In a lengthy cross-examination, Duggar attorney Justin Gelfand combed through a forensic analyst's findings that repeatedly linked the former reality star to illegal material on his work computer
When is a login screen not just a login screen?
When is a router a clue to a crime?
Where is the thumb drive that someone plugged into the work computer at Josh Duggar's car lot in 2019 shortly before someone — someone else? the same person? — installed a separate, password-protected operating system to hide evidence of child sexual abuse material that ultimately put the former 19 Kids and Counting star, 33, on trial in federal court in Arkansas?
And what about that other iPhone, not Duggar's, that was at his work when the search warrant was executed but never seized?
These were some of the questions, theories and suggestions Duggar's defense raised Friday in day four of his trial on knowing receipt and possession of child pornography. This occurred as the prosecution's key witness — James Fottrell, a top computer forensic analyst at the Department of Justice who examined Duggar's devices — made his case, outlining extensive time-and-place links between Duggar and the downloading and viewing of child pornography at his work.
While Duggar has not yet presented his defense (the prosecution is likely to rest on Monday), his attorneys have homed in on two main arguments in the course of their cross-examinations:
RELATED: Prosecution Gets Heated Questioning Josh Duggar Relative and Colleague — 'You Were Hiding Something'
Someone else had physical access to the office computer at the car lot where there was a keypad-locked door but police, in their haste and narrow-mindedness, missed that; or the machine was remotely accessed via a vulnerable network — but investigators weren't curious enough to go looking, including by examining Duggar's work router.
Nowhere was this strategy more clear so far than on Friday, as Justin Gelfand, a noted former federal prosecutor whom Duggar hired earlier this year, combed back through Fottrell's testimony to prosecutors.
Gelfand — with a habit of exhaustively reiterating, underlining and dissecting facts and analysis submitted in the prosecution's case — most of all wanted Fottrell to explain what he had and had not done in his examination; what he did and did not know conclusively, linked to direct evidence; and what he could and could not rule out.
"I don't want you to guess," Gelfand repeatedly admonished Fottrell, the director of the DOJ's High Technology Investigative Unit.
Want to keep up with the latest crime coverage? Sign up for PEOPLE's free True Crime newsletter for breaking crime news, ongoing trial coverage and details of intriguing unsolved cases.
"Details matter," Gelfand likes to say in court (Also: "Let's get our bearings" and "let's be crystal clear" and "let me get this straight for a second"). The defense is expected to call a forensic expert of their own to show that "the equivalent of a trail of blood … does not lead to Josh Duggar," Gelfand said in his opening argument.
Fottrell, for his part, acceded little on the stand on Friday during a roughly four-hour cross-examination.
No, he didn't think the USB that was plugged into Duggar's computer the day the Linux partition was created — which has not been located and which contained two word documents and a slide presentation — was ultimately relevant in a trial about child sexual abuse material found on the Linux side of the office computer.
No, he didn't think that because there was a Covenant Eyes login prompt on the desktop, if a user clicked the icon, that it meant the program could simply be turned off. The program auto-runs when the Windows side is logged-on, he said (Covenant Eyes, an accountability program on Duggar's devices, bolsters the prosecution's argument that the Linux partition was in part to evade monitoring of objectionable content).
No, Fottrell did not think the router in the office — which was never seized or examined — contained valuable, unknown evidence. And no, he didn't think there was a pattern of remote access for the office computer. It was possible, yes, "But I just don't see evidence of that."
If someone remotely accessed the machine, their activity would still be viewable on the monitor, Fottrell said — such as the mouse movements and keystrokes, or when switching from the Windows side of the machine with all of its business records and important work-related programs to a totally separate operating system with a different login screen and password. And when the illicit photos and videos were viewed, they were visible on the monitor in the office regardless if someone was accessing them remotely. People at the car lot, in the office, would have seen.
RELATED: Josh Duggar Child Porn Trial: Every Close Duggar Family Member Who Has Attended So Far
Fottrell acknowledged this: Neither he nor the federal agents had "perfect information" from which to draw conclusions or to "answer every possibility."
Files can be deleted. Hard drives can be perfectly wiped. iPhones can be locked.
But, Fottrell said, "We have lots of good evidence." Despite indications that the machine had been cleaned of the child sexual abuse material — for example, no video files were recovered in full — Fottrell said cached data and thumbnails auto-created when files are downloaded and accessed showed that the illegal photos and videos had once existed. It was "forensically challenging," he said. But not impossible. He likened the case to the "Netflix effect" of recent years.
"Some offenders understand it's dangerous to possess the material of this nature so they download it, view it and then delete it," versus amassing a library. And, he said, he had found full-sized originals of one lewd collection of images in a part of the hard drive that retains deleted files.
"We are doing the best we can," Fottrell explained.
RELATED VIDEO: Audio Revealed from When Josh Duggar Learned He Was Being Investigated for Child Pornography
"In every case, there's always more analysis you could do … it's certainly not perfect, it's certainly not exhaustive," Fottrell said.
"I would love to say I have five years to work on this case," he said, later adding, "I'm trying to efficiently work on as many cases as I can."
Still, appropriate analysis was done here, Fottrell testified — having already walked through dozens of exhibits (screenshots and spreadsheets from his forensic examination) under questioning by prosecutors that showed evidence that the sexual abuse material was downloaded and viewed on the computer in May 2019.
What's more, Fottrell told prosecutor William Clayman a backup of an iPhone 8 that was found on Duggar's personal MacBook contained timestamped text messages and photos with geolocation data that put him at or near the car lot repeatedly over four days in May 2019 when either the child pornography was accessed or the password-protected Linux partition and related programs were setup.
In one example, Fottrell said, Duggar's phone was used to take a photo of a sticky note at the car lot — apparently on a desk — two minutes after evidence was created that the video file "pedomom" was accessed on the office computer.
RELATED: Audio Revealed from When Josh Duggar Learned He Was Being Investigated for Child Pornography
The defense has continually suggested a handful of individuals who had access to the car lot, including an ex-employee, were the real perpetrators, though the prosecution says records show Duggar was the only employee at the lot that May.
Three of these men are on a list of potential witnesses but have not yet testified. Jeff Pryor, one of the Homeland Security agents who executed the search warrant at the car lot, said on the stand Thursday that as to the question of other devices on the property that day, "Not seized means cleared."
Pryor and other prosecution witnesses, including Fottrell, have explained that agents and analysts on a scene use their judgment and can manually screen certain devices, choosing not to seize them if no red flags are found (Gelfand noted in his questioning these manual examinations can miss things).
Fottrell wasn't present at the 2019 search of the car lot but said on the stand Friday that generally, "We're trying to have sensitivity."
"We don't want to seize the paint off the walls," he said. "We're trying to find where the critical evidence is." In a family residence, as an example, agents would screen a child's computer at the scene before presumptively seizing it to minimize their intrusion.
At Duggar's car lot, Fottrell said, agents had some preliminary indication they were looking for a Windows computer. And then they saw his HP work desktop.
"We're not on a wild goose chase," he said.
Gelfand pounced on one mistake during his cross of Fottrell on Friday.
Fottrell initially testified, repeatedly, that he didn't connect to the Internet or make any notable software changes while he was using a visualization tool to help show Duggar's work computer hard drive to the jury (the tool recreates both the Windows and Linux desktops). But Gelfand pointed out that the μTorrent program, which was used to access some of the sexual abuse material, had been updated on the Linux side of the computer. Fottrell noted that "does not make sense to me" and "would be significant" to him, but also stressed that the visualization tool didn't alter any of the underlying forensic analysis of the hard drive itself. Still, argued Gelfand, "Something had happened to the evidence you can't explain."
Under re-direct by prosecutors, Fottrell then said he remembered briefly connecting to the Internet to help him install the visualization tool on the hard drive copy provided by investigators.
RELATED: Prosecution Expert in Josh Duggar Trial Details What He Saw on Office Computer at Center of the Case
"I made a mistake, I forgot," he then told Gelfand, who hammered the inconsistency.
Elsewhere, Gelfand prodded at the limits of what Fottrell knew, such as how certain programs like the anonymous Tor browser were installed on the Linux side of Duggar's work computer — or whether any of the illicit videos were being accessed by users elsewhere while they were being played on the machine. Without signs of a previous installer or manual coding, Fottrell said the "totality" of the evidence led him to conclude that the simplest, direct solutions were correct: Duggar had used an application store program pre-loaded on Linux to download other software and that it seemed perplexing for someone to remotely access his computer to stream a video — "very inefficient" versus that other person just directly accessing the video online themselves.
"Can you rule out a possibility that the files were streamed from this HP computer to another device?" Gelfand asked.
No, Fottrell said, not conclusively.
In some parts of his analysis related to how the computer was used versus what content was accessed, "I know what is likely but I don't know what is certain," he shared.
He grew seemingly impatient under this line of inquiry and at several points he and Gelfand were instructed by Judge Timothy Brooks not to talk over one another, to aid the court reporter.
Gelfand, his hands tap-tap-tapping on the lectern, highlighted the loose end of the thumb drive that was plugged in and used shortly before the Linux partition was created on the work computer.
He also said that the same password used on the Linux partition, which Fottrell found via records on Duggar's personal computer was "ubiquitously used" by Duggar for other accounts, was also fairly widely shared by Duggar with other people over the years (in re-direct, Fottrell told prosecutors there was no evidence found on the devices of anyone else mentioning they were using that password, however).
Perhaps, Gelfand also wondered, Fottrell had made another error in relying on readily available time-and-place metadata from the photos on Duggar's iPhone backup rather than forensically extracting them with a specialized tool that Fottrell decided not to use.
When Fottrell said one photo was taken at Duggar's Wholesale Motors, maybe it was actually taken at his other car lot, Champion? Maybe the times were converted wrong?
With his re-direct, prosecutor Clayman referred back to certain photos that seemed definitive as to their time and location. One key selfie was of Duggar at Wholesale, in front of the office, on the same day a sales document was created on the Linux side of his computer with his first name on it.
The metadata said the work selfie was taken at 4:47 p.m. A clock was visible on the office behind Duggar. It read 4:51 p.m.
Duggar's trial continues Monday.