Establishing Knowing Possession of Child Pornography Through Cached Thumbnails and Circumstantial Evidence

1. Introduction

This commentary examines the Seventh Circuit’s decision in United States v. Edward C. Brown, Nos. 24-1581 & 24-1582 (7th Cir. May 5, 2025). Edward Brown, previously convicted of distribution and possession of child pornography, challenged the sufficiency of evidence for a new charge of possession after probation officers discovered an unreported flip phone containing 75 cached thumbnail images of child pornography. The key issues on appeal were:

Whether “knowing possession” under 18 U.S.C. §2252A(a)(5)(B) extends to images stored in an inaccessible cache;
The permissible variance between the indictment date (“on or about April 13, 2023”) and the actual time when the underlying material was acquired or viewed;
The sufficiency of circumstantial evidence (prior convictions, interview admissions, concealment of the phone) to establish knowledge and possession beyond a reasonable doubt.

2. Summary of the Judgment

By a unanimous panel (Judge Kolar writing, joined by Judges Ripple and Brennan), the Seventh Circuit affirmed Brown’s conviction. The court held that:

Inaccessible cached thumbnails are not standalone “possession” on the date of seizure, but they serve as reliable evidence of earlier knowing possession of identical full-size child pornography files.
An indictment alleging “on or about” a date tolerates a reasonable variance when the timing of file creation is unclear and the defendant lacked prejudice from the variance.
Circumstantial evidence—75 thumbnails, November 2022 cache activity suggestive of child pornography, Brown’s prior offenses under Fed. R. Evid. 414, his admissions in interview, and concealment of the phone—collectively supported a rational jury’s finding of knowing possession beyond a reasonable doubt.

3. Analysis

3.1 Precedents Cited

United States v. Seiver, 692 F.3d 774 (7th Cir. 2012) – Held that deleted files inaccessible through a user interface are not “possessed” absent access capability; emphasized that recovered data shows prior possession.
United States v. Tucker, 305 F.3d 1193 (10th Cir. 2002) – Defined “possession” as control over material; held cache-only files outside “control” without special software.
United States v. Moreland, 665 F.3d 137 (5th Cir. 2011) – Overturned conviction for images hidden in non-plain‐view areas without proof the defendant knew of or could access them.
United States v. Flyer, 633 F.3d 911 (9th Cir. 2011) – Reversed when no evidence showed defendant could recover or view images in unallocated space or knew of their presence.
United States v. Chaparro, 956 F.3d 462 (7th Cir. 2020) – Upheld conviction where phone search history and thumbnails bore timestamps and user linkage.

These decisions shaped the court’s threshold inquiry into whether files in a cache folder could be “possessed” and supported the view that, although inaccessible thumbnails are not current possession, they are strong proof of prior possession.

3.2 Legal Reasoning

The court’s reasoning can be broken down into three steps:

Defining “Possession” and the Role of Cached Thumbnails:
- The statute requires “knowing possession” of child pornography. Files permanently removed from a device’s accessible interface do not count as current possession unless the defendant retained software or knowledge to access them.
- Nonetheless, forensic recovery of thumbnails—derivatives of full-size images—proves those full-size images existed on the device at a time when they were accessible, thereby establishing prior knowing possession within the statute’s timeframe.
Timing and “On or About” Allegations:
- An indictment specifying “on or about” accommodates reasonable discrepancies between the charged date and actual conduct.
- Here, Brown’s acquisition of the phone (June 2022), the November 2022 activity, and the April 2023 seizure were all within a nine-month window—deemed acceptable absent prejudice to Brown.
Circumstantial Evidence of Knowledge:
- Prior convictions under Fed. R. Evid. 414 demonstrated Brown’s longstanding sexual interest in child pornography and propensity to view it.
- Brown’s recorded admissions suggested he remained interested in “looking at a few pictures” and understood how images could reside in “shadow memory.”
- Brown’s concealment of the unreported phone from probation, despite its innocuous appearance, indicated an intent to hide the device used to view illicit material.

Viewed in the light most favorable to the government, these factors created a cohesive narrative permitting a rational jury to find Brown guilty beyond reasonable doubt.

3.3 Impact on Future Cases

Confirms that inaccessible cached files, while not current possession per se, furnish powerful circumstantial evidence of past possession.
Affirms a flexible approach to “on or about” dates in digital evidence cases, so long as the variance is reasonable and non-prejudicial.
Reinforces the admissibility and weight of propensity evidence under Rule 414 when digital forensic gaps exist.
Warns defendants that concealing devices and possessing technical knowledge may be construed as consciousness of guilt.

4. Complex Concepts Simplified

Cache Folder & Thumbnails: A phone’s cache temporarily stores low-resolution “thumbnail” images to speed up browsing. Even if the user deletes full files, thumbnails may remain hidden from normal view but retrievable by forensic tools.
Metadata: Digital stamps (e.g., creation, access times) embedded in image files. Their absence complicates pinpointing when files were viewed or added.
“Knowing Possession”: Statutory requirement that the defendant both had control of the device and was aware it contained illicit images.
Fed. R. Evid. 414: Allows evidence of prior child-pornography offenses to prove a defendant’s propensity and knowledge in a new child-pornography prosecution.
“On or About”: A charge that covers a reasonable time frame around the specified date, acknowledging forensic imprecision in digital-evidence cases.

5. Conclusion

United States v. Brown crystallizes the principle that forensic recovery of cached thumbnails can establish prior knowing possession of child pornography, even when those thumbnails are inaccessible via the device’s normal interface. It balances the protections against overbroad “possession” theories with the realities of digital forensics and reaffirms the power of circumstantial evidence—prior convictions, admissions, concealment—to fill gaps left by missing metadata. Moving forward, prosecutors and defense counsel alike must account for the evidentiary weight of hidden thumbnails, the scope of “on or about” allegations, and the admissibility of propensity evidence when constructing or challenging child-pornography cases.