COURT OF APPEALS OF VIRGINIA
Present: Judges Beales, Alston and Senior Judge Haley
UNPUBLISHED
Argued at Richmond, Virginia
MICHAEL FORREST KOVACH
MEMORANDUM OPINION BY
v. Record No. 2013-15-2 JUDGE ROSSIE D. ALSTON, JR.
DECEMBER 6, 2016
COMMONWEALTH OF VIRGINIA
FROM THE CIRCUIT COURT OF WESTMORELAND COUNTY
Harry T. Taliaferro, III, Judge
David B. Hargett (Hargett Law, PLC, on brief), for appellant.
Rosemary V. Bourne, Senior Assistant Attorney General (Mark R.
Herring, Attorney General, on brief), for appellee.
Michael Forrest Kovach appeals his convictions of possession of child pornography in
violation of Code § 18.2-374.1:1(A), two counts of possession of child pornography as a second
or subsequent offense in violation of Code § 18.2-374.1:1(B), distribution of child pornography
in violation of Code § 18.2-374.1:1(C), and three counts of distribution of child pornography as a
second or subsequent offense in violation of Code § 18.2-374.1:1(C). Specifically, appellant
argues that the evidence was insufficient to support his convictions. We affirm in part and
reverse in part.
I. BACKGROUND
On November 19, 2013, Special Agent Mike Jedrey of the Virginia State Police began
investigating an IP address suspected of distributing child pornography. The IP address provided
him with a file list containing terms of child exploitation. From this list, Special Agent Jedrey
attempted to download some of the files to verify the content. He was able to download the files
Pursuant to Code § 17.1-413, this opinion is not designated for publication.
using a peer-to-peer sharing platform designed to facilitate file sharing between computers.
Special Agent Jedrey later traced the IP address to appellant because the address was registered
to appellant’s residence.
On March 5, 2014, Special Agent Jedrey, along with several other officers, executed a
search warrant of appellant’s home. Nine items were seized including a Dell Dimension 2400
Tower, an iPhone, two SD cards, three laptops, an external hard disc drive, and a large black
custom computer desk top tower.
On the same day, Special Agent Jedrey interviewed appellant. Appellant stated that only
he and his sons lived in the house and that he monitored the computers very carefully,
controlling what information his sons could access. He also indicated that he downloaded
peer-to-peer sharing software, Shareaza, on his computer and admitted to downloading adult
pornography. Appellant also stated that while he was downloading these files, he viewed child
pornography on a zip file1 that he downloaded using Shareaza.
At trial, Special Agent Jedrey testified about the files that came from the IP address
registered to appellant’s home which Special Agent Jedrey downloaded using peer-to-peer
sharing programs. As part of his investigation, Special Agent Jedrey testified that for several
months he would download files that he suspected of being child pornography. Some of these
images were found on a zip file on appellant’s desktop and a SD card.2 During that time the files
he downloaded ultimately allowed him to obtain a search warrant for appellant’s home.
Thomas Heflin, an expert in the field of digital forensic examination, testified about what
the investigators found on the items seized from appellant’s house. Child pornography was
1
A zip file is downloaded by a computer user and allows multiple pictures, videos, or any
other type of file to be contained within a compressed file to provide space on a computer and
make transmission more efficient.
2
A SD card is a memory card that stores files and can be inserted into a computer.
- 2 -
found on a laptop, the desktop computer, and a SD card. The child pornography was found in
the unallocated space3 on the desktop and in the thumb cache4 on the laptop. Heflin testified that
there were videos on the SD card depicting child pornography, which the Commonwealth played
at trial. Heflin also testified that when he examined the desktop the user name for the
peer-to-peer sharing program installed on the computer was “Mike.”
Lawrence Daniel, an expert in forensic examination, testified that he could not tell from
examining the SD card whether it had been accessed by other computers. Daniel also stated that
he did not find any link file from the SD card on the laptop or the desktop, which would have
appeared if a link had been opened on either device from the SD card. Further, Daniel testified
that the only pictures found on the desktop and laptop computer were in the unallocated space or
the thumb cache. Both the unallocated space and the thumb cache require special software to
gain access to them; there was no evidence of any such programs on either the laptop or the
desktop. Daniel testified that because the globally unique identifier (“GUID”) number, which
Special Agent Jedrey found while downloading suspicious files using the peer-to-peer sharing
program, matched appellant’s desktop, it followed that the child pornography came from
appellant’s computer.
At the close of the Commonwealth’s case, appellant moved to strike the evidence on each
charge. Appellant argued that the evidence presented by the Commonwealth was insufficient to
support the child pornography possession and distribution charges against him. Appellant
3
Unallocated space is an area of the computer where files that users have viewed will be
stored, even if they are deleted, until they are eventually overwritten. Files found in the
unallocated space on a computer could not be accessed by a user without some specialized
software or program.
4
A thumb cache is a Microsoft Windows database designed to store smaller versions of
images that a computer user looks at in Windows Explorer. Thumb cache images on a computer
cannot be accessed by a user without some specialized software or program.
- 3 -
argued that the Commonwealth could not prove that appellant knowingly possessed child
pornography because the only pictures found on the desktop and the laptop were in places the
appellant could not access, specifically the unallocated space and the thumb cache. Appellant
further argued that people who have SD cards do not necessarily know what is on them.
Appellant stated that there was no way to prove appellant ever accessed, acquired, or viewed
anything on the SD card containing child pornography.
In his motion to strike, appellant also argued that there was no way to prove that the
people in the videos were children. He further stated that there was no way for the trial court to
know which picture or video corresponded with each indictment. Ultimately, the trial court
denied appellant’s motion to strike.
The trial court found appellant guilty of possession of child pornography, two counts of
possession of child pornography as a second or subsequent offense, distribution of child
pornography, and three counts of distribution of child pornography as a second or subsequent
offense. While the trial court admitted that it was not trying to limit the possession charges to a
particular exhibit, it did state that the first possession conviction was based on evidence found in
the thumb cache on the desktop, the second possession conviction was based on evidence found
in a Shareaza “collection” zip file, and the third possession conviction was based on evidence
found in the unallocated space on the laptop. The first distribution conviction was based on one
photo that Special Agent Jedrey downloaded on November 21, 2013. The second distribution
conviction was based upon the evidence of all the other photographs Special Agent Jedrey
downloaded on November 21, 2013. The third distribution conviction was based on all the
images Special Agent Jedrey downloaded on December 9, 2013. The fourth distribution
conviction was based on all the images Special Agent Jedrey downloaded on November 19,
- 4 -
2013. The trial court sentenced appellant to a total of forty years in prison, with twenty-five
years suspended. This appeal followed.
II. ANALYSIS
In this case, appellant challenges the trial court’s decision to deny his motion to strike the
possession and distribution of child pornography charges against him. When reviewing the
sufficiency of evidence on appeal, “the evidence and all reasonable inferences fairly drawn
therefrom must be viewed in the light most favorable to the Commonwealth. The trial court’s
judgment should be affirmed unless it appears that it is plainly wrong or without evidence to
support it.” Spencer v. Commonwealth, 238 Va. 275, 283, 384 S.E.2d 775, 779 (1989) (citation
omitted). The appellate court examines a trial court’s fact findings “with the highest degree of
appellate deference.” Thomas v. Commonwealth, 48 Va. App. 605, 608, 633 S.E.2d 229, 231
(2006). “An appellate court does not ‘ask itself whether it believes that the evidence at the trial
established guilt beyond a reasonable doubt.’” Williams v. Commonwealth, 278 Va. 190, 193,
677 S.E.2d 280, 282 (2009) (quoting Jackson v. Virginia, 443 U.S. 307, 318-19 (1979)). The
only “relevant question is, after reviewing the evidence in the light most favorable to the
prosecution, whether any rational trier of fact could have found the essential elements of the
crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280 Va. 672, 676, 701 S.E.2d
61, 63 (2010) (citing Jackson, 443 U.S. at 319).
A. Possession of Child Pornography
Code § 18.2-374.1:1(A) states that “[a]ny person who knowingly possesses child
pornography is guilty of a Class 6 felony.” To convict appellant of possession of child
pornography, the Commonwealth had to prove appellant “was aware of the presence and
character of the [contraband] and that he intentionally and consciously possessed [it].” Merritt v.
Commonwealth, 55 Va. App. 719, 733, 689 S.E.2d 757, 764 (2010) (quoting Castaneda v.
- 5 -
Commonwealth, 7 Va. App. 574, 583, 376 S.E.2d 82, 87 (1989)); see also Terlecki v.
Commonwealth, 65 Va. App. 13, 24-25, 772 S.E.2d 777, 782-83 (2015) (holding that possession
of child pornography may be analyzed under principles of constructive possession).
“Possession can be proven ‘by showing either actual or constructive possession.’”
Merritt, 55 Va. App. at 733, 689 S.E.2d at 764 (quoting Birdsong v. Commonwealth, 37
Va. App. 603, 607, 560 S.E.2d 468, 470 (2002)). “Proof of constructive possession necessarily
rests on circumstantial evidence; thus, ‘all necessary circumstances proved must be consistent
with guilt and inconsistent with innocence and exclude every reasonable hypothesis of
innocence.’” Id. (quoting Burchette v. Commonwealth, 15 Va. App. 432, 435, 425 S.E.2d 81, 83
(1992)). When proving constructive possession of contraband, as in this case, “the
Commonwealth must point to evidence of acts, statements, or conduct of the accused or other
facts or circumstances which tend to show that [appellant] was aware of both the presence and
character of the [contraband] and that it was subject to his dominion and control.” Powers v.
Commonwealth, 227 Va. 474, 476, 316 S.E.2d 739, 740 (1984) (citing Eckhart v.
Commonwealth, 222 Va. 447, 450, 281 S.E.2d 853, 855 (1981)).
In this case, appellant argues that the Commonwealth’s evidence was insufficient for the
trial court to convict him of the possession charges because there was no evidence that appellant
had knowledge of what was on his desktop or laptop, in the unallocated space or the thumb
cache. Appellant also argues that the Commonwealth did not provide evidence to support the
trial court’s finding that he had knowing possession or dominion and control over the SD card
found by the police.5
5
Appellant did not provide a substantial argument about the evidence found on the
desktop in the Shareaza “collection” zip file which is what the trial court considered in
convicting him of the second possession charge, instead appellant focused on the SD card.
- 6 -
In Kobman v. Commonwealth, 65 Va. App. 304, 307-08, 777 S.E.2d 565, 567 (2015),
this Court found that the mere presence of contraband in the unallocated space of a computer
does not establish knowing possession of the contraband because the material in the unallocated
space cannot be accessed or seen without forensic software. Likewise, in the present case,
investigators found images in the unallocated space of appellant’s desktop, but because no
forensic software was found on the computer allowing access to the material appellant could not
be found to possess the contraband. Therefore, the trial court erred in denying the motion to
strike because no evidence established that appellant had knowledge, dominion, or control of the
photographs found in the unallocated space.6
The trial court also erred by denying the motion to strike as it related to the possession
charges for images in the thumb cache. Based on Daniel’s expert testimony, special software is
required to access the thumb cache, similar to that necessary for accessing the unallocated space.
Pursuant to Kobman, when special software is required to access part of a computer, and that
special software is not present, the recovered evidence by itself does not establish criminal
liability. 65 Va. App. at 307-08, 777 S.E.2d at 567. In this case, there was no evidence that
appellant had the software on his laptop that was necessary to access the thumb cache.
For the remaining possession charge, based on the evidence found on the desktop in the
Shareaza “collection” zip file, the Commonwealth advances a theory of constructive possession
of the contraband. As previously stated, “the Commonwealth must point to evidence of acts,
statements, or conduct of the accused or other facts or circumstances which tend to show that the
[appellant] was aware of both the presence and character of the [contraband] and that it was
6
The Commonwealth concedes this point on brief, citing Kobman. While this Court is
not obligated to follow concessions of law by the Commonwealth, this concession of law is an
appropriate recognition of controlling principles in this matter. See Logan v. Commonwealth, 47
Va. App. 168, 172, 622 S.E.2d 771, 773 (2005) (en banc).
- 7 -
subject to his dominion and control.” Powers, 227 Va. at 474, 316 S.E.2d at 739. “Ownership or
occupancy of the premises on which the contraband was found is a circumstance probative for
possession.” Archer v. Commonwealth, 26 Va. App. 1, 12, 492 S.E.2d 826, 832 (1997). In the
present case, the police recovered images from the desktop in a Shareaza “collection” zip file.
Special Agent Jedrey testified that these images were accessible to users without any special
programs. In addition, appellant admitted to Special Agent Jedrey that he saw an image of child
pornography on a zip file. This evidence, coupled with the facts which bolster the finding that
appellant had control over the desktop, the images located in the zip file which were under the
user name “Mike,” and because the zip file had recently been opened on the desktop, lead to the
conclusion that appellant knew the images were on the desktop and were under his dominion and
control. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s
ruling on the motion to strike as it related to the evidence found on the desktop in the Shareaza
“collection” zip file was not plainly wrong or without evidence to support it.
With regard to the pictures found on the SD card, the trial court did not specifically base
any conviction on the evidence found there but it still acknowledged in its ruling that when it
assigned a particular exhibit to a charge “it was not trying to limit it to just those particular
exhibits.” The trial court also stated that “from the beginning, the case has been about essentially
the SD drive and the two computers.” The Commonwealth again offers a theory of constructive
possession of the contraband. The Commonwealth argues that several different “acts,
statements, [and certain] conduct” of appellant would lead a factfinder to conclude that appellant
possessed the child pornography recovered by the police on the SD card. See Powers, 227 Va. at
474, 316 S.E.2d at 739.
These facts included that the SD card was found in appellant’s hamper in his bedroom.
Next, appellant admitted that he controlled the electronic devices in his house and stated that he
- 8 -
was the “dragon” between his sons and the computers, monitoring their use of electronics.
Appellant admitted that sometimes suspect images and videos appeared when he was trying to
download adult pornography. Lastly, several of the videos that Special Agent Jedrey obtained
while he was using peer-to-peer sharing software were also found on the SD card. Viewing the
evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion
to strike as it related to the possession charges from the SD card was not plainly wrong or
without evidence to support it.
In summary, we conclude that the trial court erred when it found that the child
pornography found in the unallocated space on the desktop and in the thumb cache on the laptop
established appellant’s guilt because special forensic software programs and training were
necessary to access these images. Thus, we reverse the two possession of child pornography
second or subsequent convictions based on the files found in the unallocated space and thumb
cache. We affirm the possession of child pornography conviction based on the evidence found in
the “collection” zip file downloaded using Shareaza.
B. Distribution of Child Pornography
Code § 18.2-374.1:1(C)(i) states that “[a]ny person who knowingly [ ] reproduces by any
means, including by computer, sells, gives away, distributes, electronically transmits, displays,
[or] purchases” child pornography shall be guilty of violating the statute. Appellant argues that
he should not have been convicted of distribution of child pornography because the evidence was
insufficient to prove that he intentionally shared child pornography or was the person responsible
for sharing it.
In Kelley v. Commonwealth, 289 Va. 463, 469, 771 S.E.2d 672, 674-75 (2015), the
Supreme Court of Virginia held that because the appellant chose to download peer-to-peer
sharing software onto his laptop, he voluntarily participated in peer-to-peer sharing of child
- 9 -
pornography. The Court also found that appellant knew how the peer-to-peer sharing software
worked and knew that the software was capable of sharing files with other users, regardless of
whether appellant intended to share the files or if they were just put into a shared folder as a
default option by the program. Id.
Similarly, in this case, appellant knowingly downloaded and used the peer-to-peer
sharing software on his desktop. Appellant admitted to downloading movies and adult
pornography using Shareaza, showing he knew how to use the software. Appellant also admitted
that he had accidentally downloaded child pornography in the past. It was reasonable for the
factfinder to conclude that appellant should have known that the software had the ability to share
files with other users. Appellant’s assertion that he did not know that the sharing feature was
operating is insignificant. Furthermore, the trial court did not find appellant’s statements to
Special Agent Jedrey, with respect to his awareness of or intention to share pornographic image
files, credible.
Moreover, a GUID number that Special Agent Jedrey captured while downloading
photographs onto his computer during his investigation was a number generated during the
installation of Shareaza on appellant’s desktop. Daniel testified that because this GUID number
matched appellant’s desktop, Special Agent Jedrey downloaded the child pornography from
appellant’s computer. Finally, several of the videos that Special Agent Jedrey obtained while he
was using peer-to-peer sharing software were also found on the SD card in appellant’s hamper.
Based on the facts and circumstances presented to the trial court, we hold that the trial
court was not plainly wrong in denying appellant’s motion to strike the charges of distribution of
child pornography. Accordingly, we affirm appellant’s conviction of distribution of child
pornography in violation of Code § 18.2-374.1:1(C), and his three distribution of child
pornography second or subsequent offenses in violation of Code § 18.2-374.1:1(C).
- 10 -
III. CONCLUSION
We hold that the trial court erred when it denied appellant’s motion to strike as to the
possession of child pornography convictions based on evidence from the unallocated space on
the desktop and in the thumb cache on the laptop. Thus, the possession of child pornography
convictions that rely on evidence obtained from the unallocated space or the thumb cache are
reversed. The possession of child pornography conviction that relies on evidence found on the
desktop in the “collection” zip file downloaded using Shareaza is affirmed. We further hold that
the trial court did not err when it denied appellant’s motion to strike as to the distribution of child
pornography convictions. Thus, appellant’s distribution of child pornography convictions are
affirmed.
Affirmed in part, and reversed in part.
- 11 -