COURT OF APPEALS OF VIRGINIA
Present: Judges Alston, Chafin and Malveaux UNPUBLISHED
Argued at Salem, Virginia
ALBERT HENRY CHRISTY, JR. MEMORANDUM OPINION* BY v. Record No. 0169-17-3 JUDGE MARY BENNETT MALVEAUX APRIL 10, 2018 COMMONWEALTH OF VIRGINIA
FROM THE CIRCUIT COURT OF AUGUSTA COUNTY Victor V. Ludwig, Judge
Kieran Bartley, Assistant Public Defender, for appellant.
John Ira Jones, IV, Assistant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee.
Albert Henry Christy, Jr. (“appellant”), appeals his convictions for three counts of
possession of child pornography, in violation of Code § 18.2-374.1:1(A).1 He argues the
evidence was insufficient to prove that he had knowledge of, access to, or dominion and control
over the pornographic images at issue on or about March 1, 2016. For the reasons that follow,
we affirm appellant’s convictions.
* Pursuant to Code § 17.1-413, this opinion is not designated for publication. 1 Appellant was also indicted for additional counts of possession of child pornography, in violation of Code § 18.2-374.1:1(A), reproduction of child pornography, in violation of Code § 18.2-374.1:1(C)(i), and reproduction of child pornography, second or subsequent offense, in violation of Code § 18.2-374.1:1(C)(i). The Commonwealth entered a nolle prosequi to several possession and reproduction charges. A jury found appellant not guilty of reproduction of child pornography and guilty of five counts of possession of child pornography. Two of appellant’s convictions are not before this Court in this appeal. I. BACKGROUND
“Under familiar principles of appellate review, we will state ‘the evidence in the light
most favorable to the Commonwealth, the prevailing party in the trial court, and will accord the
Commonwealth the benefit of all reasonable inferences fairly deducible from that evidence.’”
Sidney v. Commonwealth, 280 Va. 517, 520, 702 S.E.2d 124, 126 (2010) (quoting Murphy v.
Commonwealth, 264 Va. 568, 570, 570 S.E.2d 836, 837 (2002)).
In 2015, Detective Mark Belew of the Albemarle County Police Department was a
member of the Southern Virginia Internet Crimes Against Children Task Force. In that role,
Belew investigated computer file-sharing of sexually explicit materials involving children. To
identify those who were sharing such materials, Belew employed a variety of software, including
a program called Shareaza LE.2 He testified that Shareaza allows its users to share files by
accessing peer-to-peer (“P2P”) computer networks.3 Shareaza users employ search terms to look
for files on such networks, and the program provides them with a list of other users’ files that
match their terms. Users then select the files they want and download them directly to their
computers from other computers. However, Shareaza does not allow its users to force others to
accept files.
In December 2015, Belew used Shareaza to download several files that a specific
computer user had made available for P2P sharing. The images contained within the files
2 “Shareaza is a peer-to-peer sharing program that allows users to trade electronic files, including music, photographic, and video files.” Rideout v. Commonwealth, 62 Va. App. 779, 783 n.2, 753 S.E.2d 595, 597 n.2 (2014). The law enforcement version, Shareaza LE, “differs from the regular Shareaza in that it does not permit law enforcement to share files with other users.” Id. 3 “[P]eer-to-peer networks are ‘so called because users’ computers communicate directly with each other, not through central servers.’” United States v. Vadnais, 667 F.3d 1206, 1208 (11th Cir. 2012) (quoting Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913, 919-20 (2005)). -2- depicted sexual acts committed with minors. Belew identified the Shareaza user’s internet
protocol (“IP”) address4 and subpoenaed documents from the user’s internet service provider.
Those documents identified appellant as the internet service subscriber associated with that
particular IP address. Belew also identified a global unique identifier (“GUID”)5 associated with
the Shareaza user’s computer. He testified that a GUID is a specific numerical code assigned to
a device connected to a P2P network, which is “unique and specific. . . . [A] fingerprint[,] if you
will,” that allows the network to recognize that specific device.
On March 1, 2016, deputies from the Augusta County Sheriff’s Department,
accompanied by Belew, executed a search warrant at appellant’s home and recovered several
computers. Appellant told Belew that he had downloaded Shareaza some years earlier in order
to download music.
Zachary Moyer was a computer forensic examiner for the Office of the Attorney General
and qualified as a computer forensic expert at trial. He testified that he participated in the search
of appellant’s home and found, in a bedroom, appellant’s laptop computer open and running
Shareaza. Moyer identified a folder on the computer’s desktop which appeared to contain “child
exploitation materials.”
When Moyer conducted a forensic examination of appellant’s laptop, he determined that
it contained a single user-generated account named “bubba.” That account was secured by a
password, “bubba23,” which a user would need to log on to the laptop and access any files
contained within the “bubba” account. Moyer testified that the GUID associated with appellant’s
4 “An IP address is a string of . . . integer numbers . . . that identifies the location of a specific computer connected to the Internet.” Am. Online, Inc. v. Nam Tai Elecs., Inc., 264 Va. 583, 587 n.3, 571 S.E.2d 128, 130 n.3 (2002). 5 “A GUID number is produced whenever a peer-to-peer . . . file-sharing application . . . is installed or updated on a computer, and remains associated with the computer whenever the file-sharing program is in use.” United States v. Pirosko, 787 F.3d 358, 363 n.1 (6th Cir. 2015). -3- laptop matched the GUID identified by Belew. He also testified that Shareaza was not set to run
automatically when the laptop was turned on, but would have to be manually started by a user
after they accessed the password-protected “bubba” account. Moyer’s examination revealed that
between February 10 and March 1, 2016, the laptop’s user started Shareaza twenty times. On
March 1, the day the laptop was seized by law enforcement at approximately 11:00 a.m., the
laptop was turned on at 10:24 a.m., a user accessed the “bubba” account at 10:29 a.m., and at
10:32 a.m. the user started Shareaza. Moyer further testified that the program had been
configured to download files into a sub-folder on the computer’s desktop and that the user had to
manually change Shareaza’s default download destination to establish that configuration. He
also noted that it is not possible for a person to use Shareaza to place files on someone else’s
computer. Instead, an individual must use the program to execute a search before
double-clicking on specific search results to download files. Moyer used forensic software to
recover some of the search terms used in the Shareaza program on appellant’s laptop. Those
terms included “Toddler,” “Pre-teen,” “Jailbait,” “PTHC,” “3 YO,” “5 YO,” “6 YO,” and
“7 YO.” Moyer testified that “PTHC” is an acronym for “Preteen Hardcore” and that, based on
his experience with other child pornography cases, “YO” stands for “years old.”
Moyer located 31 relevant images and videos on the laptop’s hard drive, stored in three
distinct areas: allocated space, the thumb cache, and unallocated space. He testified that the
videos and images stored in allocated space, including those in the desktop file, would have been
readily accessible to the laptop’s user, because the computer’s operating system was aware of
their existence and where to find them on the hard drive.
Moyer stated that the thumb cache images were smaller versions of images that had been
deleted from other locations on the hard drive and that thumb cache images remain on the hard
drive unless the computer user specifically acts to delete them. The thumb cache image files
-4- contained no information indicating when they were stored on the hard drive, or later accessed or
modified. Moyer used a forensic software program to find and recover the images from the
thumb cache.
Lastly, some images were “orphan” images stored in the laptop’s unallocated space.
Moyer explained that there are two components for every file stored on a computer’s hard drive.
First, there is the actual file itself, which is stored in one location. Separately, in another
location, the computer creates a directory entry containing information about the file, including
its name and where it is stored on the hard drive. Moyer stated that “when you delete a file, it is
not like the actual picture [or] video disappears. All [that] is happening is the [directory] entry
referencing the file is marked in a way that the computer knows that [the] file is deleted.” Thus,
until the “deleted” images or videos are overwritten with new files, they will remain on the hard
drive. Moyer testified that “these [orphan] files, their [directory] entries had been deleted, but
the actual images or videos themselves . . . remained behind.” Moyer stated that because the
orphan images’ directory entries had been deleted, the computer’s operating system no longer
knew where the image files were stored. Thus, the computer’s user would not have been able to
access or recover those images from unallocated space without using special software. However,
unlike the images in the thumb cache, the orphan images did retain associated dates and times
indicating when they were first stored on the computer.
The Commonwealth introduced three orphan images into evidence. The first was stored
on appellant’s laptop at 9:34 a.m. on February 21, 2016. Its file name included the terms
“preteen,” “PTHC,” and “10yo.” The second image was also stored on appellant’s laptop at
9:34 a.m. on February 21, 2016. Its file name included the terms “Preteen,” “Pthc,” and “10Yo.”
The third image was stored on appellant’s laptop on February 25, 2016 at 12:14 p.m. Its file
name included “((PTHC)).”
-5- Appellant denied knowing that any of the pornographic images were on his computer.
He testified that he used Shareaza to search for and download music, but accessed his laptop
“just rarely” to play a computer game. He denied changing the default download settings for
Shareaza and stated that the program would sometimes “pop open” on its own. Appellant also
testified that his nickname is Bubba and that his laptop was protected by the password
“bubba23.” He stated that he and Jody Pritts were the only residents of his home, that Pritts
could not get to his laptop in his bedroom, and that he sometimes locked that room. Pritts’
testimony confirmed these facts. Pritts, who was not at the house when police executed the
search warrant, testified that she was not permitted to enter appellant’s room and that appellant
locked the room “[p]retty much” every time he left. Appellant would keep the key with him.
Pritts, who uses a wheelchair, was also unable to enter the room because it was too physically
confining.
At the close of the Commonwealth’s case, appellant moved to strike with respect to the
thumb cache images. He argued that the evidence failed to demonstrate he knowingly possessed
the images on the dates charged in the indictments, because there were no dates associated with
the images, the images were not “easily accessible,” and there was no way for him to know they
were present on his computer. The trial court denied the motion, but later revisited its ruling and
granted the motion to strike.
Appellant also moved to strike with respect to the orphan images stored in unallocated
space, arguing that a “general user” would have believed the images were “gone” after deleting
them, and would not have been able to access them without “special technology” and the
“special knowledge” that they could still be found. Further, it was impossible to know when and
how the images had been deleted and they could have been deleted “long before” March 1. The
trial court denied the motion.
-6- A jury convicted appellant of five counts of possession of child pornography—two
counts for possession of images which were stored on the computer’s desktop in allocated space,
and three counts for possession of orphan images that were stored in unallocated space.
Appellant moved to vacate the verdicts with respect to the orphan images, and his motion was
denied. This appeal followed.
II. ANALYSIS
Appellant argues that the Commonwealth’s evidence was insufficient to prove that he had
knowledge of, or access to, or dominion and control of the orphaned images on or about March
1, 2016, the dates alleged in his indictments.
When considering a challenge to the sufficiency of evidence on appeal, “we review the
evidence in the light most favorable to the Commonwealth,” the prevailing party at trial,
“granting to it all reasonable inferences fairly deducible therefrom.” Sierra v. Commonwealth,
59 Va. App. 770, 774, 722 S.E.2d 656, 657 (2012) (quoting Archer v. Commonwealth, 26
Va. App. 1, 11, 492 S.E.2d 826, 831 (1997)). The Court “discard[s] the evidence of the accused
in conflict with that of the Commonwealth.” Johnson v. Commonwealth, 53 Va. App. 79, 99,
669 S.E.2d 368, 378 (2008) (quoting Parks v. Commonwealth, 221 Va. 492, 498, 270 S.E.2d
755, 759 (1980)). Further, “circumstantial evidence may be more compelling and persuasive
than direct evidence, and when convincing, it is entitled to as much weight as direct evidence.”
Booker v. Commonwealth, 61 Va. App. 323, 335-36, 734 S.E.2d 729, 735 (2012) (quoting
Bridgeman v. Commonwealth, 3 Va. App. 523, 526, 351 S.E.2d 598, 600 (1986)).
In conducting our inquiry, “the relevant question is, after reviewing the evidence in the
light most favorable to the [Commonwealth], whether any rational trier of fact could have found
the essential elements of the crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280
Va. 672, 676, 701 S.E.2d 61, 63 (2010). “This familiar standard gives full play to the
-7- responsibility of the trier of fact fairly to resolve conflicts in the testimony, to weigh the
evidence, and to draw reasonable inferences from basic facts to ultimate facts.” Kelly v.
Commonwealth, 41 Va. App. 250, 257-58, 584 S.E.2d 444, 447 (2003) (en banc) (quoting
Jackson v. Virginia, 443 U.S. 307, 319 (1979)). We “presume the judgment of the trial court to
be correct,” White v. Commonwealth, 68 Va. App. 111, 118, 804 S.E.2d 317, 320 (2017)
(quoting Kelly, 41 Va. App. at 257, 584 S.E.2d at 447), and do not “substitute our judgment for
that of the trier of fact,” Wactor v. Commonwealth, 38 Va. App. 375, 380, 564 S.E.2d 160, 162
(2002). Thus, we “will reverse only where the trial court’s decision is ‘plainly wrong or without
evidence to support it.’” Calloway v. Commonwealth, 62 Va. App. 253, 261, 746 S.E.2d 72, 76
(2013) (quoting Seaton v. Commonwealth, 42 Va. App. 739, 746, 595 S.E.2d 9, 12 (2004)).
Code § 18.2-374.1:1(A) provides that “[a]ny person who knowingly possesses child
pornography is guilty of a Class 6 felony.”6 This Court “[has] previously held that possession of
child pornography found in computers may be analyzed under familiar principles of constructive
possession.” Kobman v. Commonwealth, 65 Va. App. 304, 307, 567 S.E.2d 565, 567 (2015).
See also Kromer v. Commonwealth, 45 Va. App. 812, 817-18, 613 S.E.2d 871, 873-74 (2005).
To convict a defendant for constructive possession, “the Commonwealth must point to evidence
of acts, statements, or conduct of the accused or other facts or circumstances which tend to show
that the defendant was aware of both the presence and character of the [contraband] and that it
was subject to his dominion and control.” Terlecki v. Commonwealth, 65 Va. App. 13, 24, 772
S.E.2d 777, 782 (2015) (quoting Drew v. Commonwealth, 230 Va. 471, 473, 338 S.E.2d 844,
845 (1986)). Further, “[o]wnership or occupancy of the premises on which the contraband was
6 Appellant does not challenge that the images at issue constituted child pornography, as defined by Code § 18.2-374.1(A). -8- found is a circumstance probative of possession.” Id. (quoting Kromer, 45 Va. App. at 819, 613
S.E.2d at 874).
Appellant contends that the instant case is analogous to Kobman. In Kobman, this Court
considered whether the evidence was sufficient to sustain the defendant’s convictions for
possession of child pornography based upon photographs stored in the unallocated space of two
computers. Kobman, 65 Va. App. at 307-08, 777 S.E.2d at 567. Both computers were seized
from the defendant’s home. Id. at 306, 777 S.E.2d at 566. The photographs were recovered by
an investigator using specialized forensic software, and the investigator testified that “files and
data in the unallocated space of a computer are ‘invisible’ to the computer’s operating system
and inaccessible to the user unless . . . specialized software is downloaded on the computer.” Id.
at 306, 777 S.E.2d at 567. Applying principles of constructive possession, this Court reversed
the convictions after concluding that “[n]o evidence established [the defendant] had access to or
used the required forensic software necessary to retrieve the deleted photographs. Further, no
evidence showed other indicia of knowledge, dominion, or control of the . . . photographs found
in the unallocated space on the specific date [sic] of the indictments.” Id. at 308, 777 S.E.2d at
567. The Court also noted that “[w]hile the evidence may suggest [the defendant] at one time
possessed the photographs in the unallocated space, there was no evidence that he had dominion
or control of them on or about May 19, 2013, as the indictments charged.” Id.
Appellant argues that the evidence in the instant case is “equivalent” to the evidence in
Kobman, and thus insufficient for the same reasons. He acknowledges that in the instant case,
the computer containing the images was seized from his residence—a circumstance Kobman
notes is probative of possession. See id. However, appellant contends that, as in Kobman, there
was no evidence he possessed the special software necessary to access the images, and no other
-9- evidence that he “had dominion and control of the images at the date alleged in the indictments,
or knew of their continued existence.”
We find appellant’s argument unpersuasive. Here, viewing the evidence in the light most
favorable to the Commonwealth, a rational trier of fact could have found that although appellant
lacked special software to access the orphan images, unlike in Kobman, there were sufficient
“other indicia” that he had knowledge of and dominion and control over the images on or about
March 1, 2016.
The images at issue were found on a laptop containing a single user account, named
“bubba,” which was secured by the password “bubba23.” Appellant testified that Bubba is his
nickname and that he protected his computer with the stated password. Only two people—
appellant and Pritts—lived in appellant’s home. Appellant maintained a separate bedroom,
where he kept several computers, and Pritts was not permitted to enter that room. Further, Pritts
was physically unable to enter the room because appellant frequently kept it locked and because
the room was too confining for her wheelchair. When law enforcement officers searched
appellant’s home, Shareaza was running on the laptop in that room and appellant was the only
person in the home. Appellant admitted to Detective Belew that he had installed Shareaza on the
laptop and testified that he used the program to download music files from the internet. Zachary
Moyer testified that the Shareaza program on appellant’s laptop had been manually reconfigured
and had to be manually started by the computer’s user and that between February 10 and March
1, 2016, Shareaza had been started twenty times. A reasonable inference may be drawn from
this evidence that appellant was the sole person who had access to and used the laptop computer
and the “bubba” account. This evidence further supports the reasonable inference that appellant
was familiar with how to use Shareaza and frequently used it in the days and weeks prior to
- 10 - Both Belew and Moyer testified that a Shareaza user acquires files from a P2P network
by entering search terms and selecting and downloading files of interest from the search results.
They also testified that it is not possible for someone else to use Shareaza to place files on a
person’s computer. Moyer testified that the laptop’s user employed search terms associated with
child pornography, including “Pre-teen,” “PTHC,” and “YO” and that these terms were found in
the file names of images on appellant’s laptop, including the orphan images. Also, Belew was
able to use Shareaza to download images of child pornography from a computer with the same IP
address and GUID as appellant’s laptop. This evidence supports the inference that appellant
used Shareaza to access P2P networks, search for images of child pornography, and download
those images to his laptop.
Based on the foregoing evidence and inferences, a rational trier of fact could have
concluded that appellant purposely searched for and downloaded the images at issue, and thus
knew of their character and presence on his computer at that time. A rational trier of fact could
also have concluded that the images were subject to appellant’s dominion and control from their
download dates until he acted to delete them, thus making them “orphan” images, at some point
during the five to nine days between their download dates and the laptop’s seizure. Thus, the
evidence was sufficient to prove that appellant knowingly possessed the three orphan images.7
7 Appellant also argues that the trial court’s rationale in granting his motion to strike the evidence of the thumb cache images applies equally to the evidence of the orphan images—that, as in Kobman, there was neither evidence that he possessed the special software necessary to access the images, nor “other indicia” of his knowledge of or dominion and control over them. This argument is without merit. The orphan images in the unallocated space on appellant’s hard drive are distinguishable from the thumb cache images, because they retain indicia of the specific dates on which they were downloaded and stored on the hard drive. For the reasons discussed above, those dates support that appellant knowingly possessed the images, because the other evidence shows that appellant used Shareaza to search for and download child pornography and only appellant could have accessed and used his laptop to download the images on those dates.
- 11 - Finally, we address appellant’s contention that the evidence failed to prove he knowingly
possessed the images at issue “on the dates alleged,” that is, “on or about March 1, 2016.” In
support of his argument, appellant again analogizes to Kobman, noting in particular this Court’s
statement that “[w]hile the evidence may suggest [the defendant] at one time possessed the
photographs in the unallocated space, there was no evidence that he had dominion or control of
them on or about May 19, 2013, as the indictments charged.” Kobman, 65 Va. App. at 308, 777
S.E.2d at 567.
We first note that the Commonwealth was not required to prove the exact date appellant
was in possession of each image in order to convict him of possession of child pornography.
Code § 19.2-226 provides that “[n]o indictment . . . shall be quashed or deemed invalid . . . [f]or
omitting to state, or stating imperfectly, the time at which the offense was committed when time
is not the essence of the offense.” “When time is not an element of the crime charged, the jury
verdict will stand” so long as the evidence proves that “a crime occurred and that the defendant
committed the crime, even though the evidence is such that there may be a reasonable doubt as to
the day on which the offense occurred.” Marlowe v. Commonwealth, 2 Va. App. 619, 623-24,
347 S.E.2d 167, 170 (1986). Further, “[t]ime is not a material element of a criminal offense
unless made so by the statute creating the offense.” Farhoumand v. Commonwealth, 288 Va.
338, 351, 764 S.E.2d 95, 102 (2014) (alteration in original) (quoting United States v. Stuckey,
220 F.3d 976, 982 (8th Cir. 2000)). Thus, where there is no such statutory provision, “[i]n a
felony case the Commonwealth may prove the commission of a crime charged on a date different
from that alleged in the indictment.” Id. (alteration in original) (quoting Harris v.
Commonwealth, 185 Va. 26, 34, 37 S.E.2d 868, 871 (1946)).
Code § 18.2-374.1:1 does not establish time as a material element of the crime of
possession of child pornography, and thus time is not of the essence of that offense.
- 12 - Consequently, even if there is reasonable doubt as to the exact date or range of dates on which
appellant possessed the images at issue, the jury verdict convicting appellant will stand so long
as the evidence is sufficient to prove he possessed child pornography as charged in the
indictments. As discussed above, the evidence is sufficient to so prove.
Further, we reject appellant’s argument that Kobman compels a different result, as
Kobman is factually distinguishable. In Kobman, the only evidence supporting the defendant’s
convictions for possession of images stored in his computers’ unallocated space was the presence
of those images themselves—undated images which he may have knowingly possessed, if at all,
at some indefinite point long before the time frame referenced in his indictments. Here, by
contrast, the evidence showed that appellant possessed the images at issue and that he did so not
more than five to nine days prior to the date specified in the indictments—March 1, 2016. Thus,
because time is not an element of the crime of possession of child pornography and Kobman is
distinguishable on the facts surrounding the images, contrary to appellant’s contention, the
evidence was sufficient to prove that he was in possession of those images “on the dates
alleged,” i.e., “on or about March 1, 2016.”
III. CONCLUSION
For the foregoing reasons, we hold that the evidence was sufficient to convict appellant
for possession of child pornography, in violation of Code § 18.2-374.1:1(A), and affirm
appellant’s convictions.
Affirmed.
- 13 -