Our society generally agrees that possessing, producing, and distributing child sexual abuse material (CSAM)1 is morally reprehensible.2 This societal judgment is represented in sentencing outcomes for those convicted of federal child pornography offenses. Of the individuals who were sentenced in 2023 for child pornography–related offenses, ninety-nine percent were sentenced to prison, with an average sentence of 114 months.3 But, despite the severity of these crimes, sentencing fails to consider certain forensic evidence that could help distinguish more and less culpable offenders.
Judges have discretion over sentencing outcomes but are also required to consider the Federal Sentencing Guidelines, which help calculate a recommended sentence for each offender based on his offense and criminal history.4 The Guidelines include several enhancements relevant to child pornography offenses.5
An oft-used enhancement in the Federal Sentencing Guidelines, section 2G2.2(b)(7), recommends additional years based on the number of images involved in an offense.6 Though the greatest number of images considered by this section is “600 or more images,”7 most nonproduction child pornography offenders far exceed this number, with a median of 4,265 images in each collection.8
But not all images are created equal. The forensics process extracts images from a device using two different methods: parsing and carving.9 A parsed image is accessible to any ordinary user when examining the device.10 A carved image was at one point accessible on the device but is no longer accessible to the ordinary user.11 “Ordinary user” is an important caveat here. Users with relevant technical backgrounds are able to access carved images,12 and they could even manipulate their devices on purpose so that images are carved and hidden from the detection of ordinary users.13 Both carved and parsed images may signal culpability in different ways. For example, the presence of parsed images may suggest a repeated or straightforward defiance of the ban on CSAM possession, while carved images might, in some factual circumstances, communicate a defendant’s intention to evade legal detection and enforcement by taking additional technical steps, such as creating a “hidden” partition to store and hide illegal images.14
At the same time, there are different, innocuous reasons that a carved or parsed illegal image could be present. For instance, if a user discovered and promptly deleted CSAM that someone else downloaded on his device, it would remain as a carved image.15 Contrariwise, if the user never discovered and deleted that material, it would appear as a parsed image following forensic examination.
Thus, the distinction between carved and parsed images has relevance for culpability: In individual cases, within the broader context of the case, whether an image was …
If the court cannot distinguish between carved and parsed illegal images, THEN there is a possibility that one could buy a previously owned device where the previous owner deleted CSAM still left carved images that the current owner had no knowledge of and still be prosecuted regardless there is no metadata in these carved images to tie him with the crime. That is a BIG PROBLEM.