COURT OF APPEALS OF VIRGINIA

Present: Judges Beales, Al ston and Senior Judge Haley Argued at Richmond, Virginia

MICHAEL FORREST KOVACH MEMORANDUM OPINION  BY v. Record No. 2013-15-2 JUDGE ROSSIE D. ALSTON, JR. DECEMBER 6, 2016 COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF WESTMORELAND COUNTY Harry T. Taliaferro, III, Judge David B. Hargett (Hargett Law, PLC, on brief), for appellant. Rosemary V. Bourne, Senior Assi stant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee.

Michael Forrest Kovach appeals his convict ions of possession of child pornography in violation of Code § 18.2-374.1:1(A) , two counts of possession of child pornography as a second or subsequent offense in violation of Code § 18.2-374.1:1(B), distribut ion of child pornography in violation of Code § 18.2-374.1: 1(C), and three counts of distri bution of child pornography as a second or subsequent offense in violation of Code § 18.2-374.1:1(C). Specifically, appellant argues that the evidence was insufficient to supp ort his convictions. We affirm in part and reverse in part.

I. B ACKGROUND On November 19, 2013, Special Agent Mike Jedr ey of the Virginia State Police began investigating an IP address susp ected of distributing child pornography. The IP address provided him with a file list containing te rms of child exploitation. From this list, Special Agent Jedrey attempted to download some of the files to verify the content. He was able to download the files

 Pursuant to Code § 17.1-413, this opin ion is not designated for publication.UNPUBLISHED- 2 - using a peer-to-peer sharing plat form designed to facilitate file sharing between computers. Special Agent Jedrey later traced the IP address to appellant because the address was registered to appellant’s residence. On March 5, 2014, Special Agent Jedrey, along with several other officers, executed a search warrant of appellant’s home. Nine ite ms were seized including a Dell Dimension 2400 Tower, an iPhone, two SD cards, three laptops, an external hard disc drive, and a large black custom computer desk top tower. On the same day, Special Agent Jedrey intervie wed appellant. Appella nt stated that only

he and his sons lived in the house and that he monitored the computers very carefully, controlling what information his sons could acce ss. He also indicated that he downloaded peer-to-peer sharing software, Shareaza, on hi s computer and admitted to downloading adult pornography. Appellant also stated that while he was downloading these files, he viewed child pornography on a zip file 1 that he downloaded using Shareaza. At trial, Special Agent Jedrey testified about the files that came from the IP address registered to appellant’s home which Special Agent Jedrey downloaded using peer-to-peer sharing programs. As part of his investigation, Special Agent Jedrey testified that for several

months he would download files that he suspected of being ch ild pornography. Some of these images were found on a zip file on appellant’s desktop and a SD card. 2 During that time the files he downloaded ultimately allowed him to obt ain a search warrant for appellant’s home. Thomas Heflin, an expert in the field of dig ital forensic examination, testified about what the investigators found on the items seized from appellant’s house. Child pornography was

1 A zip file is downloaded by a computer user and allows multiple pictures, videos, or any other type of file to be cont ained within a compressed file to provide space on a computer and make transmission more efficient.

2 A SD card is a memory card that stores f iles and can be insert ed into a computer.- 3 - found on a laptop, the desktop computer, and a SD card. The child pornography was found in the unallocated space 3 on the desktop and in the thumb cache 4 on the laptop. Heflin testified that there were videos on the SD card depicting ch ild pornography, which th e Commonwealth played

at trial. Heflin also testified that when he examined the desktop the user name for the peer-to-peer sharing program installed on the computer was “Mike.” Lawrence Daniel, an expert in forensic examin ation, testified that he could not tell from examining the SD card whether it had been accessed by other computers. Daniel also stated that he did not find any link file from the SD card on the laptop or the desk top, which would have appeared if a link had been opene d on either device from the SD ca rd. Further, Daniel testified that the only pictures found on the desktop and la ptop computer were in the unallocated space or the thumb cache. Both the unallocated space and the thumb cache require special software to gain access to them; there was no evidence of any such programs on either the laptop or the desktop. Daniel testified that because the gl obally unique identifier (“GUID”) number, which Special Agent Jedrey found while downloading susp icious files using the peer-to-peer sharing program, matched appellant’s desktop, it followed that th e child pornography came from appellant’s computer. At the close of the Commonwealth’s case, appe llant moved to strike the evidence on each charge. Appellant argued that the evidence pr esented by the Commonwealth was insufficient to support the child pornography po ssession and distributi on charges against him. Appellant

3 Unallocated space is an area of the computer where files that users have viewed will be stored, even if they are dele ted, until they are eventually overwritten. Files found in the unallocated space on a computer could not be ac cessed by a user without some specialized software or program.

4 A thumb cache is a Microsoft Windows databa se designed to store smaller versions of images that a computer user looks at in Window s Explorer. Thumb cache images on a computer cannot be accessed by a user without some specialized softwa re or program.- 4 - argued that the Commonwealth could not pr ove that appellant knowingly possessed child pornography because the only pictures found on the desktop and the laptop were in places the appellant could not access, specifically the una llocated space and the thumb cache. Appellant further argued that people who have SD car ds do not necessarily know what is on them. Appellant stated that there was no way to prove appellant ever accesse d, acquired, or viewed anything on the SD card c ontaining child pornography. In his motion to strike, appellant also argue d that there was no wa y to prove that the people in the videos were children. He further stated that there was no way for the trial court to know which picture or video corresponded with each indictment. Ultimately, the trial court denied appellant’s motion to strike. The trial court found appellant guilty of po ssession of child pornography, two counts of possession of child pornography as a second or subsequent offense, distribution of child pornography, and three counts of distribution of child pornography as a second or subsequent

offense. While the trial court admitted that it was not trying to limit the possession charges to a particular exhibit, it did state that the first possession convicti on was based on evidence found in the thumb cache on the desktop, the second posse ssion conviction was based on evidence found in a Shareaza “collection” zip file, and the third possession conviction was based on evidence found in the unallocated space on the laptop. The first distribution conviction was based on one photo that Special Agent Jedrey downloaded on November 21, 2013. The second distribution conviction was based upon the ev idence of all the other photogr aphs Special Agent Jedrey downloaded on November 21, 2013. The third di stribution conviction was based on all the images Special Agent Jedrey downloaded on December 9, 2013. The fourth distribution conviction was based on all the images Speci al Agent Jedrey downloaded on November 19,- 5 - 2013. The trial court sentenced appe llant to a total of forty year s in prison, with twenty-five years suspended. This appeal followed.

II. A NALYSIS In this case, appellant challenges the trial co urt’s decision to deny hi s motion to strike the possession and distribution of child pornography charges against him. When reviewing the sufficiency of evidence on appeal, “the evidence and all reasonable inferences fairly drawn

therefrom must be viewed in th e light most favorable to the Co mmonwealth. The trial court’s judgment should be affirmed unless it appears th at it is plainly wrong or without evidence to support it.” Spencer v. Co mmonwealth, 238 Va. 275, 283, 384 S.E.2d 775, 779 (1989) (citation omitted). The appellate court examines a trial court’s fact findings “with the highest degree of appellate deference.” Thomas v. Commonwealth, 48 Va. App. 605, 608, 633 S.E.2d 229, 231 (2006). “An appellate court doe s not ‘ask itself whether it believes that the evidence at the trial established guilt beyond a reasonable doubt .’” Williams v. Commonwealth, 278 Va. 190, 193, 677 S.E.2d 280, 282 (2009) (quoting Jackson v. Virginia, 443 U.S. 307, 318-19 (1979)). The only “relevant question is, after reviewing the evidence in the light most favorable to the prosecution, whether any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280 Va. 672, 676, 701 S.E.2d 61, 63 (2010) (citing Jackson, 443 U.S. at 319). A. Possession of Child Pornography Code § 18.2-374.1:1(A) states that “[a] ny person who knowingly possesses child pornography is guilty of a Class 6 felony.” To convict appellant of possession of child pornography, the Commonwealth had to prove a ppellant “was aware of the presence and character of the [contraband] and that he intentionally and consciously possesse d [it].” Merritt v. Commonwealth, 55 Va. App. 719, 733, 689 S.E .2d 757, 764 (2010) (quoting Castaneda v.- 6 - Commonwealth, 7 Va. App. 574, 583, 376 S.E.2d 82, 87 (1989)); see also Terlecki v. Commonwealth, 65 Va. App. 13, 24-25, 772 S.E.2d 777, 782-83 (2015) (holding that possession of child pornography may be analyzed under pr inciples of constructive possession). “Possession can be proven ‘by showing eith er actual or cons tructive possession.’” Merritt, 55 Va. App. at 733, 689 S.E.2d at 764 (quoting Birdsong v. Commonwealth, 37 Va. App. 603, 607, 560 S.E.2d 468, 470 (2002)). “Pr oof of constructive possession necessarily rests on circumstantial evidence; thus, ‘all necess ary circumstances proved must be consistent with guilt and inconsistentwith innocence and exclude every reasonable hypothesis of innocence.’” Id. (quoting Bu rchette v. Commonwealth, 15 Va. App. 432, 435, 425 S.E.2d 81, 83 (1992)). When proving constructive possession of contraband, as in this case, “the Commonwealth must point to evidence of acts, st atements, or conduct of the accused or other

facts or circumstances which tend to show that [appellant] was aware of both the presence and character of the [contraband] and that it was su bject to his dominion and control.” Powers v. Commonwealth, 227 Va. 474, 476, 316 S.E.2d 739, 740 (1984) (citing Eckhart v. Commonwealth, 222 Va. 447, 450, 281 S.E.2d 853, 855 (1981)). In this case, appellant argues that the Co mmonwealth’s evidence was insufficient for the trial court to convict him of the possession char ges because there was no evidence that appellant had knowledge of what was on his desktop or laptop, in the unallocated space or the thumb cache. Appellant also argues that the Commonwealth did not provide evidence to support the trial court’s finding that he ha d knowing possession or dominion and control over the SD card found by the police. 5

5 Appellant did not provide a substantial argument about the evidence found on the desktop in the Shareaza “collecti on” zip file which is what the trial court considered in convicting him of the second possession charge , instead appellant focused on the SD card.- 7 - In Kobman v. Commonwealth, 65 Va . App. 304, 307-08, 777 S.E.2d 565, 567 (2015), this Court found that the mere presence of c ontraband in the unallocated space of a computer does not establish knowing possession of the cont raband because the material in the unallocated space cannot be accessed or seen without forensic software. Likewise, in the present case, investigators found images in the unallocated sp ace of appellant’s desktop, but because no forensic software was found on the computer allo wing access to the material appellant could not be found to possess the contraband. Therefore, th e trial court erred in denying the motion to strike because no evidence established that appellant had knowledge, dominion, or control of the photographs found in the unallocated space. 6 The trial court also erred by denying the moti on to strike as it related to the possession charges for images in the thumb cache. Based on Daniel’s expert testimo ny, special software is required to access the thumb cache, similar to that necessary for accessing the unallocated space. Pursuant to Kobman, when special software is required to access part of a computer, and that special software is not present, the recovere d evidence by itself does not establish criminal liability. 65 Va. App. at 307-08, 777 S.E.2d at 567. In this case, there was no evidence that appellant had the software on his laptop that was necessary to access the thumb cache. For the remaining possession charge, based on the evidence found on the desktop in the Shareaza “collection” zip file, the Commonwealth advances a theory of constructive possession of the contraband. As previously stated, “the Commonwealth must point to evidence of acts, statements, or conduct of the accused or other fact s or circumstances which tend to show that the [appellant] was aware of both the presence and ch aracter of the [contraband] and that it was

6 The Commonwealth concedes th is point on brief, citing Kobman. While this Court is not obligated to follow concessions of law by th e Commonwealth, this concession of law is an appropriate recognition of controll ing principles in this matter. See Logan v. Commonwealth, 47 Va. App. 168, 172, 622 S.E.2d 771, 773 (2005) ( en banc ).- 8 - subject to his dominion and control.” Powers , 227 Va. at 474, 316 S.E.2d at 739. “Ownership or occupancy of the premises on which the contra band was found is a circumstance probative for possession.” Archer v. Comm onwealth, 26 Va. App. 1, 12, 492 S.E.2d 826, 832 (1997). In the present case, the police recovered images from th e desktop in a Shareaza “c ollection” zip file. Special Agent Jedrey testified that these imag es were accessible to us ers without any special programs. In addition, appellant admitted to Special Agent Jedrey that he saw an image of child pornography on a zip file. This evidence, coupled with the facts which bolster the finding that appellant had control over the de sktop, the images located in the zip file which were under the user name “Mike,” and because the zip file had recently been opened on the desktop, lead to the conclusion that appellant knew the images were on the desktop and were under his dominion and control. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion to strike as it related to the evidence fou nd on the desktop in the Shareaza “collection” zip file was not plainly wrong or without evidence to support it. With regard to the pictures found on the SD car d, the trial court did not specifically base any conviction on the evidence f ound there but it still acknowledge d in its ruling that when it assigned a particular exhibit to a charge “it was not trying to limit it to just those particular

exhibits.” The trial court also stated that “fro m the beginning, the case has been about essentially the SD drive and the two computers.” The Comm onwealth again offers a theory of constructive possession of the contraband. The Commonwea lth argues that several different “acts, statements, [and certain] conduct” of appellant would lead a factfinde r to conclude that appellant possessed the child pornography r ecovered by the police on the SD card. See Powers, 227 Va. at 474, 316 S.E.2d at 739.

These facts included that the SD card was f ound in appellant’s hamper in his bedroom. Next, appellant admitted that he controlled the el ectronic devices in his house and stated that he- 9 - was the “dragon” between his sons and the comp uters, monitoring their use of electronics. Appellant admitted that sometimes suspect images and videos appeared when he was trying to download adult pornography. Lastly, several of th e videos that Special Agent Jedrey obtained while he was using peer-to-peer sharing software were also found on the SD card. Viewing the evidence in the light most favorable to the Co mmonwealth, the trial court’s ruling on the motion to strike as it related to the possession ch arges from the SD card wa s not plainly wrong or without evidence to support it. In summary, we conclude that the tria l court erred when it found that the child pornography found in the unallocated space on the desktop and in the thumb cache on the laptop established appellant’s guilt because special fo rensic software programs and training were necessary to access these images. Thus, we reverse the two possession of child pornography second or subsequent convictions based on the files found in the unallocated space and thumb cache. We affirm the possession of child pornography conviction based on the evidence found in the “collection” zip file dow nloaded using Shareaza. B. Distribution of Child Pornography Code § 18.2-374.1:1(C)(i) states that “[a]ny person who knowingly [ ] reproduces by any means, including by computer, sells, gives away, distributes, electronicall y transmits, displays, [or] purchases” child pornography sha ll be guilty of violating the st atute. Appellant argues that

he should not have been convicted of distribut ion of child pornography be cause the evidence was insufficient to prove that he intentionally shar ed child pornography or was the person responsible for sharing it. In Kelley v. Commonwealth, 289 Va. 463, 469, 771 S.E.2d 672, 674-75 (2015), the Supreme Court of Virginia held that because the appellant chose to download peer-to-peer sharing software onto his laptop, he voluntarily participated in peer-to-peer sharing of child- 10 - pornography. The Court also found that appellant knew how the peer-to-peer sharing software worked and knew that the software was capable of sharing files with othe r users, regardless of whether appellant intended to share the files or if they were just put into a shared folder as a default option by the program. Id. Similarly, in this case, appellant knowingl y downloaded and used the peer-to-peer sharing software on his desktop. Appellant admitted to downloading movies and adult pornography using Shareaza, showing he knew how to use the software. Appellant also admitted that he had accidentally downloaded child porn ography in the past. It was reasonable for the factfinder to conclude that appe llant should have known that the so ftware had the ability to share files with other users. Appellant ’s assertion that he did not k now that the sharing feature was operating is insignificant. Furthermore, the tria l court did not find appe llant’s statements to Special Agent Jedrey, with respect to his awaren ess of or intention to share pornographic image files, credible. Moreover, a GUID number th at Special Agent Jedrey captured while downloading photographs onto his computer during his inve stigation was a number generated during the

installation of Shareaza on appellant’s desktop. Daniel testif ied that because this GUID number matched appellant’s desktop, Special Agent Je drey downloaded the child pornography from appellant’s computer. Finally, several of the vide os that Special Agent Jedrey obtained while he was using peer-to-peer sharing software were also found on the SD card in appellant’s hamper. Based on the facts and circumstances presented to the trial court, we hold that the trial court was not plainly wrong in denying appellant’s motion to strike the char ges of distribution of child pornography. Accordingly, we affirm appe llant’s conviction of distribution of child pornography in violation of Code § 18.2-374.1:1(C), and his three distribution of child pornography second or subsequent offenses in violation of Code § 18.2-374.1:1(C).- 11 - III. C ONCLUSION We hold that the trial court erred when it de nied appellant’s motion to strike as to the possession of child pornography convictions based on evidence from the unallocated space on the desktop and in the thumb cache on the lapt op. Thus, the possession of child pornography convictions that rely on evidence obtained fr om the unallocated space or the thumb cache are reversed. The possession of ch ild pornography conviction that relies on evidence found on the desktop in the “collection” zip file downloaded us ing Shareaza is affirmed. We further hold that the trial court did not err when it denied appellant’ s motion to strike as to the distribution of child pornography convictions. Thus, appellant’s distribution of ch ild pornography convictions are

affirmed. Affirmed in part, and reversed in part.