography as a second 

or subsequent offense in violation of Code § 18.2-374.1:1(B), distribution of child pornography 

in violation of Code § 18.2-374.1:1(C), and three counts of distribution of child pornography as a 

second or subsequent offense in violation of Code § 18.2-374.1:1(C). Specifically, appellant 

argues that the evidence was insufficient to support his convictions. We affirm in part and 

reverse in part. 

I. BACKGROUND

On November 19, 2013, Special Agent Mike Jedrey of the Virginia State Police began 

investigating an IP address suspected of distributing child pornography. The IP address provided 

him with a file list containing terms of child exploitation. From this list, Special Agent Jedrey 

attempted to download some of the files to verify the content. He was able to download the files 

                                                             

 Pursuant to Code § 17.1-413, this opinion is not designated for publication. 

UNPUBLISHED 
- 2 -

using a peer-to-peer sharing platform designed to facilitate file sharing between computers. 

Special Agent Jedrey later traced the IP address to appellant because the address was registered 

to appellant’s residence. 

On March 5, 2014, Special Agent Jedrey, along with several other officers, executed a 

search warrant of appellant’s home. Nine items were seized including a Dell Dimension 2400 

Tower, an iPhone, two SD cards, three laptops, an external hard disc drive, and a large black 

custom computer desk top tower. 

On the same day, Special Agent Jedrey interviewed appellant. Appellant stated that only 

he and his sons lived in the house and that he monitored the computers very carefully, 

controlling what information his sons could access. He also indicated that he downloaded 

peer-to-peer sharing software, Shareaza, on his computer and admitted to downloading adult 

pornography. Appellant also stated that while he was downloading these files, he viewed child 

pornography on a zip file1

 that he downloaded using Shareaza. 

At trial, Special Agent Jedrey testified about the files that came from the IP address 

registered to appellant’s home which Special Agent Jedrey downloaded using peer-to-peer 

sharing programs. As part of his investigation, Special Agent Jedrey testified that for several 

months he would download files that he suspected of being child pornography. Some of these 

images were found on a zip file on appellant’s desktop and a SD card.2

 During that time the files 

he downloaded ultimately allowed him to obtain a search warrant for appellant’s home. 

Thomas Heflin, an expert in the field of digital forensic examination, testified about what 

the investigators found on the items seized from appellant’s house. Child pornography was 

                                                             1

 A zip file is downloaded by a computer user and allows multiple pictures, videos, or any 

other type of file to be contained within a compressed file to provide space on a computer and 

make transmission more efficient. 

2

 A SD card is a memory card that stores files and can be inserted into a computer. 
- 3 -

found on a laptop, the desktop computer, and a SD card. The child pornography was found in 

the unallocated space3

 on the desktop and in the thumb cache4 on the laptop. Heflin testified that 

there were videos on the SD card depicting child pornography, which the Commonwealth played 

at trial. Heflin also testified that when he examined the desktop the user name for the 

peer-to-peer sharing program installed on the computer was “Mike.” 

Lawrence Daniel, an expert in forensic examination, testified that he could not tell from 

examining the SD card whether it had been accessed by other computers. Daniel also stated that 

he did not find any link file from the SD card on the laptop or the desktop, which would have 

appeared if a link had been opened on either device from the SD card. Further, Daniel testified 

that the only pictures found on the desktop and laptop computer were in the unallocated space or 

the thumb cache. Both the unallocated space and the thumb cache require special software to 

gain access to them; there was no evidence of any such programs on either the laptop or the 

desktop. Daniel testified that because the globally unique identifier (“GUID”) number, which 

Special Agent Jedrey found while downloading suspicious files using the peer-to-peer sharing 

program, matched appellant’s desktop, it followed that the child pornography came from 

appellant’s computer. 

At the close of the Commonwealth’s case, appellant moved to strike the evidence on each 

charge. Appellant argued that the evidence presented by the Commonwealth was insufficient to 

support the child pornography possession and distribution charges against him. Appellant 

                                                             3

 Unallocated space is an area of the computer where files that users have viewed will be 

stored, even if they are deleted, until they are eventually overwritten. Files found in the 

unallocated space on a computer could not be accessed by a user without some specialized 

software or program. 

4

 A thumb cache is a Microsoft Windows database designed to store smaller versions of 

images that a computer user looks at in Windows Explorer. Thumb cache images on a computer 

cannot be accessed by a user without some specialized software or program. 
- 4 -

argued that the Commonwealth could not prove that appellant knowingly possessed child 

pornography because the only pictures found on the desktop and the laptop were in places the 

appellant could not access, specifically the unallocated space and the thumb cache. Appellant 

further argued that people who have SD cards do not necessarily know what is on them. 

Appellant stated that there was no way to prove appellant ever accessed, acquired, or viewed 

anything on the SD card containing child pornography. 

In his motion to strike, appellant also argued that there was no way to prove that the 

people in the videos were children. He further stated that there was no way for the trial court to 

know which picture or video corresponded with each indictment. Ultimately, the trial court 

denied appellant’s motion to strike. 

The trial court found appellant guilty of possession of child pornography, two counts of 

possession of child pornography as a second or subsequent offense, distribution of child 

pornography, and three counts of distribution of child pornography as a second or subsequent 

offense. While the trial court admitted that it was not trying to limit the possession charges to a 

particular exhibit, it did state that the first possession conviction was based on evidence found in 

the thumb cache on the desktop, the second possession conviction was based on evidence found 

in a Shareaza “collection” zip file, and the third possession conviction was based on evidence 

found in the unallocated space on the laptop. The first distribution conviction was based on one 

photo that Special Agent Jedrey downloaded on November 21, 2013. The second distribution 

conviction was based upon the evidence of all the other photographs Special Agent Jedrey 

downloaded on November 21, 2013. The third distribution conviction was based on all the 

images Special Agent Jedrey downloaded on December 9, 2013. The fourth distribution 

conviction was based on all the images Special Agent Jedrey downloaded on November 19, 
- 5 -

2013. The trial court sentenced appellant to a total of forty years in prison, with twenty-five 

years suspended. This appeal followed. 

II. ANALYSIS

In this case, appellant challenges the trial court’s decision to deny his motion to strike the 

possession and distribution of child pornography charges against him. When reviewing the 

sufficiency of evidence on appeal, “the evidence and all reasonable inferences fairly drawn 

therefrom must be viewed in the light most favorable to the Commonwealth. The trial court’s 

judgment should be affirmed unless it appears that it is plainly wrong or without evidence to 

support it.” Spencer v. Commonwealth, 238 Va. 275, 283, 384 S.E.2d 775, 779 (1989) (citation 

omitted). The appellate court examines a trial court’s fact findings “with the highest degree of 

appellate deference.” Thomas v. Commonwealth, 48 Va. App. 605, 608, 633 S.E.2d 229, 231 

(2006). “An appellate court does not ‘ask itself whether it believes that the evidence at the trial 

established guilt beyond a reasonable doubt.’” Williams v. Commonwealth, 278 Va. 190, 193, 

677 S.E.2d 280, 282 (2009) (quoting Jackson v. Virginia, 443 U.S. 307, 318-19 (1979)). The 

only “relevant question is, after reviewing the evidence in the light most favorable to the 

prosecution, whether any rational trier of fact could have found the essential elements of the 

crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280 Va. 672, 676, 701 S.E.2d 

61, 63 (2010) (citing Jackson, 443 U.S. at 319). 

A. Possession of Child Pornography 

Code § 18.2-374.1:1(A) states that “[a]ny person who knowingly possesses child 

pornography is guilty of a Class 6 felony.” To convict appellant of possession of child 

pornography, the Commonwealth had to prove appellant “was aware of the presence and 

character of the [contraband] and that he intentionally and consciously possessed [it].” Merritt v. 

Commonwealth, 55 Va. App. 719, 733, 689 S.E.2d 757, 764 (2010) (quoting Castaneda v. 
- 6 -

Commonwealth, 7 Va. App. 574, 583, 376 S.E.2d 82, 87 (1989)); see also Terlecki v. 

Commonwealth, 65 Va. App. 13, 24-25, 772 S.E.2d 777, 782-83 (2015) (holding that possession 

of child pornography may be analyzed under principles of constructive possession). 

“Possession can be proven ‘by showing either actual or constructive possession.’” 

Merritt, 55 Va. App. at 733, 689 S.E.2d at 764 (quoting Birdsong v. Commonwealth, 37 

Va. App. 603, 607, 560 S.E.2d 468, 470 (2002)). “Proof of constructive possession necessarily 

rests on circumstantial evidence; thus, ‘all necessary circumstances proved must be consistent 

with guilt and inconsistent with innocence and exclude every reasonable hypothesis of 

innocence.’” Id. (quoting Burchette v. Commonwealth, 15 Va. App. 432, 435, 425 S.E.2d 81, 83 

(1992)). When proving constructive possession of contraband, as in this case, “the 

Commonwealth must point to evidence of acts, statements, or conduct of the accused or other 

facts or circumstances which tend to show that [appellant] was aware of both the presence and 

character of the [contraband] and that it was subject to his dominion and control.” Powers v. 

Commonwealth, 227 Va. 474, 476, 316 S.E.2d 739, 740 (1984) (citing Eckhart v. 

Commonwealth, 222 Va. 447, 450, 281 S.E.2d 853, 855 (1981)). 

 In this case, appellant argues that the Commonwealth’s evidence was insufficient for the 

trial court to convict him of the possession charges because there was no evidence that appellant 

had knowledge of what was on his desktop or laptop, in the unallocated space or the thumb 

cache. Appellant also argues that the Commonwealth did not provide evidence to support the 

trial court’s finding that he had knowing possession or dominion and control over the SD card 

found by the police.5

                                                             5

 Appellant did not provide a substantial argument about the evidence found on the 

desktop in the Shareaza “collection” zip file which is what the trial court considered in 

convicting him of the second possession charge, instead appellant focused on the SD card. 
- 7 -

In Kobman v. Commonwealth, 65 Va. App. 304, 307-08, 777 S.E.2d 565, 567 (2015), 

this Court found that the mere presence of contraband in the unallocated space of a computer 

does not establish knowing possession of the contraband because the material in the unallocated 

space cannot be accessed or seen without forensic software. Likewise, in the present case, 

investigators found images in the unallocated space of appellant’s desktop, but because no 

forensic software was found on the computer allowing access to the material appellant could not 

be found to possess the contraband. Therefore, the trial court erred in denying the motion to 

strike because no evidence established that appellant had knowledge, dominion, or control of the 

photographs found in the unallocated space.6

The trial court also erred by denying the motion to strike as it related to the possession 

charges for images in the thumb cache. Based on Daniel’s expert testimony, special software is 

required to access the thumb cache, similar to that necessary for accessing the unallocated space. 

Pursuant to Kobman, when special software is required to access part of a computer, and that 

special software is not present, the recovered evidence by itself does not establish criminal 

liability. 65 Va. App. at 307-08, 777 S.E.2d at 567. In this case, there was no evidence that 

appellant had the software on his laptop that was necessary to access the thumb cache. 

For the remaining possession charge, based on the evidence found on the desktop in the 

Shareaza “collection” zip file, the Commonwealth advances a theory of constructive possession 

of the contraband. As previously stated, “the Commonwealth must point to evidence of acts, 

statements, or conduct of the accused or other facts or circumstances which tend to show that the 

[appellant] was aware of both the presence and character of the [contraband] and that it was 

                                                             6

 The Commonwealth concedes this point on brief, citing Kobman. While this Court is 

not obligated to follow concessions of law by the Commonwealth, this concession of law is an 

appropriate recognition of controlling principles in this matter. See Logan v. Commonwealth, 47 

Va. App. 168, 172, 622 S.E.2d 771, 773 (2005) (en banc).
- 8 -

subject to his dominion and control.” Powers, 227 Va. at 474, 316 S.E.2d at 739. “Ownership or 

occupancy of the premises on which the contraband was found is a circumstance probative for 

possession.” Archer v. Commonwealth, 26 Va. App. 1, 12, 492 S.E.2d 826, 832 (1997). In the 

present case, the police recovered images from the desktop in a Shareaza “collection” zip file. 

Special Agent Jedrey testified that these images were accessible to users without any special 

programs. In addition, appellant admitted to Special Agent Jedrey that he saw an image of child 

pornography on a zip file. This evidence, coupled with the facts which bolster the finding that 

appellant had control over the desktop, the images located in the zip file which were under the 

user name “Mike,” and because the zip file had recently been opened on the desktop, lead to the 

conclusion that appellant knew the images were on the desktop and were under his dominion and 

control. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s 

ruling on the motion to strike as it related to the evidence found on the desktop in the Shareaza 

“collection” zip file was not plainly wrong or without evidence to support it. 

With regard to the pictures found on the SD card, the trial court did not specifically base 

any conviction on the evidence found there but it still acknowledged in its ruling that when it 

assigned a particular exhibit to a charge “it was not trying to limit it to just those particular 

exhibits.” The trial court also stated that “from the beginning, the case has been about essentially 

the SD drive and the two computers.” The Commonwealth again offers a theory of constructive 

possession of the contraband. The Commonwealth argues that several different “acts, 

statements, [and certain] conduct” of appellant would lead a factfinder to conclude that appellant 

possessed the child pornography recovered by the police on the SD card. See Powers, 227 Va. at 

474, 316 S.E.2d at 739. 

These facts included that the SD card was found in appellant’s hamper in his bedroom. 

Next, appellant admitted that he controlled the electronic devices in his house and stated that he 
- 9 -

was the “dragon” between his sons and the computers, monitoring their use of electronics. 

Appellant admitted that sometimes suspect images and videos appeared when he was trying to 

download adult pornography. Lastly, several of the videos that Special Agent Jedrey obtained 

while he was using peer-to-peer sharing software were also found on the SD card. Viewing the 

evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion 

to strike as it related to the possession charges from the SD card was not plainly wrong or 

without evidence to support it. 

 In summary, we conclude that the trial court erred when it found that the child 

pornography found in the unallocated space on the desktop and in the thumb cache on the laptop 

established appellant’s guilt because special forensic software programs and training were 

necessary to access these images. Thus, we reverse the two possession of child pornography 

second or subsequent convictions based on the files found in the unallocated space and thumb 

cache. We affirm the possession of child pornography conviction based on the evidence found in 

the “collection” zip file downloaded using Shareaza. 

B. Distribution of Child Pornography 

Code § 18.2-374.1:1(C)(i) states that “[a]ny person who knowingly [ ] reproduces by any 

means, including by computer, sells, gives away, distributes, electronically transmits, displays, 

[or] purchases” child pornography shall be guilty of violating the statute. Appellant argues that 

he should not have been convicted of distribution of child pornography because the evidence was 

insufficient to prove that he intentionally shared child pornography or was the person responsible 

for sharing it. 

In Kelley v. Commonwealth, 289 Va. 463, 469, 771 S.E.2d 672, 674-75 (2015), the 

Supreme Court of Virginia held that because the appellant chose to download peer-to-peer 

sharing software onto his laptop, he voluntarily participated in peer-to-peer sharing of child 
- 10 -

pornography. The Court also found that appellant knew how the peer-to-peer sharing software 

worked and knew that the software was capable of sharing files with other users, regardless of 

whether appellant intended to share the files or if they were just put into a shared folder as a 

default option by the program. Id. 

Similarly, in this case, appellant knowingly downloaded and used the peer-to-peer 

sharing software on his desktop. Appellant admitted to downloading movies and adult 

pornography using Shareaza, showing he knew how to use the software. Appellant also admitted 

that he had accidentally downloaded child pornography in the past. It was reasonable for the 

factfinder to conclude that appellant should have known that the software had the ability to share 

files with other users. Appellant’s assertion that he did not know that the sharing feature was 

operating is insignificant. Furthermore, the trial court did not find appellant’s statements to 

Special Agent Jedrey, with respect to his awareness of or intention to share pornographic image 

files, credible. 

Moreover, a GUID number that Special Agent Jedrey captured while downloading 

photographs onto his computer during his investigation was a number generated during the 

installation of Shareaza on appellant’s desktop. Daniel testified that because this GUID number 

matched appellant’s desktop, Special Agent Jedrey downloaded the child pornography from 

appellant’s computer. Finally, several of the videos that Special Agent Jedrey obtained while he 

was using peer-to-peer sharing software were also found on the SD card in appellant’s hamper. 

Based on the facts and circumstances presented to the trial court, we hold that the trial 

court was not plainly wrong in denying appellant’s motion to strike the charges of distribution of 

child pornography. Accordingly, we affirm appellant’s conviction of distribution of child 

pornography in violation of Code § 18.2-374.1:1(C), and his three distribution of child 

pornography second or subsequent offenses in violation of Code § 18.2-374.1:1(C). 
- 11 -

III. CONCLUSION

 We hold that the trial court erred when it denied appellant’s motion to strike as to the 

possession of child pornography convictions based on evidence from the unallocated space on 

the desktop and in the thumb cache on the laptop. Thus, the possession of child pornography 

convictions that rely on evidence obtained from the unallocated space or the thumb cache are 

reversed. The possession of child pornography conviction that relies on evidence found on the 

desktop in the “collection” zip file downloaded using Shareaza is affirmed. We further hold that 

the trial court did not err when it denied appellant’s motion to strike as to the distribution of child 

pornography convictions. Thus, appellant’s distribution of child pornography convictions are 

affirmed. 

Affirmed in part, and reversed in part.