Erik Hentzen v. United States

NOT RECOMMENDED FOR PUBLICATION
File Name: 23a0522n.06

No. 22-5573

UNITED STATES COURT OF APPEALS
FILED
Dec 13, 2023
FOR THE SIXTH CIRCUIT
KELLY L. STEPHENS, Clerk

)
ERIK HENTZEN,
)
Petitioner-Appellant, ) ON APPEAL FROM THE UNITED
) STATES DISTRICT COURT FOR
v. ) THE EASTERN DISTRICT OF
) KENTUCKY
UNITED STATES OF AMERICA, )
) OPINION
Respondent-Appellee.
)

Before: BOGGS, SUHRHEINRICH, and READLER, Circuit Judges.

BOGGS, Circuit Judge. Erik Hentzen was convicted of receipt and possession of child

pornography, in violation of 18 U.S.C. § 2252(a)(2) and 18 U.S.C. § 2252(a)(4)(B), and was

sentenced to 20 years in prison. Hentzen then appealed to this court, arguing that the prosecution

presented insufficient evidence to convict and that the admission of a “grooming” video was

improper. United States v. Hentzen, 638 F. App’x 427 (6th Cir. 2015) (“Hentzen I”). Finding that

the body of evidence showed that Hentzen affirmatively sought out child pornography and the

admission of the video was harmless error, this court affirmed the judgment and sentence of the

district court. Id. at 427-35.

Hentzen filed a timely motion to vacate his conviction and sentence under 28 U.S.C.

§ 2255, asserting that his trial counsel was ineffective for failing to obtain and prepare qualified

expert testimony to expose inaccuracies in, and otherwise contest, the government’s

computer-forensics evidence. A magistrate judge recommended that Hentzen’s 28 U.S.C. § 2255
No. 22-5573, Hentzen v. United States

be denied and the district court adopted the findings. Hentzen filed a timely notice of appeal,

asking this court to issue a certificate of appealability (COA). (Hentzen v. United States, No.

18-6168 (“Hentzen II”) Order at 1-2). We granted Hentzen relief as to some of his ineffective-

assistance-of-counsel claims, namely (1) his failure to obtain and prepare a competent expert, (2)

ineffective assistance of trial counsel at the sentencing hearing, and (3) ineffective assistance of

Appellate counsel claims. Ibid. The United States then moved to reverse the district court’s denial

of Hentzen’s motion to vacate and to remand the case to the district court, as he was entitled to an

evidentiary hearing with respect to the claims allowed by the COA. Hentzen II, 2019 U.S. App.

LEXIS 14831, at *1 (6th Cir. May 17, 2019). This court vacated the district court’s judgment and

remanded the matter. Id. at *2-3.

In August 2021, a two-day evidentiary hearing was held. The court heard testimony from,

among others, Dr. Andrew Cobb, a former University of Louisville professor, about the computer-

forensics examination of Hentzen’s computers and computer-related devices. Dr. Cobb opined

that the investigators breached universally accepted procedures of computer forensics and analysis

at the time Hentzen’s equipment was seized and that the court heard inaccurate testimony with

respect to how certain features of the Windows XP operating system functioned. Hentzen himself

also testified during the evidentiary hearing about his trial counsel’s representation of him and the

evidence. Additionally, Kentucky Attorney General’s Office Cyber Crimes Unit Forensic

Examiner and Detective Michael Littrell also testified regarding certain “triage” procedures

conducted on Hentzen’s equipment at the time of seizure. He opined that the time stamps found

on Hentzen’s files that post-dated seizure were the result of the triage software used at the time

Hentzen’s computers and computer devices were seized.

-2-
No. 22-5573, Hentzen v. United States

In February 2022, Magistrate Judge Ingram issued a comprehensive Report and

Recommendation, recommending denial of Hentzen’s motion to vacate on his three remaining

grounds: (1) his ineffective-assistance-of-trial-counsel’s failure to obtain and prepare a competent

expert, (2) his ineffective-assistance-of-trial-counsel at allocution at sentencing, and (3) his

ineffective-assistance-of-appellate-counsel at sentencing claims. Magistrate Judge Ingram,

however, also recommended the issuance of a COA only as to the first ground—Hentzen’s

ineffective-assistance-of-trial-counsel counsel claim—finding that reasonable jurists could find

that Hentzen was prejudiced. The district court subsequently entered judgment in favor of the

United States.

Hentzen now appeals, asserting that his trial counsel failed to provide him constitutionally

adequate assistance of counsel as to the presentation of expert testimony regarding the computer-

forensic evidence. Hentzen has failed to establish that his trial counsel’s performance was either

deficient or prejudicial, and we affirm.

I. BACKGROUND

A. Hentzen I

In 2014, a jury convicted Erik Hentzen of knowing receipt and possession of child

pornography and he was sentenced to 240 months in prison. At the time, he was a 25-year-old

student at the University of Kentucky. Hentzen I, 638 F. App’x at 428. Hentzen had a keen interest

in computers, possessing seven computers and seventeen other computer-related devices capable

of storing a combined seventeen terabytes of digital data. He also avidly downloaded and collected

internet files including music, videos, and pornography using peer-to-peer networks like eDonkey.

Ibid. To access eDonkey, Hentzen used a software client called eMule.

-3-
No. 22-5573, Hentzen v. United States

The Kentucky Attorney General’s Cyber Crime Unit surveils peer-to-peer networks,

including eDonkey, for the distribution of child pornography. To surveil these networks, the Unit

uses remote forensics tools, including an automatic software that searches networks for common

keywords associated with child pornography. When a computer shares files containing those

keywords, the IP address of the computer and the hash values of the files are documented. A hash

value is a unique digital fingerprint for each file that the Unit can use to identify files that match

those of known child pornography. Between September and November of 2012, an agent detected

many child-pornography files being shared by a single IP address on an unsecured internet router

in Hentzen’s apartment building. These files were traced to a laptop in Hentzen’s apartment.

In March 2013, state law-enforcement officials executed a search warrant at Hentzen’s

apartment. Among the state law-enforcement officials were also computer-forensics experts with

the Kentucky Attorney General’s Office Cyber Crimes Branch, including investigator Thomas

Bell.

Investigators testified that they found “the largest collection of computer equipment” they

had seen in executing over 200 warrants. A total of seven computers, multiple external hard drives,

and USB storage devices were seized from Hentzen’s home. Investigators examined the devices

on the scene and conducted a preliminary review of a laptop. The laptop’s IP address matched the

IP address that had previously been identified as downloading known child-pornography files prior

to the execution of the search warrant. When investigators opened the laptop, it was running and

showed all active downloads and uploads at the time. Recent and current downloads visible on

Hentzen’s computer screen included files with keywords that were clearly associated with child

pornography. Hentzen was subsequently arrested.

-4-
No. 22-5573, Hentzen v. United States

Hentzen’s computers and computer devices were submitted to forensic examination and

were found to contain child pornography. Investigators found a total of 1,348 child-pornography

images and 4,144 child-pornography videos on Hentzen’s laptop. An additional 4,006 images and

2,461 videos, all believed to contain representations of child sexual abuse, were also located in a

deleted state or stored within unallocated space, indicating that these files had been deleted or

moved to another storage device. Further, investigators discovered a digital catalogue for

commercial-grade child pornography and child-sexual-abuse images and videos for sale and

multiple videos of animated child pornography depicting children engaging in sexual activity with

adult men. Videos relating to exactly how to molest a child and how to “groom” a child into

participating in abusive activities, as well as videos and images depicting bondage, torture, sado-

masochistic behavior, and bestiality involving children were also contained within Hentzen’s

devices. All the evidence above was presented at trial.

The only contested issue at trial was whether Hentzen knew that the child-pornography

files that had been found on his computer were, in fact, child pornography when he downloaded

and possessed them. Hentzen I, 638 F. App’x at 429. The government presented a document

detailing his last 30 searches on eMule as evidence that Hentzen knew that he was downloading

child pornography. This document contained several known keyword terms pertaining to child

sexual abuse and pornography, all entered individually. The government also presented evidence

that two still images had been opened on an internet browser and some files had been opened using

a view that shows the thumbnails of videos and images. The government introduced into evidence

several examples of the files that were found on Hentzen’s computer, including the catalogue and

nine child-pornography videos, portions of which were played for the jury. These included a video

-5-
No. 22-5573, Hentzen v. United States

depicting a girl forced to engage in sexual activity with an animal as well as recordings of adult

men sexually abusing young girls and, in one video, an infant.

Hentzen testified on his own behalf, asserting that he did not know that the files he was

downloading were child pornography. Hentzen I, 638 F. App’x at 429-30. He testified that the

files were on his computer through two different ways: (1) as a result of his side business of fixing

his friends’ computers in which he would copy all their media files onto his hard drives, or (2)

because of his habit of searching the internet and batch downloading the top searches of the day.

Hentzen explained that he developed a text file of all possible pornography keywords and would

copy those keywords into the eMule search box and download any files that the program told him

he did not already have. Hentzen maintained that he would generally not look at the names of the

files, but rather the size of the file and how quickly it could download onto his computer. Using

this batch downloading method, Hentzen testified that he downloaded at least 100,000 media files

and had not watched most of them. Upon downloading the files, Hentzen would immediately open

25 different files at once to see if the files prompted an alert that they contained a virus or were

otherwise corrupted. He testified that he would then move the uncorrupted files into a new labeled

folder. If a folder was automatically created by the downloading software for a group of files,

Hentzen would search for other files with that keyword and place them together in that folder.

The government presented rebuttal testimony from William Baker, investigating forensic

examiner and investigations manager for the Cyber Crimes Unit at the Kentucky Attorney

General’s Office, regarding the files that were actively downloading when Hentzen’s computer

was seized. Baker testified that, for some of the child-pornography files, there was no evidence

that any other downloads had begun during the downloading process for those files found actively

-6-
No. 22-5573, Hentzen v. United States

downloading on Hentzen’s computer at the start of the seizure. Additionally, the forensic examiner

noted that the still-downloading files had been downloaded individually.

After hearing the evidence, a jury convicted Hentzen. Hentzen I, 638 F. App’x at 430-31.

He received a below-Guidelines sentence of 240 months of imprisonment. Ibid. Hentzen

appealed, contesting the sufficiency of the evidence supporting his conviction, but this court

affirmed. Id. at 431-37.

B. Hentzen II

Hentzen then filed a timely motion to vacate his conviction and sentence under 28 U.S.C.

§ 2255. Hentzen II, 2019 U.S. App. LEXIS 14831, at *1. Among other things, Hentzen argued

that his counsel was ineffective because his defense attorney failed to obtain and prepare qualified-

expert testimony to expose alleged inaccuracies in, and otherwise contest, the government’s use

of computer evidence. Id. at *3. To support his claim, Hentzen submitted an affidavit from

Andrew Cobb, Ph.D., a forensic examiner and partner at One Source Discovery. Hentzen II,

No. 18-6168 Order at 5. Ultimately, this court vacated and remanded the case to the district court

so that an evidentiary hearing may be held. Hentzen II, 2019 U.S. App. LEXIS 14831, at *1.

In his affidavit, Dr. Cobb reviewed the evidence and averred that the Kentucky Attorney

General’s investigators “breached universally accepted procedures” of computer-forensic data

collection and analysis. Hentzen II, No. 18-6168 Order at 5. He argued that this compromised the

integrity of the evidence after Hentzen’s hard drives were taken into custody, “call[ing] into

question the quality of the evidence, and all findings and opinions based on such evidence.” Dr.

Cobb also averred that examiner William Baker provided false testimony about certain features of

the Windows XP Operating System, namely the creation and existence of “shortcut evidence,”

such as .lnk and thumbs.db files, on Hentzen’s devices. Dr. Cobb contends that the government

-7-
No. 22-5573, Hentzen v. United States

used this piece of evidence to persuade the jury of Hentzen’s guilt. Ibid. Hentzen argued that his

counsel’s failure to mitigate the government’s “shortcut evidence” with evidence akin to Dr.

Cobb’s findings was “fatal” to his case.

Hentzen also argued that trial counsel was ineffective because he failed to obtain a “more

reliable, competent, and persuasive” computer-forensics expert. Hentzen II, No. 18-6168 Order at

6. Hentzen contends that Brian Ingram, the forensics expert that his counsel retained, was “grossly

inadequate” and compromised his counsel’s ability to formulate sound trial strategy.

This court rejected Hentzen’s argument that trial counsel was ineffective because of a

failure to obtain a “more” competent expert. Explaining that the selection of a trial expert is a

“paradigmatic example” of a “virtually unchallengeable” strategic choice, Hentzen had

accordingly failed to demonstrate a reasonable probability that the outcome of his trial would have

been different had counsel consulted another expert. We noted that counsel’s investigation was

thorough; he contacted several computer-forensics entities in search of a competent expert for

Hentzen’s case, a fact Hentzen himself admitted. Further, Hentzen noted that, after determining

that Mr. Ingram’s expertise was insufficient, counsel sought and retained another expert for the

defense, Emmanuel Kressel. We concluded that, apart from mere speculation, Hentzen had failed

to demonstrate a reasonable probability that the outcome of his trial would have been different had

counsel retained a different, “more competent” expert.

With respect to Hentzen’s “shortcut evidence” claim, however, this court remanded the

issue for further proceedings. Explaining that this ineffective-assistance-of-counsel claim relied

on off-the-record conversations between Hentzen and his counsel, Hentzen should be afforded an

evidentiary hearing. Id. at 7. The court further noted that Hentzen had already met the burden for

an evidentiary hearing through his § 2255 petition and affidavit. Because reasonable jurists could

-8-
No. 22-5573, Hentzen v. United States

debate whether Hentzen is entitled to an evidentiary hearing, the court explained that, logically,

this would also mean that reasonable jurists could debate having resolved of Hentzen’s “shortcut

evidence” claim without such an evidentiary hearing.

On remand, the district court considered whether trial counsel was ineffective for failing

to obtain and prepare qualified-expert testimony to expose inaccuracies in, and otherwise contest,

the government’s computer-forensics evidence. Following an evidentiary hearing, a magistrate

judge recommended denying the motion to vacate but issuing a certificate of appealability (COA)

for only this ground due to the fact-intensive nature of the inquiry. The district court agreed and

adopted the magistrate judge’s recommendation, denied the motion, and issued a COA. In issuing

the COA, the district court noted that the question is very fact-intensive and reasonable jurists

could debate whether Hentzen was prejudiced by the failure to introduce evidence as described by

Dr. Cobb. Hentzen appeals.

II. ANALYSIS

A defendant must make two showings to succeed on an ineffective-assistance-of-trial-

counsel claim. First, he must show that counsel’s performance “fell below an objective standard

of reasonableness.” Strickland v. Washington, 466 U.S. 668, 687–88 (1984). This means that

“counsel made errors so serious that counsel was not functioning as the ‘counsel’ guaranteed the

defendant by the Sixth Amendment.” Id. at 687.

When reviewing counsel’s performance, we “indulge a strong presumption” that, “under

the circumstances, the challenged action ‘might be considered sound trial strategy.’” Id. at 689

(citation omitted). Disagreement over trial strategy is not a basis for ineffective assistance of

counsel. Ibid. In particular, “strategic choices made after thorough investigation of law and facts

relevant to plausible options are virtually unchallengeable.” Id. at 690. This standard is extremely

-9-
No. 22-5573, Hentzen v. United States

deferential, as counsel is “strongly presumed to have rendered adequate assistance and made all

significant decisions in the exercise of reasonable professional judgment.” Ibid. The inquiry

involves eliminating “the distorting effects of hindsight . . . to evaluate the conduct from counsel’s

perspective at the time.” Id. at 689.

Second, the defendant must establish that counsel’s “deficient performance prejudiced the

defense.” Id. at 687. For counsel’s error to be prejudicial, “[i]t is not enough… that [it] had some

conceivable effect on the outcome of the proceeding.” Id. at 693. Instead, there must be a

“reasonable probability that, but for counsel’s unprofessional errors, the result of the proceeding

would have been different.” Id. at 694. A reasonable probability is a “probability sufficient to

undermine confidence in the outcome.” Ibid. Counsel must have engaged in errors “so serious as

to deprive the defendant of a fair trial, a trial whose result is reliable.” Id. at 687. “An error by

counsel, even if professionally unreasonable, does not warrant setting aside the judgment of a

criminal proceeding if the error had no effect on the [ultimate] judgment.” Id. at 691.

Defendants alleging ineffective assistance of counsel bear “a heavy burden of proof.”

Whiting v. Burt, 395 F.3d 602, 617 (6th Cir. 2005). The “threshold issue is not whether [counsel]

was inadequate; rather, it is whether he was so manifestly ineffective that defeat was snatched from

the hands of probable victory.” United States v. Morrow, 977 F.2d 222, 229 (6th Cir. 1992). In

reviewing ineffective-assistance-of-counsel claims, the goal is not to ensure that a criminal

defendant is afforded perfect counsel, but rather “to ensure that the adversarial testing process

works to produce a just result under the standards governing decision.” Strickland, 466 U.S. at

687. The “proper measure of attorney performance remains simply reasonableness under

prevailing professional norms.” Id. at 688.

-10-
No. 22-5573, Hentzen v. United States

This court reviews de novo the denial of a 28 U.S.C. § 2255 motion and will overturn the

factual findings of the district court only if they are clearly erroneous. Hamblen v. United States,

591 F.3d 471, 473 (6th Cir. 2009). Ineffective-assistance-of-counsel claims present mixed

questions of law and fact and are reviewed de novo. Railey v. Webb, 540 F.3d 393, 415 (6th Cir.

2008).

A. Battle of the Experts

In his 28 U.S.C. § 2255 motion, Hentzen relies heavily upon the affidavit and testimony of

his new expert, Dr. Andrew Cobb, at his evidentiary hearing to identify issues that he says his trial

counsel should have responded to or raised. Dr. Cobb’s affidavit was based on copies of evidence

introduced at trial along with spreadsheets and other data files provided in discovery. At the

evidentiary hearing, Dr. Cobb alleged that the computers and computer devices that were seized

from Hentzen’s residence and later admitted into evidence during trial were not properly handled.

The Kentucky Office of Attorney General’s Cyber Crimes Branch, according to Dr. Cobb’s

testimony at the hearing, mishandled Hentzen’s items because they did not comply with applicable

industry standards in their investigation. To support his claim, Dr. Cobb pointed to several

thousand files that contained time stamps and dates after the evidence was taken into custody. Dr.

Cobb testified at the evidentiary hearing that this could indicate “a variety of activity,” but did not

opine as to what caused the post-custody time stamps on those files.

During cross-examination, however, Dr. Cobb contradicted himself. Cobb admitted that

the on-scene “triage” that investigators used on Hentzen’s computer and computer devices, which

involves running a particular program—OS Triage—to examine for suspect activity on devices

during the execution of a search warrant, can result in post-custody timestamps. Moreover, Cobb

-11-
No. 22-5573, Hentzen v. United States

testified that on-scene triage is, in fact, acceptable practice in this precise investigatory situation:

when investigators see contraband on the screen and suspect that file encryption may be involved.

This acceptable practice is in line with the testimony of Detective Mike Littrell, a forensic

examiner and detective with the Kentucky Attorney General’s Office Cyber Crimes Unit, who

testified that triage is (1) a part of basic forensic protocol; (2) can be performed on site without a

further search warrant; and (3) results in additional post-seizure dates being placed on a file.

Further, Detective Littrell noted that the “created” file dates—the only forensic date of importance

in a child-pornography case—were not modified. Dr. Cobb acknowledged that none of Hentzen’s

child-pornography files in question contained any creation dates that post-dated the search warrant.

Dr. Cobb also contested the testimony of William Baker, the government’s forensic

examiner, with respect to how certain shortcut files—.lnk and thumbs.db files found on Hentzen’s

computer—were created. Examiner Baker testified that a .lnk file is created when a file is opened

and a thumbs.db file is created by Windows software when a file is either viewed or opened in

icon or display view. Cobb argued, however, that .lnk files may also be created using two other

methods: right clicking on a file and creating a shortcut link, and moving an already existing .lnk

file from one device to another. Notably, however, Dr. Cobb conceded that the .lnk files, as well

as the actual child-pornography files, in question matched the existing file paths on Hentzen’s

computer, noting that there was no evidence that the .lnk files were copied or had traveled from

another computer onto Hentzen’s computer.

Likewise, Dr. Cobb also disagreed with Examiner Baker’s testimony about the creation of

thumbs.db files. Cobb testified that a thumbs.db file appears when a file is opened and viewed in

icon view or when a file is moved from one computer to another, even if it was never opened.

Cobb conceded, however, that there was no evidence that the thumbs.db files in question were

-12-
No. 22-5573, Hentzen v. United States

copied from another computer to Hentzen’s computer; the actual child-pornography files upon

which the thumbs.db files were created already existed on Hentzen’s computer. Stated simply, Dr.

Cobb concluded that the shortcut files in question, .lnk and thumbs.db files, as well as the actual

child-pornography files, both existed, and that they had matching file paths on Hentzen’s computer

and computer devices; there was no evidence that they were copied onto Hentzen’s devices.

Lastly, Dr. Cobb attempted to discredit Examiner Baker’s rebuttal testimony with respect

to Hentzen’s batch-downloading defense. While Hentzen testified that he did not have an

awareness of exactly what he was downloading because his practice was to download several files

at once, Baker testified in rebuttal that this was untrue because certain downloaded files on

Hentzen’s computer had different timestamps, rather than a single one indicative of batch

downloading. Cobb, however, noted that the creation times of the files revealed a pattern of many

files sharing a single timestamp on Hentzen’s eMule folder.

The magistrate judge recommended denying Hentzen’s motion to vacate, finding that

Hentzen’s counsel was not deficient or prejudicial. The magistrate judge explained that, had Dr.

Cobb testified at trial, the testimony would not have had any meaningful effect to undermine the

government’s credibility with respect to its data-collection methods.

Similarly, the magistrate judge explained that Dr. Cobb simply presented his own

speculation regarding how thumbs.db and .lnk files could have been copied and transferred from

another computer onto Hentzen’s own computer; there was no real evidence supporting this

method of shortcut file creation. Finding that the weight of the evidence clearly pointed to the fact

that the child-pornography files were accessed on Hentzen’s computer and computer devices, the

magistrate judge found that Dr. Cobb’s highlighting of “minor” inconsistencies was ultimately

insignificant. The magistrate judge found that, even taking Hentzen’s batch-downloading

-13-
No. 22-5573, Hentzen v. United States

testimony as true against that of Baker’s rebuttal, no prejudice resulted, considering the volume

and strength of evidence against Hentzen. The district court agreed and denied the § 2255 motion.

We agree. Hentzen has failed to show that, had Dr. Cobb’s speculative critiques of counsel

based on the evidentiary record at trial been presented to the jury at said trial, the result would have

been different. In fact, at the evidentiary hearing, Dr. Cobb conceded on several key issues asserted

in his affidavit, including the industry standards of acceptable triage practice, the creation and

presence of “shortcut evidence,” and the time stamps associated with Hentzen’s downloading

patterns. Thus, Hentzen’s argument fails to demonstrate that counsel’s performance was deficient

or that the trial outcome would have been different. Considering the evidence, he has done quite

the opposite.

B. Preparation of Computer-Forensics Evidence

On appeal, Hentzen claims that counsel was unprepared to address the government’s

computer-forensics evidence. He argues that his counsel was deficient because he should have

been prepared to show that investigators mishandled seized computer-forensics evidence and that

the government’s expert provided inaccurate testimony. The jury, he argues, did not have the

opportunity to hear mitigating evidence as to how the computer evidence was seized. Had they

had that opportunity, Hentzen claims, the integrity of the government’s computer evidence would

have been undermined.

Hentzen’s failure-to-challenge argument fails. As acknowledged by Dr. Cobb himself, the

evidence was handled properly. Dr. Cobb’s own testimony noted that an exception to the general

industry practice of powering down devices upon seizure applied to this case—when contraband

was visible on the screen. Thomas Bell testified at trial that Hentzen’s computer was in the process

of actively downloading content using eMule software at the time the search warrant was executed

-14-
No. 22-5573, Hentzen v. United States

and that the names and keywords of those files were indicative of child pornography and

immediately visible to the investigators. Thus, the subsequent decision by investigators to triage

Hentzen’s computers and computer devices was a reasonable one.

Expert testimony, including that of Dr. Cobb, contravenes Hentzen’s argument. As

mentioned above, Dr. Cobb himself conceded that the post-custody timestamps that he once argued

were significant were a result of the triaging on Hentzen’s computer at the time the search warrant

was executed. Likewise, Detective Littrell testified that changes in the times and dates of files

were an “expected outcome” of the process. Both Dr. Cobb and Detective Littrell agreed that the

created dates of the child-pornography files were the most significant pieces of evidence and were

never modified in this case.

Hentzen’s counsel testified at the evidentiary hearing that he consulted not one but two

forensic experts, both of whom raised no issues with the forensic methods used by the government.

Counsel stated that, had his experts found an issue with the forensics, he would have made the

strategic choice to contest the evidence presented by the government. Counsel’s strategic choice

to forgo countering this evidence, therefore, was sound trial strategy that exercised reasonable

professional judgment. As such, counsel cannot be considered deficient or prejudicial for a failure

to challenge the computer-forensics evidence.

C. Importance of Computer-Forensics Evidence Admitted to Trial

Relying on Dr. Cobb’s opinion, Hentzen also challenges counsel’s failure to contest the

accuracy of the government’s expert testimony. He argues that counsel allowed the government

expert to testify inaccurately and did not provide appropriate factual context regarding the nature

of shortcut files on his devices. Hentzen argues that their existence does not necessarily mean that

he opened the original, existing child-pornography files upon which the shortcut files were made,

-15-
No. 22-5573, Hentzen v. United States

but rather that the files could be on his device through other means, such as transferring the files

from another device onto his own. This argument also fails under Strickland.

As mentioned, Dr. Cobb presents mere speculation, not evidence, relating to the alternative

ways in which .lnk and thumbs.db shortcut files can be created. Regarding the child-pornography

videos in question, Dr. Cobb conceded that the .lnk and thumbs.db shortcuts traced back to and

matched file paths with those found on Hentzen’s computer. Simply stated, the actual files upon

which the shortcut files were based were on Hentzen’s computer; there is no evidence that the

shortcut files were on Hentzen’s computer through other means.

Hentzen correctly identifies two instances in which Examiner Baker’s trial testimony was

incorrect: (1) eMule was installed on more than one, not just on one, of Hentzen’s computers, and

(2) Baker’s assertion that Hentzen downloaded some files individually or in small batches of a few

files at a time was not supported by Hentzen’s eMule history, which in fact favored Hentzen’s

claim that he mostly batch-downloaded his files in bulk.

For an ineffective-assistance-of-counsel claim to prevail, however, the question is whether

counsel’s failure to highlight these errors in Baker’s testimony fell below professional standards

and prejudiced Hentzen’s defense. While Hentzen’s counsel may have failed to highlight the

presence of eMule on multiple devices, Hentzen himself stated this fact to the jury in his own

testimony. As such, this point did not require a qualified expert to testify, and Hentzen cannot

fault counsel for deficiency on this ground. In addition, it would not seem that this discrepancy is

either relevant or harmful.

Likewise, whether counsel contended that some, most, or all of Hentzen’s contraband files

were downloaded individually or in batches does not render his performance ineffective. Hentzen

argues that, had trial counsel been effective, he would have been able to undermine the confidence

-16-
No. 22-5573, Hentzen v. United States

in the computer-forensics evidence. This would, in turn, provide the jury with reasonable doubt

that Hentzen knew he downloaded child pornography and produce a different result.

There is no doubt, however, that Hentzen had knowledge of what he was doing. Regardless

of the downloading method, it is uncontested that thousands of child-pornography files were

downloaded onto Hentzen’s computer. Accomplishing this necessarily required Hentzen to

knowingly search in specific places and for specific terms on the internet. A survey of Hentzen’s

last 30 searches on eMule alone showed terminology referring to known darknet child-

pornography production studios and websites, titles and abbreviations for child pornography

known to law enforcement, known terminology added to the ends of file names to disguise child

pornography files from the authorities, and the words “toddler” in Dutch and “daughter,” “sister,”

and “brother” in German. Counsel’s failure to challenge Baker’s testimony was not prejudicial to

Hentzen, considering the evidence. Under Strickland, Hentzen again fails to prove that counsel’s

performance was deficient and that the outcome of his proceeding would have been different.

Lastly, Hentzen claims that, had his counsel been constitutionally adequate, he would have

been able to keep out of the trial record an allegedly prejudicial animated “grooming video” that

he claims was erroneously introduced into evidence. This would, in Hentzen’s view, have

warranted a reversal for a new trial on his direct appeal. Hentzen also asserts that, had counsel

been effective, he would have been able to undermine this piece of “significant circumstantial

evidence.” Hentzen I, 638 F. App’x at 431.

Again, Hentzen’s argument fails. As this court previously held, the admission of the video

evidence was one of harmless error. Id. at 435. Whether the admission of improperly admitted

404(b) evidence “substantially swayed” a jury “generally depends on whether the properly

-17-
No. 22-5573, Hentzen v. United States

admissible evidence of defendant’s guilt was overwhelming.” Id. at 434. Again, Hentzen fails to

show that his counsel was ineffective or prejudicial.

The weight of properly admitted evidence in this case is overwhelming. For Hentzen to

acquire thousands of images and videos of minors engaged in sexual abuse and sexual conduct, he

intentionally inserted keywords and phrases that he knew related to child pornography into a search

box on a peer-to-peer network, directed the program to search for files that matched those known

terms, selected the files to download from a screen that revealed the file names, instructed the

computer to download those files, and eventually removed them from his incoming folder to other

locations. As this court previously held, the admission of an isolated video in light of the evidence

is not substantial or prejudicial. There was no undermining of the properly admitted evidence in

this case; the “limited” use of single video weighed against the body of “horrifying” evidence

presented did not materially affect the outcome of the case. Hentzen I, 638 F. App’x at 435.

AFFIRMED.

-18-