for my part, and it is ONLY a guess. but i'm thinking that there is something or a specified title that is found by the FBI to have CP. they then take over that file and attach 'trap' of some sort. when it is downloaded it alerts them. then if it is opened it alerts again. it doesn't matter if you delete the file or not. and it does not matter if you did it by accident either, they could care less. as far as they are concerned once you open that file you ARE guilt. if you find a questionable file or a file of CP i hope to goodness you know someone who is really good with computers and knows what they are doing to totally wipe your hard drive clean.

and that's only the random ones that they find. then you have the lovely and or so honorable FBI creating their own files of complied CP pics and putting them on sites of known CP downloaders or known CP sites.

the laptop that i was using at the time all our mess started shit the bed on me so i had to get a new one. when they came for my laptop they took the new one to check out not the old one. i have since had a friend who is experienced, repair and 'just in case', wipe my hard drive clean.

it's funny. i got the old laptop back this last summer but have yet to open and use it. i know it's clean, i trust the friend to have totally wiped it clean. but i still get the willies at the thought of using it. : /

EchoMoon,
OK, so your saying that even if you use a D.O.D./Grunman shredder (delete file) that it is still on your hard drive. and the only sure way to kill the file is to re-format the HD?

I would think that in court, if you dl a "Specific" file that did not have some type of CP knowledge it would be shown that the person was not trying to obtain/access to CP. I would think that it is/was entrapment if the FBI placed a file with false discription of content that a user would dl not knowing the true file to be CP.

I have dl files that my anti-virus saw was questionable (A pop-up comes up stating it STOPPED the dl) and that worries me. How can they prove without a shadow of doubt that the user was "knowingly" dl CP, if the file they dl was not titled in a CP way, such as - LolitaPlaysWithDaddy (dot) Whatever - etc.... If a person downloaded a file that said - HowToMakeMoneyInThreeDays (dot) whatever - how would they know they were knowingly downloading CP. I think it has to have something that points to the file that a person is DLing to show (know) that it contains CP.

Makes me think of the StarWars movie (Return of the Jedi) when The fish-head says.. It's A Trap!
I get the willies too just thinking about all the files I have DL that might have hidden CP on it and I don't even know it.....................

Thank You!

Anyone else wanna add their 2 cents? Let me hear!

The owners of the websites usually have immunity as long as they are willing to work with authorities. Google made a big deal a few months ago about trying to remove CP from searches, the 2 billionaires that own google aren't going to prison.
If someone is charged with possession and wants to try to go to trial, it's possible they win...but the risk of losing is usually too large a gamble. When someone pleads guilty, the prosecution doesn't have to prove anything.
To me if someone has under a million illegal pics, I would believe it was accidental, bc if someone wanted to download something illegal it would take about a day to find a million pics.

Mr. Martin,

Please allow me to help you guys out here.

You asked, "OK, so your saying that even if you use a D.O.D./Grunman shredder (delete file) that it is still on your hard drive. and the only sure way to kill the file is to re-format the HD?

You can never really "delete" a file on your hard drive. Once it is on the hard drive, it is there BUT you can overwrite that file by putting random data on top of it where the file was. In other words, you cannot really "erase" a file on your hard drive, but data can be placed over the file after you delete it to cover the file up. You can also "shred" a file by doing the same thing.

Here is an example. Say you have a new house. Your grandchild is playing with a crayon and wrote a few letters on the wall. One way to get rid of this "mark" is to paint over it. You have "overwritten" the crayon mark. It can now not be seen.

In each instance, if done correctly, the file cannot be recovered; it has been overwritten by another file or date.

The DOD or Gutman method just describes how many times that file is written over. The DOD method is the Department of Defense method and it wipes the entire drive with random data three times. The Gutman method does the same thing, but it does it 35 times. Theoretically, you only have to overwrite a file one time to make it unrecoverable, but many people wipe it several times. The Gutman method is overkill.

Both methods make any previous files unrecoverable by any software or hardware method although who knows what the NSA can actually do. But for the FBI and other law enforcement wiping the drive three times certainly makes any PREVIOUSLY DELETED files unrecoverable.

If you want to be 100% sure that nothing can ever be recovered from the drive, the only way to do that is to destroy the drive. Take the drive out, beat the platters to death with a large hammer, then throw the pieces in different places.

Reformatting the hard drive does not do a thing. With software, any law enforcement agency can recover data from a drive that has been formatted. The reason is that the format procedure does not overwrite any of the drives contents at all. It only fixes it so that the operating system can no longer "see" the files, but the files are still there and can be recovered as long as they have not been overwritten by another file.

It is always possible to accidentally download CP, but I am not sure what people are talking about when they say a CP file was "attached" to a music file? Do you mean when you download the music file, the CP files comes with it? I have never heard of anything like that.

CP files can be in a zip or rar archive and when you unzip the file, the CP will be there, but I wish someone would explain to me how you download a music file and the CP file comes with it.

Please, someone tell me how that happens?

I know when using P2P programs that someone can do a mass download and not pay attention to each and every file in that download; a CP file can then come with the mass download.

I also understand that files on a P2P network can be misnamed. For example, you might download a file that has the name "Goldilocks and the Three Bears," but when you open it, you see a file that is CP.

But I don't understand this "file attached to a music file" concept.

Law enforcement does not even pay any attention to the actual name of the file. Each file has a unique "hash value," which is just a long numeric value. They identify the file by comparing the hash value with the hash values of known CP files. In the previous example, "Goldilocks and the Three Bears," and the CP file might have different names, but the hash value is identical, since both are the same file. One is just renamed and renaming a file does not change its hash value.

The hash value they compare it to are the hash values of known CP that has been recovered from other peoples' drives over the years in CP investigations. The FBI no doubt has the biggest CP collection in the world, as they have the file---and thus the hash value---of every CP file they have ever confiscated. Of course, any new CP being made would have a different hash value and could not be traced until the FBI found that file and could determine its hash value, which would give them a hash value to compare it with.

Unfortunately, the FBI or law enforcement does not care how you received the file, only that you now have it. There are exceptions to this as when a virus is the cause of the CP being downloaded, but generally you cannot use the defense "I did not know it was CP" as a viable defense in a CP case. If it is on your hard drive, you certainly have possession of it and that is all they really care about.

Mr. Martin said, " I get the willies too just thinking about all the files I have DL that might have hidden CP on it and I don't even know it.....................

I just don't know how someone downloads a file and it has "CP on it." I don't understand what anyone is talking about when they say that.

I hope this clarifies things.

rewdiazepam

I just do not think any file has some kind of magic "attachment" to it where CP is downloaded when the music file is downloaded.

Nor do I believe that the FBI "plants" CP somewhere on the Internet. I may have read about it once, but I don't remember if I did.

The authorities have been know to take over a known CP website and leave it running for several weeks in an attempt to determine who visited that web site, but they are using CP already on the site and not "planting" anything.

I wish someone--ANYONE---would give me a link where the FBI actually planted CP somewhere. Also, please give me the link where a CP somehow "attaches" itself to a music file and when the music file is downloaded, the CP comes with it. I would like to see a verifiable link, and not some rumor.

rewdiazepam

Mr Rew,
I agree with you 100% and thank you for clearing up the DOD/Gutman shredder thing...

I am at a loss too when it comes to those who are saying, (someone) Downloaded a music file opened it and it was CP. Only audio files can have music on them, and I understand that some people don't know what a mp3/wav/flac extension file is, but if someone dl a zip/rar file and opened it and it had CP on it and they did NOT knowingly know it was a CP file I think they should not be prosecuted.

I am not bad mouthing anyone here let me first and foremost say that, I am just confused as to how someone downloads a file that is stated to be music and ends up being CP

A person can download what they thought was a music file, with an mp3 extension and the with name of a popular song, but it could actually be CP in that the file was misnamed. The person downloads the misnamed file and a picture of a child being abused is the result when the file is opened.

A computer savvy person can look at the file's extension and see that a music file has a mp3 extension. CP can be a video file with an AVI, MPG, or WMV extension, but not a mp3 extension. And an image file can be a JPEG, JPG, TIFF, or a bitmap file.

But even that is not ironclad in that a CP file might be misnamed with the wrong file extension. The three lettered file extension after the period on a file's name just tells Windows which program to use when opening that file, but anyone can change the file extension.

A computer savvy person can look at the size of the file to get a better indication of the type of file it is. A normal mp3 file will be something like only a few megabytes in size while an image file would usually be smaller and a movie file much larger in size. So if a person download a 200 megabyte file with an mp3 extension, something is wrong. Also if someone downloads a 200 megabyte photo file with an image extension, then something is amiss.

Unless someone on here can give me a link---a link to a credible source---a music file and a CP file just don't "attach" to each other although they can be in a zip or rar archive with several other files.

Using the "attached" theory, a CP file would have to somehow piggyback on an mp3 music file and I don't think that is possible.

rewdiazepam

Rew,

What people are talking about when they mention CP being attached to a music file is the CP image(s) are tagged as the album cover art and come with the song or album that was downloaded.

Rew is right on with his info.

If you ever find anything like that on your computer , take it outside, smash it to bits and throw it in trash.

My son is a musician. He downloaded over 2300 music videos and there were 3 cp downloaded by accident..
I've done a lot of research on it and I have yet to see an attachment on a music video like that. From what I've looked into here's how they find cp on p2p.
They have software that snakes thru the internet, thru p2p applications and it has a list of 'code' that they search for. If their software finds a snippet of that code, then they go in for the kill.

Chances are the cp was just a separate bit and came in on the search. That's what happened to my son.

I never open an attachment, even if it's from someone I know. It's just not worth taking the chance.

i sure am glad that computer savvy jumped in here!!!

got to thinking, computer savvy. that sure the heck leaves me out!!!

i use to download music a lot.... the things could have had the code for anything under the sun and i wouldn't have realized it. it could have been labeled 10 bites or 10 mega bites and i wouldn't have known any better.

it goes without saying that there are a lot of us computer dummies out here!!! : ) i joke when i say that it still amazes me that i can have and email acct and that i have figured out how to use it. ahhh? well for the most part i have my email figured out....

Hi everybody. Rew, thanks for explaining everything the way you did. Very good job.
The way a lot of graphics files (JPG, etc) are tracked has to do with a number called a "hash value". This little bit of information remains even if the file is compressed, renamed or incorporated as an "easter egg" inside of another file. The hash value is the easiest way to verify files against a list of "known CP". It still takes a while, but the forensic software that does this is very advanced.

The other aspect of JPG and other image files is that nude or mostly nude files are determined by the percentage of skin tone (regardless of color) vs. clothing. The forensic software has a formula that looks at percentage of skin and flags everything with a minimum percentage.

On side note, an "easter egg" is when you have MP3 or other files that are larger than they are supposed to be, and the extra size is from compressed graphics files. (the graphics files are the "easter egg"). Let's put aside the "easter egg" stuff aside. It is not hugely relevant in my experience. I only mentioned this because that is the proper term when files exist with extra code incorporated. I do not want anyone to get freaked out or sidetracked by this, so my apologies in advance.

I never used LimeWire or other music sharing. I stay away from that out of natural paranoia from being in the IT field. If I have an music, I paid for it.

Rew, you are correct that a traditional disk format does not wipe a hard drive. Forensic reconstruction of hard drives took off after 9/11. There are ways to format a hard drive at the hardware level that can destroy more information, but it is a technically advanced process. The best thing is to destroy the drive physically.

Many laptop drives with "traditional" hard disks have the internal disks made of glass. They are really easy to destroy. Desktop PCs have larger hard drives and the internals are generally metal.

I am going to sound stupid, but I am still hung up on this file being attached situation. In all the child porn investigations I have ever read about I have never heard of this.

So, is it a case where someone downloads a mp3 file and there is a CP image file attached? If so, who attached it to the mp3 file? And how is it attached?

Is it one file or two?

So, is the mp3 file downloaded and it separates into two files at some point?

So, if the mp3 is oversized---as in the Easter egg example--- as Brain said, when downloaded does it look like an image file or play like an mp3 file?

So, if you download an mp3 file, are images somehow created on the drive also? Who puts the CP images on the mp3 files? How do the CP images get on the drive?

Or once an infected mp3 file is downloaded, does another file come down from the internet?

The government surely does not plant CP with mp3s somehow. In most investigations I have ever read about, the government is not allowed to plant CP anywhere, even in a "honeypot" type situation, so I am at a loss how the CP image file gets on the hard drive.

Not questioning anybody here, but just not clear on this.

rewdiazepam

Here is something that really bothers me. Say this "easter egg" is attached to a file that is a mp3 or avi/mpg and John Doe downloads a music mp3 or even a rar file from a p2p site and this file has a hidden easter egg that a person must extract somehow to open it (or as stated was tagged as a .jpg song cover). Now, lets say John Doe downloads another file and the file (description) is a music video called I Wanna Rock by various artist... so, John Doe downloads iwannarock.avi but in reality it is a CP video that someone created as a hidden CP video, How does the FBI or any other law enforcement connect that John Doe is "knowingly" downloading CP because John might in truth be thinking he is downloading a rock video that he saw in the description. Then when John Doe sees that the file is actually a CP video and deletes it, even with Gutman shredder, it is still written on the hard drive. That is SUPER SCARY!

Mr. Martin,

The government generally does not care HOW the CP file got there, only that it is there. From that, they can file CP possession charges.

A defendant has to spend a lot of money to ever convince the government that he did not download the file on purpose---and then in only certain circumstances such as a malware infection. You might have to hire a forensic computer person to prove you did not even look at the file, but even that makes little difference to a prosecutor.

If you decide to go to trial, you can be sure that the prosecutor will find a way to get some of those CP images admitted as evidence and you can be equally sure that he finds a way to show the jury some of those CP images. From that point emotionalism takes over and the defendant is a dead duck. The sight of a two year old being raped is just too much overload for the jury and they will convict on pure emotion.

These government people are not nice people. They are ruthless.

It doesn't matter if you delete the file after you saw what it was. You still had possession of said CP file.

rewdiazepam