[2026] SADC 19

Accused: W, S Counsel: MS H HANNAFORD GUNN - Solicitor: LEGAL SERVICES COMMISSION (SA) Prosecution: R Counsel: MR J POWELL - Solicitor: DIRECTOR OF PUBLIC PROSECUTIONS Hearing Date/s: 17/02/2026, 18/02/2026 File No/s: DCCRM-23-011068 B DISTRICT COURT OF SOUTH AUSTRALIA (Criminal) DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment. The onus remains on any person using material in the judgment to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court in which it was generated. R v W, S [2026] SADC 19 Reasons for the Verdicts of her Honour Judge Fuller 4 March 2026 CRIMINAL LAW - PARTICULAR OFFENCES - CHILD PORNOGRAPHY AND CHILD EXPLOITATION MATERIAL OFFENCES - AGGRAVATED Accused charged with one count of aggravated possession of child exploitation material, one count of aggravated obtaining access to child exploitation material and one count of aggravated obtaining access to child pornography – on 28 February 2022 police searched accused’s home where he was living with his wife and two sons aged 19 and 14 – desktop computer found in living room of house on desk and laptop found in wire basket in internal garage – data extracted from desktop computer and laptop and analysed by digital evidence expert employed by SAPOL – 675 thumbnail images of CEM found in folder on desktop computer – thumbnail images had file path which included accused’s name and were generated on 25 and 26 February 2022 as a result of the user of the desktop computer scrolling through the corresponding original images in an encrypted container called TrueCrypt – police unable to access encrypted folder – 238 thumbnail images of child pornography found in folder in a virtual machine on laptop – thumbnail images had file path which included accused’s name and were generated on 26 October 2013 as a result of the user accessing the original images on a remote device by double clicking them or scrolling through them in encrypted containers called TrueCrypt – accused’s first name was user account for desktop computer and laptop – accused’s mobile telephone seized from him on 1 April 2022 – 18 thumbnail images (8 of which were duplicates) found in cache folder – images were still images from CCTV footage recorded in 2021 of a courtyard area in an Adelaide college at which accused had been employed– images showed children under the age of 14 in school uniform – one of the female children wearing a uniform dress was performing a cartwheel in each of the images – child’s underwear and legs visible in still images as cartwheel performed – images alleged to be child exploitation material – expert evidence that thumbnail images in mobile phone automatically generated and inaccessible to accused without forensic software – expert conceded that it was possible that the thumbnail images could have populated in cache folder without any interaction by the user with the original images – prosecution did not allege accused produced the images but alleged that person who produced the images did so intending to gratify or excite sexual interest. Held: Evidence on charges of obtaining access to CEM/child pornography cross-admissible given similarities in username, file path locations and mechanism of access to CEM/child pornography but probative weight low given passage of time between each access on each device and possibility of access by other persons - only one user account for desktop computer and password was eldest son’s -- 1 of 43 -- name plus the numeral 2 – password unchanged since 2018 - no direct evidence of location of laptop or persons with access to it in 2013 – no statements taken from other members of household present on 28 February 2022 – no evidence of examination of other devices in household - evidence not capable of establishing exclusive use of either device by accused – evidence did not exclude reasonable possibility of other persons having access to desktop computer or laptop and knowledge of username and/or password. Images on mobile phone were not pornographic in nature – prosecution has not proved that images were intended or apparently intended to excite or gratify sexual interest – production of CCTV footage (and still images) was for security purposes - exposure of underwear natural incident of performance of cartwheel – child’s bottom and genitals not visible – even if images constituted CEM – possession has not been proved beyond reasonable doubt. On the charge of obtaining access to CEM and the charge of obtaining access to child pornography – prosecution has not excluded reasonable possibility of access being obtained to CEM/child pornography by person other than accused. Verdicts: Not guilty on all counts. Criminal Law Consolidation Act 1935 (SA) s 62, s 63A(1)(b), s 63C(1); Juries Act 1927 (SA) s 7; Evidence Act 1929 (SA) s 34P(1)(a), s 34P(2)(b), referred to. R v Morcom 122 SASR 154; He Kaw Teh (1985) 157 CLR 523; Tabe v The Queen (2005) 225 CLR 418; Sabourne v Western Australia [2010] WASCA 242; F, BV v Magistrates Court (2013) 115 SASR 232; R v Keyte (2000) 78 SASR 68; Douglass v The Queen (2012) 86 ALJR 1086; AK v The State of Western Australia (2008) 232 CLR 438; R v G [2015] SASC 186; R v Morcom (2015) 122 SASR 154; R v Finnigan (No 3) [2015] SADC 166; R v Porter [2007] 2 All ER 625; R v CJN (2013) 117 SASR 81, applied. -- 2 of 43 -- R v W, S [2026] SADC 19 Criminal The charges 1 The accused, SW, is charged on Information with the following offences: Count One: Offence Details: Aggravated Possessing Child Exploitation Material. (Section 63A(1)(a) of the Criminal Law Consolidation Act, 1935). Particulars [SW] on the 1st day of April 2022 at Onkaparinga Hills, possessed child exploitation material, knowing of its pornographic nature. Circumstances of aggravation It is further alleged that [SW] committed the offence knowing that the child depicted in the child exploitation material was under the age of 14 years. Count Two: Offence Details: Aggravated Obtaining Access to Child Exploitation Material. (Section 63A(1)(b) of the Criminal Law Consolidation Act, 1935). Particulars [SW] on or around 25 February 2022 at Onkaparinga Hills, obtained access to child exploitation material or took a step towards obtaining access to child exploitation material, intending to obtain access to child exploitation material. Circumstances of aggravation It is further alleged that [SW] committed the offence knowing that the child depicted in the child exploitation material was under the age of 14 years. Count Three: Offence Details: Aggravated Obtaining Access to Child Pornography. (Ibid). Particulars [SW] on or around 26 October 2013 at Onkaparinga Hills, obtained access to child pornography or took a step towards obtaining access to child pornography, intending to obtain access to child pornography. -- 3 of 43 -- [2026] SADC 19 2 Circumstances of aggravation It is further alleged that [SW] committed the offence knowing that the child depicted in the child pornography was under the age of 14 years. The plea 2 The accused pleaded not guilty and elected for trial by Judge alone. I heard the trial without a jury. I now publish my reasons for the verdicts I am about to deliver. Elements of the offence of aggravated possessing child exploitation material 3 This offence consists of the following elements which the prosecution must prove beyond reasonable doubt: 1. The accused has possession of material. 2. The material is child exploitation material, other than a child-like sex doll. 3. The accused knew the material is pornographic in nature. 4. The accused knew that the child depicted in the child exploitation material was under the age of 14 years. 4 Possession requires proof that the accused knew of the existence of the material and intended to exercise custody or control over the material.1 Where child exploitation material is found on a device under the accused’s control, the prosecution may be able to prove possession by showing that the accused downloaded and viewed the material.2 5 ‘Material’ is defined in section 62 Criminal Law Consolidation Act 1935 (SA) (CLCA) to include any written or printed material. It includes files on a computer or in an electronic device such as a mobile telephone. Child exploitation material is defined in s 62 CLCA as meaning material: (a) – (i) that - (A) describes or depicts a child under, or apparently under, the age of 17 years engaging in sexual activity; or (B) consists of, or contains, the image or representation of (or what appears to be the image or representation of) a child under, or apparently under, the age of 17 years, or the bodily parts of such a child, or in the production of which such a child has been or appears to have been involved; or 1 R v Morcom (2015) 122 SASR 154; [80], [145]. See also He Kaw Teh (1985) 157 CLR 523; Tabe v The Queen (2005) 225 CLR 418. 2 R v Morcom (2015) 122 SASR 154, [146]; Sabourne v Western Australia [2010] WASCA 242, [29]. -- 4 of 43 -- [2026] SADC 19 3 (C) (without limiting subparagraph (B)) consists of, or contains, the image or representation of (or what appears to be the image or representation of) a child-like sex doll, or part of a child-like sex doll;3 and (ii) that is pornographic in nature; or (b) that is a child-like sex doll. 6 ‘Pornographic nature’ is defined in s 62 CLCA to mean: —material is of a pornographic nature for the purposes of this Division if the material is intended or apparently intended— (a) to excite or gratify sexual interest; or (b) to excite or gratify a sadistic or other perverted interest in violence or cruelty. 7 When deciding whether material is ‘of a pornographic nature’, the trier of fact can take into account the circumstances in which the material is produced, used or intended to be used. These considerations cannot, however, deprive material that is inherently pornographic of that character.4 8 In R v Morcom5, Peek and Blue JJ described the two limbs required to constitute child exploitation material as follows: • the physical characteristic of depicting a child engaging in sexual activity (or the image is, or appears to be, that of a child or bodily parts of a child); and • the functional or purposive characteristic of the material being intended or apparently intended to excite or gratify a sexual (or perverted violence or cruelty) interest. 9 As the offence is aggravated, the prosecution must prove that the accused knew that the child depicted in the material was under the age of 14 years. 10 This aggravating circumstance requires the trier of fact to consider the age of the child depicted in the child exploitation material at the time the material was originally produced. The trier of fact does not take into account any change in the child’s age between the production of the child exploitation material and the accused’s possession of the material.6 11 While the definition of child exploitation material contemplates the situation where an adult appears to be under 17, the aggravating circumstance of a child 3 For the purposes of count 3, the definition of child pornography in s 62 CLCA in October 2013 mirrored subsections (A) and (B) of s 62 CLCA in force in February 2022 but did not include subsection (C) or (b). 4 Criminal Law Consolidation Act 1935 (SA) s 63C(1). 5 R v Morcom (2015) 122 SASR 154, [17]. At the time, the Act used the language of “child pornography” rather than “child exploitation material”, but the applicable definitions were relevantly identical (subject to the references to child-like sex doll). 6 F, BV v Magistrates’ Court (2013) 115 SASR 232, [41], [60] (Kourakis CJ), [138] (Gray J). -- 5 of 43 -- [2026] SADC 19 4 being under the age of 14 depends solely on the actual age of the child and the higher penalty is not engaged where the victim merely appears to be under 14.7 Aggravated obtaining access to child exploitation material/child pornography 12 This offence in its current form and in its form in October 20138 consists of the following elements: • The accused obtains access to material; • The material is child pornography/child exploitation material, other than a child- like sex doll; • The accused intended to obtain access to child exploitation material/child pornography. • The child knew that the child depicted in the child exploitation material/child pornography was under the age of 14 years. 13 The offence of accessing child exploitation material/child pornography does not require the degree of control over the images which the offence of possessing child exploitation material/child pornography requires. It is sufficient for the person to view the material without having control over the medium on which the material is displayed.9 14 For this offence, the prosecution must prove that the accused intended to obtain access. Recklessness is not sufficient.10 15 The aggravating circumstance requires the trier of fact to consider the age of the child depicted in the child exploitation material/child pornography at the time the material was originally produced. The trier of fact does not take into account any change in the child’s age between the production of the child exploitation material/child pornography and the accused’s acts in accessing the material.11 16 While the definition of child exploitation material/child pornography contemplates the situation where an adult appears to be under 17, the aggravating circumstance of a child being under the age of 14 depends solely on the actual age of the child and the higher penalty is not engaged where the victim merely appears to be under 14.12 Issues in dispute 17 The issues in dispute on count 1 are as follows: 7 Ibid at [135]. 8 In 2013, the section referred to child pornography and not child exploitation material. 9 Ibid at [47]. 10 Ibid at [48]. 11 Ibid at [41], [60] (Kourakis CJ), [138] (Gray J). 12 Ibid at [135]. -- 6 of 43 -- [2026] SADC 19 5 1. Is the material pornographic in nature? 2. If so, was the accused in possession of that child exploitation material? 18 The issues in dispute on counts 2 and 3 are: 1. Was the accused the person who obtained access to the child exploitation material/child pornography? 2. If so, did he intend to obtain access to child exploitation material/child pornography? Overview of the prosecution case 19 On 28 February 2022 police attended the accused’s house in Onkaparinga Hills. They seized a Custom desktop computer and a HP ProBook laptop. The desktop computer was located on a small desk in the open kitchen and living space and the laptop in an enclosed garage space. 20 On 1 April 2022, police seized a Huawei branded mobile phone from the accused. 21 All three items were examined by personnel in the Digital Evidence Section of South Australia Police. 22 675 images of child exploitation material were found on the desktop computer. 238 images were found on the HP ProBook laptop. 18 images of child exploitation material were found on the mobile phone. 23 Count two relates to an occasion on 25 February 2022 when it was alleged that the accused logged on to the Custom desktop computer under the username Steve at about 11.45pm The computer had an operating system called Ubuntu Linux. At this time, the accused lived in the house with his wife and two teenage sons. 24 A feature of the Ubuntu Linux system is a file explorer called Gnome Nautilus which functions like other file explorers. At 11.46pm, it is alleged that the accused opened an encrypted file storage location on the computer called ‘TrueCrypt 1’. From 11.47pm on 25 February 2022 - 12.22am on 26 February 2022 the accused opened 675 files contained within four sub-folders of the TrueCrypt 1 location. The computer was shut down at 12.25am. 25 Count three relates to an occasion on 26 October 2013 when it is alleged that the accused logged on to the HP ProBook laptop under the username Steve. He then accessed a virtual machine called Debian 7 64-bit. Using that virtual machine, the accused accessed 238 images of child pornography. 26 In relation to count one, it is alleged that on 1 April 2022, there were 18 still images from CCTV footage of a paved play area at an Adelaide college on the accused’s mobile phone. In each of the images, there are a number of young girls playing in this area. Each girl was fully clothed in a school uniform dress and one -- 7 of 43 -- [2026] SADC 19 6 appeared to be performing a cartwheel during which her underwear is exposed. The images were contained within a file path location associated with a Microsoft One Drive account in an email address containing the accused’s surname and the initial of his first name and the name of the college. 27 The prosecution case is that the evidence on counts two and three is cross- admissible to rebut any innocent association with the devices or any innocent explanation for obtaining access to the material on each device. Further, if proved beyond reasonable doubt that the images on the mobile phone were child exploitation material, the evidence on counts two and three was cross-admissible on count one as circumstantial evidence relevant to the issue of possession and the accused’s knowledge that the material was pornographic. General directions 28 The accused elected for trial by Judge sitting without a jury pursuant to the provisions of section 7 of the Juries Act 1927 (SA). As Lovell J observed in R v G,13 whilst the Act is silent as to any requirement regarding the contents of the reasons for verdicts, such requirements are established in a number of authorities: see R v Keyte (2000) 78 SASR 68, Douglass v The Queen (2012) 86 ALJR 1086; and AK v The State of Western Australia (2008) 232 CLR 438 per Heydon J.14 29 The general directions were summarised by Lovell J in R v G. They are as follows: As the Judge of the facts and law, I must find the facts and draw the inferences from them as well as apply the law to the facts that I find. I must bring an open and unbiased mind to the evidence and view it clinically and dispassionately and not let emotion enter into the decision-making process. Both the prosecution and the accused are entitled to my verdict free of partiality or prejudice, favour or ill-will. I must then deliver my verdict according to the evidence. The prosecution bears the onus of proving the guilt of the accused at all times. The accused does not have to prove that he did not commit the offence as charged. The standard of proof of the prosecution case is proof beyond reasonable doubt and the accused cannot be found guilty of the offence unless the evidence, which I accept, satisfies me beyond reasonable doubt of his guilt. In the findings I make in these reasons, I make those findings beyond reasonable doubt unless I specify otherwise. The accused is presumed by law to be innocent of the offence unless and until the evidence I accept satisfies me that each and every element of the charge has been proved beyond reasonable doubt. I must determine whether each of the witnesses called are truthful and reliable, that is, whether I can rely on the evidence that the witness gives me and so find the facts about which the witness has given evidence. I can accept part of a witness’s evidence and reject part of that evidence or accept or reject it all. 13 R v G [2015] SASC 186. 14 Ibid at [61] – [116]. -- 8 of 43 -- [2026] SADC 19 7 If, however, the evidence which I accept fails to satisfy me beyond reasonable doubt, of any or all of the elements of the offence charged, then the accused remains presumed innocent and I must find a verdict of not guilty. The evidence Detective Brevet Sergeant Lucy Schiek 30 On 28 February 2022, Detective Schiek was stationed with the Joint Anti- Child Exploitation Team. She attended the accused’s home address in Onkaparinga Hills to conduct a search of the premises.15 Other officers present included Detective Brevet Sergeant O’Callaghan, Detective Brevet Sergeant Dalton, members of the AFP and two members from the Digital Evidence Section. The accused and his wife KW answered the knock on the door. Their two sons were present at the address. 16 31 Detective Schiek was the exhibits officer. During the search a Custom desktop computer was seized from a desk right next to the kitchen bench. A HP ProBook laptop was seized from a wire basket in the garage. Photographs of the interior of the house and the location where the two devices were seized were taken and tendered: Exhibit P1. A table describing the photographs was also tendered: Exhibit P2.17 32 A hard drive was found on the computer desk with the desktop computer and can be seen in photograph 1 of P1.18 A video recording was made of a walk-through of the premises: Exhibit P3. Cross-examination 33 Detective Schiek agreed that the accused’s home had three bedrooms and he and his wife appeared to occupy the master bedroom and their two sons occupied the remaining two bedrooms. The garage was physically accessible to anyone in the house.19 34 There were several electronic devices at the premises which were not seized. The hard drive on the desktop computer was not seized. A white tablet in a black case and an Apple iPad on the kitchen bench, together with a Motorola tablet were not seized.20 The investigating officer and the digital evidence section members guided her regarding what was and was not to be seized.21 35 Detective Schiek agreed that there was paperwork, a receipt and some medication or vitamin bottles on the desk where the Custom desktop computer was 15 T 21. 16 T 22. 17 T 23-25. 18 T 26. 19 T 31. 20 T 32. 21 T 33. -- 9 of 43 -- [2026] SADC 19 8 located. None of these items were seized.22 Detective Schiek said it was possible that hard drives in a plastic bag were located during the search but she could not recall any conversation between the accused and Detective O’Callaghan on this topic.23 Detective Jacob O'Callaghan 36 In February 2022, Detective O’Callaghan was stationed at the Joint Anti- Child Exploitation Team. He attended the search of the accused’s premises on 28 February 2022. He subsequently conducted an examination of the data obtained from the Custom desktop computer.24 He located 675 thumbnail images depicting child exploitation material. He then made that information available to a digital expert for analysis.25 37 Detective O’Callaghan examined the data from the HP ProBook laptop and located 238 thumbnail images depicting child exploitation material. He then made that data available to a digital expert for analysis.26 38 On 1 April 2022, Detective O’Callaghan seized a Huawei mobile phone from the accused. Upon analysing the data from that phone he identified 18 images of interest. There were other images on the device, but he could not say how many. Eight of the images of interest had the title ‘preview’ followed by a number and the remaining files had the title ‘smallscale’ and were smaller scale versions of the same images. A USB with the 18 images was tendered: Exhibit P4.27 39 Each image had a date and time stamped on it and the words ‘Junior School Lower’.28 Cross-examination 40 Detective O’Callaghan agreed that the titles of the images were either ‘preview.bin’ or ‘scaled small.bin’. He had to change the file type to JPG in order to view it and that resulted in a conversion from a .bin file to a JPG file.29 41 Detective O’Callaghan said it was still possible to zoom in on the 18 images on a mobile phone but the size of the screen limited the zoom capacity.30 42 Detective O’Callaghan said that he positively identified the location of the images as [redacted] College and he spoke to the head of learning in primary school and some of the students in the images were identified but not the student 22 T 33. 23 T 33-34. 24 T 37. 25 T 38. 26 T 38. 27 T 39-40. 28 T 43. 29 T 44. 30 T 45. -- 10 of 43 -- [2026] SADC 19 9 performing the cartwheel. His inquiries extended to the camera involved and who might have had access to the images.31 43 Detective O’Callaghan said that the kitchen dining area and garage were accessible to anyone in the house.32 44 Detective O'Callaghan agreed that when he attended the accused’s premises on 28 February 2022, the accused was the target.33 It became apparent that the accused’s wife and two sons lived at that address. He said it was his understanding that the electronic devices at the address were triaged by the digital evidence officers and he assumed there was ‘some sort of ruling out of devices’ done by them on site.34 45 Statements were never taken from anyone else living in the house.35 He assumed they were ruled out by the triaging process.36 46 Once they found child exploitation material, part of the focus was on connecting the accused to those devices at the relevant dates and times. The username ‘Steve’ suggested to him that it was the accused using that username.37 He considered the possibility of someone else using that username but he did not undertake any investigations to rule in or out other people using that username.38 47 Detective O’Callaghan agreed that he could not say whether anyone in the household was using any of the devices seized to access their social media or emails or personal documentation at the time the thumbnails were created.39 He agreed that the paperwork and vitamin/medication bottles on the desk with the Custom desktop computer were not seized.40 Nicholas DeGuglielmo 48 Mr DeGuglielmo is a digital evidence specialist working for South Australia Police. He had been performing that role for a year and in the three years prior to that he was a digital evidence support officer. He had a degree from the University of South Australia in Cybersecurity and Computer Networking. He had undertaken further training in his current role including Cellebrite Certified Operator training. Cellebrite is a forensic tool for extracting data from mobile devices. He also undertook XRY Certification training. XRY is another forensic tool for extracting data from mobile devices. The remaining courses that he undertook were the AX100 Forensic Fundamentals Training Course, Linux Fundamentals Training 31 T 46. 32 T 47. 33 T 47. 34 T 48-49. 35 T 48. 36 T 49. 37 T 49. 38 T 50. 39 T 50. 40 T 51. -- 11 of 43 -- [2026] SADC 19 10 Course, the Digital Evidence Investigator Course, Magnet Griffeye Analysis Course, Certified Ethical Handler Course, Certified Network Defender Course, and Certified Incident Handler Course. He had testified in the District Court on three prior occasions.41 49 Mr DeGuglielmo’s experience and training had given him the skills necessary to analyse and interpret data extracted from various electronic devices.42 Analysis of Custom desktop computer 50 Mr DeGuglielmo explained that a Custom desktop computer is a computer that does not come from a particular vendor, such as HP or Lenovo, but is something a user would put together from parts purchased at their local electronic store, including a processor, memory, storage and monitor. An operating system must be installed in order to use the computer and to create a user and log in.43 51 The Custom desktop computer seized by police had a Linux Ubuntu operating system on it.44 Linux Ubuntu has a graphical user interface, file explorer and an internet explorer plus additional tooling, services and software. The file explorer on this device was Gnome Nautilus which came with a Gnome Image Viewer. The viewer allows a user to open an image file which will render and display on the screen the contents of that image file.45 52 The Custom desktop computer had one user with the username Steve. The password was Jayden2.46 53 A series of screenshots of the Linux Ubuntu user interface were tendered: Exhibit P5. The first screenshot showed the desktop after the user had logged in. The second screenshot showed the application grid, which was pre-installed.47 54 Mr DeGuglielmo said that if the desktop computer was shut down, when it was powered up the user would need to log in again. However, it could be configured to dim and lock the account after a certain period of time or to never dim and lock. He could not recall how the Custom desktop computer was configured.48 55 The third screenshot in P5 showed the Gnome Nautilus file explorer and the navigation to a folder called thumbnails within the .cache folder.49 41 T 56-59. 42 T 59. Defence counsel confirmed that there was no challenge to Mr De Guglielmo’s expertise. 43 T 61-62. 44 T 62. 45 T 62-63. 46 T 64. 47 T 65-66. 48 T 66. 49 T 66. -- 12 of 43 -- [2026] SADC 19 11 Count 2 images 56 Mr DeGuglielmo’s analysis concentrated on the data associated with the 675 thumbnail style images that were categorised as child exploitation material.50 The file path location of the 675 thumbnail images was /home/Steve.cache/thumbnails/normal. Mr DeGuglielmo explained that ‘/normal’ is the location on a Linux operating system that stores all of the user folders. ‘/Steve’ is the user folder for the account Steve. ‘.cache’ is a common folder that a lot of application software use in Linux where they temporarily store and temporarily cache a range of data. 57 Thumbnails range in size and are generated with a file explorer. A thumbnail is a small preview of an image file, generally small in data size and small in visual content and size. The thumbnails are generated to enhance the user experience when using a digital device. ‘Normal’ is the folder that stores the thumbnails that are generated when opening them with the Gnome Image Viewer. The normal folder in which the images were located appears on the screenshot on page 3 of P5.51 58 Mr DeGuglielmo conducted an experiment in the Linux Ubuntu to determine how those thumbnails were generated in the normal folder. A screenshot of every step in that process was created: Exhibit P6. When the downloads folder containing images is opened up, thumbnails are generated in the large folder. The thumbnails are only generated in the large folder once when the folder is first opened with the files in it. On page 2 of P6 the five original images in the downloads folder populated in the large folder upon the downloads folder being opened. The images in the downloads folder had not been opened.52 59 The screenshot on page 3 of P6 shows the first thumbnail image opened in the large folder and it matches a file in the downloads folder. The screenshot on page 4 of P6 shows the second thumbnail image opened in the large folder and it matches a file in the downloads folder.53 60 The screenshot on page 5 of P6 shows a hex or data dump of one of the thumbnail files opened in Gnome Image Viewer. A hex dump is a tool that comes with Linux Ubuntu out of the box. Once installed a byte by byte extract or dump of a particular file can be performed.54 61 The screenshot on page 6 of P6 shows a hex dump of the second thumbnail file. The screenshot on page 7 of P6 shows the Gnome Nautilus in the downloads folder and also in the normal folder. The normal folder is empty because no thumbnails had been generated. Large thumbnails were only generated once a 50 T 66-67. 51 T 67-68. 52 T 69-70. 53 T 70. 54 T 71. -- 13 of 43 -- [2026] SADC 19 12 folder had been opened but thumbnails populated within the normal folder were not necessarily generated by looking at that particular folder.55 62 The screenshot on page 8 of P6 shows the Gnome Nautilus in the downloads folder and in the normal folder and one of the files is open and the corresponding thumbnail is also opened within Gnome Image Viewer. This screenshot shows that once an image is opened in the downloads folder and viewed full screen within the Gnome Image Viewer the corresponding thumbnail is generated and stored within the normal folder.56 63 The screenshot on page 9 of P6 is a replica of the screenshot on page 8 but a different file has been opened.57 64 Mr DeGuglielmo explained that the large folder contains all the thumbnails that are generated when a user is navigating through folders and if the folder contains any image files, thumbnails are generated and stored within the large folder. If a user was to double click or open an image file within a folder the corresponding thumbnail would be generated and stored in the normal folder.58 65 The screenshot on page 10 of P6 shows the first thumbnail within Gnome image viewer opened and a hex dump has been performed. The hex dump provides the information revealing the file path of the original image. The same process was performed on page 11 of P6 in relation to another thumbnail image. Mr DeGuglielmo explained that the name ‘Steve@Trusty2’ referred to the user account (Steve) and ‘Trusty2’ was the name the user had set for the computer.59 66 Mr DeGuglielmo also performed thumbnail testing on the Custom desktop computer: Exhibit P7. The first screenshot on page one showed the TrueCrypt application opened up. TrueCrypt is application software used to create encrypted containers, which can hold data that is generally locked by a decryption key.60 He put the thumbnail testing folder (which contained a range of images) inside a TrueCrypt container and then opened the thumbnail testing folder. At the same time he did that, he opened the normal folder and no thumbnail image was generated in the normal folder. He explained that thumbnails are not generated in the normal folder unless they are opened in full screen, whether they are in TrueCrypt or elsewhere.61 67 Mr DeGuglielmo said he would expect that in opening the thumbnail testing folder in TrueCrypt the thumbnails would appear in the large folder because the individual photographs have not been opened. Page three of P7 shows the Gnome image viewer opened with the content of one of the images ‘viewable’ and in the 55 T 71-72. 56 T 72. 57 T 72. 58 T 74. 59 T 74-75. 60 T 77. 61 T 78-79. -- 14 of 43 -- [2026] SADC 19 13 thumbnails normal folder a singular thumbnail has been populated with its contents opened in the Gnome image viewer.62 On page four of P7 there is a hex dump of one of the thumbnails in the normal folder pointing to the original file which was located in the ‘TrueCrypt 1 thumbnail testing’.63 68 Mr DeGuglielmo produced a table presenting the metadata for thumbnail images found on the Custom desktop computer and HP laptop: Exhibit P8. P8 shows the file paths of the original images located in the TrueCrypt container on the Custom desktop computer. Using the thumbnails he located in the normal folder he was able to determine the file pathway. The modified date and time represent the start and end of the session when those thumbnails were generated. For example, between 11.47pm and 12.11am on 25 February 2022 225 thumbnails were generated. The generation of a thumbnail is virtually instantaneous; it generally takes milliseconds for a thumbnail to be generated or populated into a folder.64 69 The thumbnails shown in P8 were only generated when the corresponding images were opened in the Gnome image viewer.65 70 Mr DeGuglielmo explained the description of each of the thumbnail files on page one of P8. Each of them was: file://media/truecrypt/NEWMICHELLE/SecretStars-MichelleSS007/ file://media/truecrypt/NEWMICHELLE/SecretStars-MichelleSS0010/ file://media/truecrypt/NEWMICHELLE/SecretStars-MichelleSS0011/ file://media/truecrypt/NEWMICHELLE/SecretStars-MichelleSS0012/ 71 The ‘file://’ denoted a local file in which that particular file was accessed. The media folder name in the file path was a general location in which mountable devices are used within a Linux operating system. TrueCrypt 1 is the name of a mounted device within that media folder. “New’ is the folder name within that device called TrueCrypt 1. ‘Michelle’ is a folder within the folder named ‘New’. ‘SecretStars-Michelle’ is a folder within the subfolder ‘Michelle’.66 72 The table shows the individual sessions that thumbnail generation occurred. There was one session on 25 February 2022 between 11.47pm and 12.11am when 62 T 79. 63 T 80. 64 T 82. 65 T 83. 66 T 85-86. -- 15 of 43 -- [2026] SADC 19 14 files within the subfolder ending 007 were accessed and then files in the same subfolder ending 007 were re-accessed at 12.18am for three seconds.67 73 Page two of P8 shows a sample of the 225 thumbnail files viewed between 11.47pm and 12.11am on 25 February 2022. It shows the time elapsing between the generation of each thumbnail. The first thumbnail in the table on page two was on screen for nine seconds before the next thumbnail was generated. However, Mr DeGuglielmo said it was also possible that this first thumbnail was opened for four seconds and then closed for five seconds before the next image was opened. The table on page two was just a sample of the top 10 thumbnails from the 225 files. The remainder of the thumbnails he analysed were all opened within a second, zero seconds or less than 10 seconds of each other.68 74 Mr DeGuglielmo said that the effect of his testing of the 675 thumbnail child exploitation material images that were located in the normal folder was that they originated from a sub-folder of TrueCrypt 1 on the Custom desktop computer.69 These images could only have generated in the normal folder if the user had double-clicked using the Gnome Nautilus to open the original file located inside TrueCrypt 1. However, Mr DeGuglielmo then said that there was another mechanism by which the thumbnail images could have populated and that was if the user scrolled through a range of photographs using the right arrow key. As soon as the photograph rendered on the screen its thumbnail would be generated and stored in the folder. What the user would see was no different from double-clicking on the image.70 75 Mr DeGuglielmo prepared another booklet which detailed the steps taken in an experiment he did to create and mount TrueCrypt containers on the Custom desktop computer: Exhibit P9. P9 shows the steps required to create a TrueCrypt encrypted container, encrypt it, work out the storage space, set a password (which can be the same for all encrypted containers) and find a place to store it. Once the encrypted container is opened and the password has been inputted it will display as any other folder and it and its contents become available to store and save information. To save something into a TrueCrypt container, the container must be selected, the password put in to open it and from that point the user can navigate to it in the same way the user can for any folder on the computer.71 Count 3 images 76 Mr DeGuglielmo said that the 238 thumbnail style images of child pornography were located in a virtual machine on the HP Pro Laptop. A virtual machine is a simulated computer; a computer within a computer. It can be used to emulate other operating systems or computers. It is generally used to test and tinker. A virtual machine is usually downloaded with the application software. An 67 T 86. 68 T 84-85. 69 T 88. 70 T 89. 71 T 91-95. -- 16 of 43 -- [2026] SADC 19 15 operating system must also be downloaded. A virtual computer enables a person to have access to other features and suites of software that may not be on the host device.72 When asked why a person would have a virtual machine on a computer, he said: So virtual machines are used for – primarily for testing and primarily for using software that’s not already available to that laptop or to that device. It can also be used for the isolation of data. So a very big use in cybersecurity is we will use a virtual machine to analyse data that we don’t want to escape, we keep it containerised in the virtual machine. Things like viruses and infected files, we might want to keep them contained to that virtual machine. So if a file is opened outside of that container it can wreak, you know, real havoc on a computer network or a real computer, so keeping it in that container keeps it isolated.73 77 The virtual machine that was on the HP Pro Laptop was Debian 7, 64-bit. Its operating system was Linux Debian. The virtual machine disk file (storage device) was created at 10.37am on 26 October 2013.74 However, Mr DeGuglielmo could not say when the operating system was installed in that virtual machine disk file. Without the operating system, the virtual machine had very limited function and no storage.75 78 The file disk drive for the virtual machine had a file path: users/Steve/documents/virtual machines/Debian 7 64-bit.76 ‘Users’ was the folder on a Microsoft windows machine that contained all the user folders. ‘Steve’ was the folder within the users folder in Microsoft Windows. ‘Documents’ was the documents folder of the user account Steve. ‘Virtual machines’ was a folder within documents of the user account Steve. ‘Debian 7, 64-bit’ was the name of the virtual machine.77 79 Mr DeGuglielmo examined the Debian 7, 64-bit disk drive which was the location of the 238 child pornography thumbnail images. The thumbnail file path within the virtual disk machine was home/Steve/.cache/thumbnails/normal. ‘Home’ was the folder on a Linux operating system which contained all of the user folders. ‘Steve’ was the folder of the user account Steve. ‘.cache’ is a common folder used by application software to store temporary storage or cached files into that folder. ‘Thumbnails’ is a thumbnail folder that file explorers and image viewers use to store thumbnails of image files. ‘Normal’ is the folder that is used to generate and store image files that are used within the Gnome image viewer.78 80 Mr DeGuglielmo said that Linux is a type of operating system and Debian and Ubuntu are derivatives of Linux. Debian has a set suite of software and Ubuntu has additional add-ons and features that might make it more beneficial to particular 72 T 96-97. 73 T 98, 8-19. 74 T 99. 75 T 100. 76 T 100. 77 T 101. 78 T 101-102. -- 17 of 43 -- [2026] SADC 19 16 workflows. Debian’s file explorer is Gnome Nautilus and its image viewer is Gnome Image viewer.79 81 Mr DeGuglielmo said that the thumbnails generated into the normal folder on the Debian 7 virtual machine in the same way that the thumbnails generated in the normal folder in Linux Ubuntu as shown in P6. He was able to analyse the metadata of the 238 thumbnail images. The third page of P8 shows the data obtained from the HP Pro Laptop. Taking the first thumbnail file, sftp://[email protected]/media/truecrypt4/new/uh-tanya, ‘sftp’ stood for secure file transfer protocol which enabled a user to securely access files from a remote location. ‘Steve’ was the user account located on the IP address 192.168.1.20 which was another device. Thus, the user Steve was accessing a remote resource (another device) and performing that action through a secure file transfer protocol. ‘Media’ was a folder located on the remote resource and is a common location used in Linux operating systems for mountable media.80 ‘TrueCrypt 4’ is a mounted folder within the media folder. ‘New’ is a folder within the directory labelled TrueCrypt 4. ‘Uh-Tanya’ is the folder located within the ‘New’ folder. On 26 October 2013, 157 files were generated in the normal folder between 3.04:30pm and 3.10:56pm. The original photograph from the original file was in the file path ending in ‘uh-Tanya’. The original file was on the remote device but the thumbnail was stored locally within the virtual machine. If looking at the remote device, there would not be any correlation between the two, the original file only would be visible.81 82 A person accessing the computer remotely would need to select the protocol from the list shown on page 12 of P6. That would be prefixed first, for example, sftp:// and then the remote resource (Steve) at the location of that remote device which is the IP address. If the person did not want to log on as a user, it would not query the person for a password. If the person logged on as a user, it would require a password. If the remote device was set up to be accessed to users without a password, the person could log on or access the resource without a password or account. The password would be the same password to access the remote device directly.82 83 The thumbnail images could only have populated in the normal folder if the user had double clicked on the original image or scrolled through them using the Gnome Nautilus file viewer.83 Count 1 images 84 Mr DeGuglielmo was asked about the file path for the 18 images found on the Huawei mobile telephone. That file path was: 79 T 102. 80 T 103-104. 81 T 104-105. 82 T 106-107. 83 T 107-108. -- 18 of 43 -- [2026] SADC 19 17 data/data/com.microsoft.skydrive/files/streamcache/[W…..]_S40%[W…..].sa.edu.au%20 %28[W……]%20college%29. 85 Mr DeGuglielmo explained that ‘data/data’ is a common language on an Android mobile phone and is where applications store their application data. He said that ‘com.microsoft.skydrive’ is the application name for Microsoft’s One Drive which is a cloud storage solution that enables a user to save and access files via the Cloud.84 Cloud is a remote server usually owned by the vendor which enables a user to store their files on that vendor’s server. ‘Files’ is a folder managed by the OneDrive application to store some of the application files that it uses. ‘Streamcache’ is the name of a folder that contains a range of cache files. The final part of the file path is a percent encoded name or account name for the user [W….] S at [W…...sa.edu.au]. Percent encoding is a way to store symbols that might not necessarily be supported or able to be used for file or folder names. Percent encoding is used to standardise and verify that the support for those names is available across all sorts of devices. If this folder is decoded it would read [W….._S@w…sa.edu.au]. The 18 thumbnail image files were located in a subfolder of Microsoft OneDrive in the name of [W…._S@w…...sa.edu.au.]85 Cross-examination 86 Mr DeGuglielmo agreed that he could not tell from the metadata of the thumbnails on the laptop and desktop computer when the original images were last accessed. The metadata only indicated when the thumbnails were generated. This is ascertained by looking at the modified date and time contained in the metadata. Modified in fact means created or generated.86 87 If the original files are deleted the thumbnails that correspond with those files remain in the user’s cache folder. Mr DeGuglielmo confirmed that there was no way of knowing whether the original files were deleted. They were within an encrypted container and that container could not be unlocked as they did not have the password. He could not say whether the user interacted with the original files on a date before or after the thumbnails were generated.87 However, he also said that when a thumbnail is generated that is likely to be the first time that the user has interacted with that file on that device. Accordingly the date and time of the thumbnails on each of the devices was the first time that the user had interacted with the original file on that particular device.88 88 Mr DeGuglielmo said that when the folder SecretStarsMichelleSS007 was accessed for the second time 11 new files were accessed. All of the thumbnails on 84 T 108. 85 T 109-110. 86 T 113. 87 T 114. 88 T 114-115. -- 19 of 43 -- [2026] SADC 19 18 the desktop computer were generated in a thirty-five minute session between 11.47pm and 12.22am on 25 and 26 February 2022.89 89 The file paths show that the thumbnails on the desktop were generated after the user had accessed them from a locally mounted device named TrueCrypt 1. On the HP ProBook laptop the locally mounted device was TrueCrypt 1, TrueCrypt 2, TrueCrypt 3 and TrueCrypt 4. Locally mounted device is a physical device such as a USB or portable hard drive. It can also be another computer file mounted as a drive. Mr DeGuglielmo could not say whether the locally mounted device in this instance was a USB device or file. He also agreed that he could not say when the original files came to be either downloaded or transferred onto the devices or what else might have been transferred onto the devices at around the same time that the original files were either downloaded or transferred.90 90 In relation to the desktop computer the original files were located in folders with the names SecretStarsMichelleSS007, SecretStarsMichelleSS010, SecretStarsMichelleSS011 and SecretStarsMichelleSS012. The names of the thumbnails were computational algorithms that input a set of data and outputs an incredibly unique value tied to the original file.91 91 In relation to the laptop, the folders that the original files were in were named NEW, NEW 2, Frost 04, March 08.92 92 When the file manager Nautilus creates a thumbnail it automatically stores the thumbnail in the cache folder of the computer. The cache folder is not created by the user and the storage of the thumbnail in the cache folder does not require manual input by the user.93 He could not determine whether it was more likely that the user had scrolled through each image or double clicked on the image before closing it and clicking on the next one. However, he agreed that the speed with which the thumbnails were generated on the desktop computer favoured the scenario of the user scrolling through the images. The time between thumbnail generation on the desktop computer in P8 shows how long the user spent viewing the original image before either closing or clicking through to the next image. There are several instances where the time recorded was zero or less than one second. Where the time was zero, it was not possible to quantify the time in milliseconds. In relation to most of the 675 thumbnails on the desktop computer the user spent either a second or less than a second with the image open in Gnome image viewer. Mr DeGuglielmo agreed that 11 thumbnails were generated in three seconds which suggested the user was clicking through them almost as fast as possible.94 89 T 115. 90 T 116. 91 T 116-117. 92 T 118. 93 T 118. 94 T 119-121. -- 20 of 43 -- [2026] SADC 19 19 93 Mr DeGuglielmo agreed that to access the original files on the HP ProBook laptop via the virtual machine, the laptop must be turned on and the virtual machine opened and logged into and then the files stored remotely are accessed through the secure file transfer pathway. To access the original files on the desktop computer, the user would turn the computer on, log onto the Linux operating system and either connect a locally mounted device such as a USB or hard drive or connect and log in to the True Crypt and then navigate to the relevant folder. In other words, to access the original files, all that is needed is a series of passwords or a locally mounted device.95 94 Mr DeGuglielmo agreed that the images on the Huawei mobile phone were local copies of Cloud data.96 He explained that a local copy is a cache or temporary copy that the phone has made in a way to enhance the user experience. Instead of having to continually re-download a Cloud resource, the phone will make a local copy to make the process faster for the user to open or view. This is very similar to a thumbnail or cache.97 95 The local copies on the Huawei mobile phone were generated when the user accessed the original files via the Cloud through the Microsoft OneDrive application. The mobile phone and OneDrive application in unison created the local file via an automatic process. The local copies are previews of the original file.98 96 The metadata for the local copies on the Huawei mobile phone had a modified date of 15 December 2021 which was the date local copies were generated. Mr DeGuglielmo agreed that, based on the data, he could not say what interaction the user had with the original files in order for the mobile phone to generate the local copy. The local copies on the phone were stored automatically within the cache folder of the OneDrive application.99 97 Mr DeGuglielmo then gave this evidence: HER HONOUR Q I’ve just got a question. You agreed with the proposition that you could not say what interaction the user had with the original files in order to generate the local copy. A That’s correct. Q Did the user have to have any interaction with the original file to generate the local copy. A That data is not fully available on the extraction of the phone. However, the use of OneDrive and the logging in of an account has to somehow occur for that thumbnail 95 T 121. 96 T 122. 97 T 123. 98 T 123. 99 T 124. -- 21 of 43 -- [2026] SADC 19 20 or that local copy to be populated. So a user can’t necessarily install OneDrive on their phone and not login without that being populated somehow. So once a user has logged into an account and set up and configured their OneDrive on their phone some of those folders would be created, such as the files and stream cache, which we saw in that file path, for then it to sort of start populating and loading up, yeah, the cloud content. Q Is there a possibility - is it possible to generate a local copy of the original file without an interaction by the user. A I’m not certain. Q So in giving that answer, can you exclude the possibility that there was no interaction by the user which resulted in the generation of a local copy. A Can you repeat the question sorry? Q In saying you were not certain, can you exclude the possibility of the user not having any interaction with the original file in the generation of a local copy. A I would agree with that, yes. Q So you can’t. A You can’t. Q Thank you.100 98 Mr DeGuglielmo could not say what a user would have to do in order to be able to access the local copies on the mobile. He then said that the user could not access the file path for the local copies by clicking or tapping through folders but it is something that the application uses in the background to enhance the user experience. Mr DeGuglielmo said that the only mechanism by which the local copies could be extracted from the phone was by using forensic software.101 Agreed facts 99 The following facts were agreed: Extraction 1. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the Custom Desktop Computer (Exhibit 22/B53405-016) and extracted the data from the computer and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 2. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the HP Pro Book Laptop (Exhibit 22/B53405-014) and extracted the data from the computer and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 100 T 124, 38; 135, 1-33. 101 T 125-126. -- 22 of 43 -- [2026] SADC 19 21 3. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the Huawei Nova ST Mobile Phone (Exhibit 22/B59034-001) and extracted the data from the mobile phone and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 4. On 20 September 2022, following review by Detective Brevet Sergeant O’Callaghan the two extractions referred to at agreed facts 1, 2 and 3 above were placed onto two discs marked as DES 2022/0987 AB1. Custom Desktop Computer (Exhibit 22/B53405-016) 5. The accused, [SW], was a user of the Custom Desktop Computer. 6. The Custom Desktop computer (Exhibit 22/B53405-016) contained a Ubuntu Linux operating system. 7. The Linux Ubuntu system had one user account in the name of ‘steve’. 8. The password for the account was ‘Jayden2’. 9. The last time this password was changed was 25 August 2018. 10. On 25 February 2022 at 11:45pm, the user ‘steve’ logged in to the Custom Desktop Computer using the Ubuntu Linux operating system. 11. On 25 February 2022 at 11:46pm, the TrueCrypt program was recorded as being run. 12. On 26 February 2022 at 12:25am, the Custom Desktop Computer was shutdown. 13. The 675 thumbnail images located on the Custom Desktop Computer with the file path ‘/home/steve/.cache/thumbnails/normal’, were examined by a police officer and categorised as child exploitation material as defined by section 62 of the Criminal Law Consolidation Act 1935. All images depicted children under the age of 14 years. HP Pro Book Laptop (Exhibit 22/B53405-014) 14. The HP Pro Book Laptop contained a ‘virtual machine’ named ‘Debian 7 64-bit’. 15. The 238 thumbnail images located on the HP ProBook Laptop with the file path ‘home/steve/.cache/thumbnails/normal’, were examined by a police officer and categorised as child exploitation material as defined by section 62 of the Criminal Law Consolidation Act 1935. All images depicted children under the age of 14 years.102 Huawei Nova ST Mobile Phone (Exhibit 22/B59034-001) 16. The 18 images located on the Huawei Mobile phone depict children under the age of 14 years. Occupants of the address 102 Count 3 charged an offence of obtaining access to child pornography. As there was no dispute that the 238 images were child pornography, I have proceeded on the basis that the reference to child exploitation material is a reference to child pornography. -- 23 of 43 -- [2026] SADC 19 22 17. When police attended the address [redacted], Onkaparinga Hills on 28 February 2022 three other persons were present at the premises. [KW] born 30 November 1974, [JW] born 23 February 2002 and [TW] born 3 March 2007. Employment 18. The accused was employed at [redacted] College between March 2009 and 25 May 2022. Defence case 100 The accused elected not to give evidence or call evidence. Closing submissions Prosecution submissions 101 Mr Powell opened his submissions by noting that there was no dispute that the 238 thumbnail style images on the HP Laptop and the 675 thumbnail images on the desktop computer all met the definition of child exploitation material/child pornography pursuant to s 62 CLCA and that all children depicted were under 14 years of age. 102 The agreed facts proved that the user ‘Steve’ logged in to the Custom desktop computer at 11.45pm on 25 February 2022. In order to log in, the password Jayden2 was required. At 11.46pm the TrueCrypt software was being run. This required the creation of a password. Between 11.47pm and 12.11am, 225 thumbnail files populated in the normal folder of that computer. The file path of those thumbnails revealed that the original images were located in a subfolder of TrueCrypt 1 called ‘SecretStarsMichelleSS007’. 103 Between 11.58:48pm and 12.00:48am, 171 thumbnail files populated in the normal folder and the file path of the thumbnails revealed that the original images associated with those thumbnails were in a subfolder of TrueCrypt 1 ‘SecretStarsMichelleSS0011’. 104 Between 12.01:01am and 12.13:17am, 153 thumbnail files populated in the normal folder and the file path of the thumbnails revealed that the original image associated with those thumbnails was located in a subfolder of TrueCrypt 1 called ‘SecretStarsMichelleSS0012’. 105 Finally, between 12.18:47am and 12.18:50am, 11 thumbnail files populated in the normal folder and the file path revealed that the original images were located in a subfolder of TrueCrypt 1 called ‘SecretStarsMichelleSS007’. 106 According to the evidence of Mr DeGuglielmo, those file names would have been visible to the user opening the subfolder. 107 The evidence of Mr DeGuglielmo established that in order for the thumbnails to populate in the normal folder, in the Gnome Nautilus file explorer the corresponding original image file had to be opened in an enlarged view using -- 24 of 43 -- [2026] SADC 19 23 Gnome Nautilus image viewer. A thumbnail file could only be generated in the normal folder after a user had double clicked on the corresponding image file or had opened one file and chosen to scroll through subsequent photographs using the arrow keys on the computer. It was more likely that the user scrolled through the majority of the thumbnails. The testing performed by Mr DeGuglielmo established that each thumbnail image was a replica of the original image in a thumbnail format. Based on a sample of the 225 thumbnail images in ‘SecretStarsMichelleSS007’ the time between thumbnails generating was 10 seconds or less with the majority less than one second or zero seconds. 108 The Custom desktop computer was then shut down at 12.25am on 26 February 2022, two minutes after the last thumbnail was generated in the normal folder. 109 Mr Powell suggested that I should find that the person who accessed the computer using the username Steve knew exactly what he/she was looking for and wasted no time in locating it. The timing and sequence of events led to an inference that the user logged onto that computer for one purpose. Mr Powell said that the timing of the log in was when it could be expected that other occupants of the house would be asleep. At least two passwords were required and several steps needed to be taken to access the material. 110 The evidence was inconsistent with an unwitting access of child exploitation material and subsequent deletion of it once the nature of the contents had been discovered. It was not necessary to look at 675 images over thirty-five minutes to determine that the material was child exploitation material which needed to be deleted. Mr Powell contended that a reasonable person would set about deleting all material in the relevant folder once images of child exploitation material were discovered. In essence, Mr Powell argued that the reasonable possibility of innocent access had been excluded beyond reasonable doubt by the evidence of the number of images accessed, being far in excess of the number an innocent accessor would view before determining to delete them. 111 Mr Powell then addressed the 238 thumbnail images of child pornography on the HP Pro Book laptop. He said the effect of Mr DeGuglielmo’s evidence was that, for a user to access the Debian 7, 64-bit virtual machine, the user would need to log in through the user account ‘Steve’. 112 Between 3.04:30pm and 3.10:56pm on 26 October 2013, 157 thumbnails populated and the folder containing the original images was a sub-folder of a TrueCrypt 4 container named uh-Tanya. Between 3.11:27pm and 3.12:55pm, 32 thumbnails populated in the normal folder within the subfolder ST which was a subfolder of a TrueCrypt 4 container. Between 3.13:30pm and 3.20:23pm, 71 thumbnail files populated in the normal folder. The file path of the original files revealed that those files were contained in a subfolder of a TrueCrypt 1 container called NL%little%20bonus. Between 4.10:15pm and 4.18:32pm, 81 thumbnail files populated in the normal folder and the file path of the original file was located -- 25 of 43 -- [2026] SADC 19 24 in a subfolder of a TrueCrypt 3 contained entitled April%20Jean%20shorts. Between 4.20:19pm and 4.20:32pm 4 thumbnails populated in the normal folder and the file path of the original file was located in a subfolder called DVHN within a TrueCrypt 2 container. 113 All files were accessed utilising a secure file transfer protocol on the Debian virtual machine. The user Steve accessed a remote device and using its IP address the user accessed four different TrueCrypt containers on that remote device. Mr Powell said that the effect of Mr DeGuglielmo’s evidence was that if the IP address input into the secure file transfer protocol software was a computer that was not locked with a password, the computer could simply be accessed. There was no evidence about whether, in 2013, a password was required to access the remote device. 114 Mr Powell contended that the evidence on counts 2 and 3 was cross- admissible in order to rebut any innocent association with the Custom desktop computer and the HP ProBook laptop and to exclude the reasonable possibility of access by another person. 115 It was Mr Powell’s submission that the similarities between the circumstances in which the data was accessed from the two devices suggested that the same person was responsible for accessing the images the subject of the counts. Mr Powell said there were four key aspects of the evidence that excluded the reasonable possibility that a person other than the accused accessed the child exploitation material images: 1. Both computers were located at the accused’s home address and the accused was home at the time of police attendance. The Custom desktop computer was set up and ready to be used, consistent with the access that occurred only days before police attended. Both devices were in the accused’s possession. 2. Both computers shared similar technical features. They had similar operating systems both derived from Linux. Both used the Gnome Nautilus file explorer and image viewer software. 3. Both computers had a username which was the accused’s first name. The password for the Custom desktop computer was in the name of one of his children. 4. The methods of navigating to the location of the child exploitation material/child pornography were the same. In each case, the user of the computer had logged in using the profile Steve and navigated to the exact location of the child exploitation material/child pornography. 116 In assessing whether the reasonable possibility of access by another member of the household has been excluded beyond reasonable doubt, regard should be had to the ages of the accused’s children at the relevant times. Mr Powell said that it would be fanciful to suggest that his son, aged five and half years in 2013, accessed the child pornography. -- 26 of 43 -- [2026] SADC 19 25 117 Mr Powell conceded that there was no evidence of the location of the laptop in 2013 and the persons, if any, who had access to that laptop in 2013. In the case of the Custom desktop computer there were a number of steps that would require an above average understanding of the software necessary to create a TrueCrypt container, let alone use one. 118 Mr Powell said the hypothesis that the accused’s wife accessed those two computers under the username Steve for the purpose of accessing child exploitation material/child pornography should be rejected. Mr Powell did not rely upon gender or marital status but rather the username being the accused’s first name and the use of software to access child exploitation material/child pornography. 119 In relation to count 1, Mr Powell said the primary issue was whether the material satisfied the definition of child exploitation material in s 62 CLCA. The question was whether the material was of a pornographic nature, that is, it was intended or apparently intended to excite or gratify a sexual interest. In order to determine this issue, Mr Powell conceded that the evidence with respect to counts 2 and 3 was not cross-admissible. However, if the material was pornographic in nature, then the evidence on counts 2 and 3 was cross-admissible on the issue of possession and knowledge of the pornographic nature of the images. The images were located on the mobile phone seized from the accused’s person and were the only images of this kind on the device. They were located in a subfolder of a Microsoft OneDrive in the name of [W…[email protected]]. 120 Mr Powell referred me to R v Morcom (2015) 122 SASR 154 for the proposition that whether material is pornographic is to be determined by reference to the observable physical aspects of the material. The question of whether the material was intended or apparently intended to gratify or excite sexual interest must be established irrespective of the subjective intention of the person possessing or producing it. 121 Mr Powell said that the 18 images show a child performing a cartwheel or handstand exposing her underwear and bare legs. Mr Powell urged me to draw the inference that the person who created the images did so intending to excite or gratify sexual interest. However, he said that it was not the prosecution case that the accused created the images; it was the case that he possessed them. Mr Powell conceded that if an inference was drawn that the images were intended or apparently intended for security purposes, they would not be pornographic in nature. Defence submissions 122 Ms Hannaford Gunn opened her submissions by noting that the case against the accused was a circumstantial case as there was no direct evidence that the accused possessed or obtained access to the child exploitation material/child pornography. Accordingly, the prosecution must exclude beyond a reasonable doubt all hypotheses consistent with innocence. Ms Hannaford Gunn said that the -- 27 of 43 -- [2026] SADC 19 26 prosecution had not proved beyond reasonable doubt that it was the accused who performed the acts the subject of counts two and three or that he knowingly possessed the material the subject of count 1 and that it was child exploitation material. 123 In relation to count 1, Ms Hannaford Gunn said that the 10 images labelled ‘small scale’ were so small that to see the child whose underwear was exposed the user would need to zoom into the image reducing the resolution to the point that the underwear is barely visible. The larger images showed a wide angle shot of an outdoor school area with the camera at least fifteen metres from the child in the underwear. The images were no different from a photograph a parent might take of a child celebrating a goal by performing a cartwheel at a soccer carnival, exposing her underwear. Such an image could not be intended or apparently intended to excite or gratify sexual interest. The evidence did not exclude the reasonable possibility that the person or system generating the images did so with a different intention. 124 Ms Hannaford Gunn then contended that even if the images were child exploitation material, it had not been proved beyond reasonable doubt that the accused knew the images were on his mobile phone. The accused was not charged with possession of the original images but of local copies generated as a result of an automatic function of the phone which he could not access without forensic software. 125 Ms Hannaford Gunn referred me to the decision of R v Porter [2007] 2 All ER 625 which was followed by Clayton DCJ in R v R, AM [2011] SADC 38. R v Porter is authority for the proposition that a person is only in possession of computer images on hard drives if, at the relevant time, the person has the ability to access and retrieve those images. There was no evidence establishing that the accused had the forensic software enabling him to access and retrieve the images on 4 April 2022. 126 Accordingly, the prosecution has not proved beyond reasonable doubt that the accused knew those images were on his mobile phone and/or had the capacity to access and retrieve them, therefore possession has not been proved beyond reasonable doubt. 127 Ms Hannaford Gunn argued that counts 2 and 3 were not cross-admissible for the purpose of rebutting innocent association. This was because of the significant passage of time between the date of the count 2 offence (2022) and the date of the count 3 offence (2013). It was not improbable that over the span of nine years different people accessed child exploitation material/child pornography on each device. The similarities between the mechanisms for access of the child exploitation material/child pornography on each device were not so unique as to favour the hypothesis that it was the same person over the hypothesis that it was two different people. -- 28 of 43 -- [2026] SADC 19 27 128 In respect of count 2, the location of the Custom desktop computer in the household led to an inference that other people had access to this device. The computer only had one user account and the same password since 2018. 129 In respect of count 3, Ms Hannaford Gunn said that the evidence excluded the reasonable possibility that the accused’s youngest son accessed the child pornography in October 2013. However, she said it was not unreasonable to suggest that the accused’s other son, who was 11 years old, would have had the technical knowledge to enter a series of passwords to obtain access. Further, no evidence had been led regarding the location of the laptop in 2013 and the delay in prosecuting this charge had disadvantaged the accused. There was no evidence regarding who had access to the laptop in 2013 or the technical know-how of any of those persons. 130 There was no evidence that the child exploitation material/child pornography in counts 2 and 3 was child exploitation material/child pornography consistent with the exclusive sexual interest of an adult male. Accordingly, no inference could be drawn regarding the likely identity of potential suspects. 131 Ms Hannaford Gunn said the fact that the user who accessed the material did so by logging on to the user account ‘Steve’ was neutral because there was only one user account and the desktop computer was located in the kitchen/dining area suggesting it was not for the exclusive use of one particular member of the household. No evidence was led to establish that other members of the household had their own personal computers. It was a reasonable inference that everyone in the household would have accessed the desktop computer. The existence of one user account suggested that if a family member was using the desktop computer that person would have accessed it using the account ‘Steve’. The password had not been changed since August 2018 and was the name of one of the accused’s sons. All of this is suggestive of the fact that security was not a priority. 132 No evidence had been presented that excluded the reasonable possibility that other people in the household accessed the devices on either 25 February 2022 or 26 October 2013. In fact, there was no evidence regarding who was in the house on 25 February 2022 or who was in a position to access the laptop on 26 October 2013. The police did not obtain statements from anyone else in the household. No evidence was presented regarding the use of either device for other functions such as emails, social media or accessing personal documents to establish a temporal link between the generation of the thumbnails and activity associated with a particular person. 133 The photographs of the desktop computer in situ reveal that there was documentation on the desk and medication or vitamins. The hard drive sitting on the desk in front of the desktop was not seized and examined. 134 Finally, Ms Hannaford Gunn said that even if I was satisfied that the accused performed the acts the subject of counts 2 and 3, the prosecution had not proved -- 29 of 43 -- [2026] SADC 19 28 that he did so intending to access child exploitation material/child pornography. Recklessness was insufficient. The speed at which the thumbnails were generated on the desktop computer made it more likely that the user was scrolling through the images. The names of folders were not descriptive of child exploitation material. Further, the evidence of Mr DeGuglielmo was that thumbnails are generated when a user first interacts with the files. Accordingly, that tended to suggest that the user was not the person who put the files into the TrueCrypt containers in the first place. Mr DeGuglielmo said the metadata was so limited that he could not say how the original files came to be in TrueCrypt. 135 Ms Hannaford Gunn said that the evidence could not exclude the rational hypothesis consistent with innocence that the person who accessed the images on the occasion that the thumbnails were generated did so without the requisite intention to access child exploitation material/child pornography. The absence of any evidence as to whether the original files remained in the TrueCrypt container left open the reasonable possibility that the user accessed then deleted the child exploitation material/child pornography. Even if it could be said that the user should have realised that all of the images were likely to be child exploitation material/child pornography and was reckless in continuing to access them, recklessness is insufficient to prove the requisite mens rea. Ms Hannaford Gunn noted that the statutory defence to the charge was proof that the child exploitation material/child pornography had come into the accused’s possession unsolicited and as soon as the accused became aware of it and its pornographic nature, he took reasonable steps to get rid of it. She also referred to the significant time period between count 2 and 3 and the absence of any evidence of access to child exploitation material/child pornography in the interim period as supporting an inference of inadvertent possession and access. 136 Ms Hannaford Gunn dealt with the evidence relied upon to establish that the accused obtained access to the child exploitation material/child pornography. She referred me R v Finnigan (No 3) [2015] SADC 166. In that case, Millsteed DCJ observed: The distinction between the offences of “taking a step” and “obtaining access” is that the latter is committed when a person is not required to take any more steps to obtain access to child pornography. As the Defence put it, in their written submissions: ‘…a step short of ‘obtaining access’ does not constitute ‘obtaining access’ because otherwise the offence of ‘obtaining access’ would have no work to do’. If the person’s conduct involves taking the “final material step” then the offence of “obtains access” is committed. The final step is one that results in the person obtaining access to child pornography in circumstances which do not amount to possession of the material.103 … For the purposes of the offence of “obtains access” it is sufficient if the person (i) possesses and intention to access child pornography, (ii) intentionally performs the “final step” required to make the images available for display on the computer screen, and (iii) that the 103 R v Finnigan (No 3) [2015] SADC 166 at [70]. -- 30 of 43 -- [2026] SADC 19 29 images comprise or contain child pornography, regardless of if, when or how the images were actually viewed.104 137 Ms Hannaford Gunn argued that the act of opening the original files in TrueCrypt (as evidenced by the creation of the thumbnails) was not the final step that results in the user having access to child exploitation material/child pornography because the user has already had access to the original files. Findings of fact on agreed or undisputed evidence 138 There was no challenge to the credibility or reliability of the two police witnesses who gave evidence at the trial. The manner and content of their evidence gave me no cause to doubt their reliability and credibility. I accept that Detective Schiek and Detective Brevet Sergeant O’Callaghan gave truthful and reliable evidence. 139 I make the following findings of fact on the agreed facts, exhibits and unchallenged evidence of Detective Schiek and Detective Brevet Sergeant O’Callaghan: 1. On 28 February 2022 four persons were present in the house at [address redacted] Onkaparinga Hills when police attended to search it. Those four persons were the accused, his wife [KW] and their two sons aged 20 and 14. 2. The accused was employed at [redacted] College between March 2009 and 25 May 2022. 3. On 28 February 2022 the HP ProBook Laptop (Exhibit 22/B53405-014) was located by police in a wire basket in the garage of the Onkaparinga Hills home. The garage was accessible to members of the household. 4. The HP ProBook Laptop contained a ‘virtual machine’ named ‘Debian 7 64-bit’. 5. 238 thumbnail images were located on the HP ProBook Laptop with the file path home/steve/.cache/thumbnails/normal’ and were child pornography as defined by section 62 CLCA and all images depicted children under the age of 14 years. 6. On 28 February 2022 the Custom Desktop Computer (Exhibit 22B53405-016) was located on a desk in the living area of the house immediately adjacent to the kitchen bench. A hard drive was sitting on a shelf of the desk immediately above the keyboard of the computer. Assorted paperwork, a paperback book and small plastic containers the size and shape of medication or vitamin containers were on the desk. 7. The accused was a user of the Custom Desktop Computer. 8. The Custom Desktop Computer contained a Ubuntu Linux operating system which had one user account in the name of ‘steve’. The password for the account was ‘Jayden2’. The last time the password was changed was on 25 August 2018. 104 Ibid at [102]. -- 31 of 43 -- [2026] SADC 19 30 9. On 25 February 2022 at 11.45pm, the user ‘steve’ logged into the Custom Desktop Computer using the Ubuntu Linux operating system. 10. On 25 February 2022 at 11.46pm, the TrueCrypt program was recorded as being run. 11. On 26 February 2022 at 12.25am, the Custom Desktop Computer was shut down. 12. On 28 February 2022, 675 thumbnail images were located on the Custom Desktop Computer with the file path ‘/home/steve/.cache/thumbnails/normal’ and were child exploitation material as defined by s 62 CLCA. All images depicted children under the age of 14 years. 13. On 1 April 2022, police seized a Huawei Nova ST Mobile Phone (Exhibit 22/B59034- 001) from the accused. 18 images of children under the age of 14 years were located on this mobile phone. The 18 images show a play or recreational area of [redacted] College with children in school uniform. 8 of the images are labelled preview and 7 are numbered 1-7. 10 of the images are labelled small scale images and 8 are smaller duplicated images of the 8 preview images. Two of the small scale images are not replicated in the preview images. Preview 1 image is taken at a different time of the day and on a different date from all of the other images and depicts different children and more children and no adults. In all of the images a female child under the age of 14 performing different stages in a cartwheel or handstand can be seen. She is wearing a school uniform dress and dark coloured underwear in a boy leg style. The child performing the cartwheel in preview 1 image is not wearing a hat or watch or wristband on her left wrist and has blonde hair. The child in all of the other images is wearing a hat and a watch or wristband on her left wrist. It is not possible to determine if it is the same child. 14. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the Custom Desktop Computer (Exhibit 22/B53405-016) and extracted the data from the computer and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 15. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the HP Pro Book Laptop (Exhibit 22/B53405-014) and extracted the data from the computer and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 16. On 28 March 2022, Digital Evidence Specialist, Adrian Button, received the Huawei Nova ST Mobile Phone (Exhibit 22/B59034-001) and extracted the data from the mobile phone and made the data available to Detective Brevet Sergeant Jacob O’Callaghan for examination. 17. On 20 September 2022, following review by Detective Brevet Sergeant O’Callaghan the extractions were placed onto two discs marked as DES 2022/0987 AB1. 18. The police did not take statements from anyone else living in the house at the time of police attendance. 19. No investigations were conducted to rule out the possibility of other persons using the username for the laptop or desktop computer. 20. The paperwork and plastic containers on the desk at which the Custom Desktop Computer was located were not seized by police. -- 32 of 43 -- [2026] SADC 19 31 140 Mr DeGuglielmo was qualified in examination in chief as a digital evidence specialist. I am satisfied that he had the experience, expertise and qualification to give the opinions he expressed. He was a very impressive witness. I accept his evidence without hesitation. Based on his evidence, I make the following findings of fact: 1. A thumbnail is generated with a file explorer and is a small preview of an image file, generally small in data size and visual content and size. Thumbnails are generated to enhance the user experience when using a digital device. The folder named ‘normal’ is the folder that stores the thumbnails that are generated when opening images with a Gnome Image Viewer. 2. When the downloads folder containing images is opened up but the images themselves have not been opened, thumbnails of those images are created in the large folder. 3. Opening the downloads folder will not result in thumbnails populating in the normal folder. 4. Once an image is opened in the downloads folder and viewed in full on screen by double clicking or scrolling through with the Gnome Image Viewer the corresponding thumbnail is generated and stored within the normal folder. 5. TrueCrypt is application software used to create encrypted containers which can hold data that is generally locked by a decryption key requiring a password. When a folder containing images is placed in a TrueCrypt container and opened, no thumbnails generate in the normal folder. A thumbnail will only generate in the normal folder if an image has been opened in full screen by double clicking or scrolling through. 6. The 675 thumbnail images of child exploitation material on the Custom Desktop computer were generated on the dates and times set out on page 1 of P8. Each thumbnail in the normal folder was generated as a result of the corresponding child exploitation material image being opened in the Gnome Image viewer by scrolling through a range of images using the Gnome Nautilus to open the original files inside TrueCrypt 1. 7. The 675 thumbnail images of child exploitation material in the normal folder on the Custom Desktop computer originated from images in a subfolder in a TrueCrypt container on the Custom Desktop computer. The names of those folders were SecretStarsMichelleSS007, SecretStarsMichelleSS0010, SecretStarsMichelleSS0012. 8. The 675 thumbnail images of child exploitation material in the normal folder on the Custom Desktop computer were generated when the user opened those images for the first time. 9. The 238 thumbnail child pornography images on the HP ProBook laptop were located in the Debian 7 64-bit virtual machine on the laptop in the normal folder. The virtual machine disk file (storage device) was created at 10.37am on 26 October 2013 and had a file path users/Steve/documents/virtualmachines/Debian 7 64-bit. The 238 thumbnail child pornography images had a file path of home/Steve/.cache/thumbnails/normal. These thumbnail images were generated by using the Gnome Nautilus file viewer and double clicking on the original image or scrolling through a range of images in a folder in TrueCrypt containers on a remote device using a secure file transfer protocol and the user account Steve at IP address 192.168.1.20. The original photographs of the child exploitation material in the original files were in folders named NEW, NEW2, Frost04 -- 33 of 43 -- [2026] SADC 19 32 and March08 in TrueCrypt containers on the HP ProBook laptop. The 238 thumbnail images of child exploitation material were generated on the dates and times set out on page 3 of P8 and were stored locally in the virtual machine. 10. The 238 thumbnail child pornography images populated in the normal folder on the virtual machine as a result of the user double clicking on the original images or scrolling through the images using Gnome Nautilus file viewer. 11. The 238 thumbnail child pornography images populated in the normal folder on the virtual machine when the user interacted with the original files for the first time. 12. The 18 images on the Huawei mobile phone were local copies of Cloud data in a cache folder and were previews of the original file. They were located in the subfolder of Microsoft One Drive in the name of [accused’s surname and first initial]@ [redacted].sa.edu.au. The creation of the local copies was an automatic process performed by the mobile phone and OneDrive application acting in unison. 13. It is possible that the user of the Huawei mobile phone did not have any interaction with the original files from which the local copies were generated. The only mechanism by which the 18 local copy images on the Huawei mobile phone could be extracted was by using forensic software. They could not be accessed by the user by clicking or tapping through folders on the mobile phone. Analysis and further findings 141 The prosecution case on all counts is based substantially on circumstantial evidence. When the case against an accused person rests substantially on circumstantial evidence, a verdict of guilty cannot be returned unless the circumstances are such as to be inconsistent with any reasonable hypothesis other than the guilt of the accused.105 For the trier of fact to be satisfied beyond a reasonable doubt of the guilt of an accused person it is necessary not only that his guilt should be a rational inference but that it should be the only rational inference that the circumstances enable the trier of fact to draw.106 Count 1 142 The principal issue in dispute on count 1 is whether the 18 images were child exploitation material. 143 The secondary definition of child pornography in s 62 CLCA is very wide and provides that child exploitation material is material that ‘consists of or contains the image of a child or bodily parts of a child (or what appears to be the image of a child or bodily parts of a child)’. That requires an objective examination of the physical characteristics of the 18 images. The 18 images the subject of count one indisputably meet the secondary definition as they all depict images of children. 144 That being so, the prosecution must then prove that the material is of a pornographic nature. In other words it must be ‘intended or apparently intended to 105 Peacock v R (1911) 13 CLR 619 at 634. 106 R v Plomp (1964) 110 CLR 619 at 661; quoted with approval in Barca v The Queen (1975) 133 CLR 82 at 104 (Gibbs, Stephen and Mason JJ). -- 34 of 43 -- [2026] SADC 19 33 excite or gratify sexual interest’107 before it can be proved beyond a reasonable doubt that the material in question is child pornography. 145 The test is an objective one.108 The question of whether the material is pornographic is to be judged by reference to observable physical aspects of the material. The Court must be able to make the judgment on the basis of the objective appearance and attributes of the material as soon as it is produced. There is no requirement to prove the actual intention of the producer of the material: …if the material itself manifests an intention or apparent intention to excite or gratify sexual interest, that intention to excite or gratify sexual interest will be established, irrespective of the ‘true intention’ of the producer.109 146 Material that does not satisfy the definition of child exploitation material does not acquire the status of child exploitation material simply by reference to the peculiar sexual interest of a particular person.110 147 Section 63C CLCA provides: (1) In determining whether material to which a charge of an offence relates is of a pornographic nature, the circumstances of its production and its use or intended use may be taken into account but no such circumstance can deprive material that is inherently pornographic of that character. 148 In R v Morcom Peek and Blue JJ said: …it is important to emphasise that the words in s 63C(1) “the circumstances of its production and its use or intended use may be taken into account” do not mean that a purely idiosyncratic intention of a particular person in relation to a particular item of material is sufficient to constitute an offence when an objective examination of the material in question could not support the conclusion that it is pornographic.111 149 Their Honours said that it is not possible to supply missing objective ingredients by reference to serendipitous, subjective circumstances of the person who happens to possess the material at any particular time.112 150 I infer and find that the 18 images in P4 are still images taken from security camera footage recorded at [redacted] College. I infer and find that the security footage was recorded (and thus produced) for the purposes of maintaining the security of the College. I infer and find that the person or persons responsible for producing the security footage understood that it would capture images of children 107 On the evidence led at trial, it is not necessary to consider whether the material meets the alternative definition of material that is intended to excite or gratify a sadistic or other perverted interest in violence of cruelty. 108 R v Morcom (2015) 122 SASR 154. 109 Ibid at [42]. 110 Ibid at [55]. 111 Ibid at [69]. 112 Ibid at [72]. -- 35 of 43 -- [2026] SADC 19 34 and other persons in the areas of the College covered by the security camera in question. 151 I infer from the location of the camera and the area of the College captured in the security camera footage (an open courtyard area where children and teachers congregate or move through) that the producer of the footage did not use and did not intend to use the footage (or any still images produced from that footage) to excite or gratify a sexual interest. However, if the still images in P4 are inherently pornographic, this finding cannot deprive the still images of that character. 152 The prosecution does not allege and has not set out to prove that the accused created the still images from the original footage. The prosecution alleges that the person who created the still images, did so intending that those images would excite or gratify sexual interest. There is no evidence, other than the images themselves, to support this contention. I remind myself that even if it could be established that the person who created the still images from the original footage did so to excite or gratify a sexual interest, if an objective examination of the material in question could not support the conclusion, then no offence has been committed. 153 I have carefully considered each of the 18 still images in P4 noting that 8 are duplicate images, the only difference being the size of the image.113 The children depicted in each of the images are in school uniform. There is one female child114 in each of the images whose underwear is visible only as a consequence of her performing a cartwheel or handstand in the open area of the College Courtyard in the presence of a number of other children (and on each occasion except in the still image ‘preview 1’ in the presence of two or three adults). The genital area and bottom of the child whose underwear is exposed are not visible. The underwear is not transparent or see through, is dark in colour and of a boyleg style covering the child’s genital area and bottom. I infer and find that the child in question performed the cartwheel voluntarily and not as a consequence of the producer of the footage directing or requiring her to do so. 154 The exposure of the child’s underwear is a perfectly natural incident of the innocent activity of performing a cartwheel in a dress. It was something that was clearly observable to those present in the courtyard should they have been looking. It is a sheer coincidence and a matter of happenstance that this was captured on the security camera footage. There is nothing explicitly or implicitly sexual about the images capturing part of the child’s underwear exposed in the course of performing a cartwheel. It does not fall within the definition of a ‘private act’ under s 62 113 The images labelled ‘small scaled 3’ and ‘small scaled 4’ are not replicas of any of the images labelled ‘preview’. 114 A close inspection of the images suggests that the child in the image ‘preview 1’ is a different child from the child in the remaining images but the evidence does not permit a firm finding to be made. -- 36 of 43 -- [2026] SADC 19 35 CLCA.115 Images of this type might be captured by a parent watching his or her child playing a game of sport during which underwear is exposed. 155 The prosecution has not proved that the 18 still images were intended or apparently intended to excite or gratify sexual interest. 156 Accordingly, I am not satisfied beyond a reasonable doubt that any of the still images in P4 are pornographic in nature and I am therefore not satisfied beyond a reasonable doubt that this material was child exploitation material. 157 It follows that count 1 has not been proved beyond a reasonable doubt. 158 In light of my finding that this element has not been proved, it is not necessary to consider the issue of whether the accused was in possession of the 18 still images. 159 Nevertheless, I propose to record the findings I would have made, had I been satisfied beyond a reasonable doubt that the 18 still images were child exploitation material. 160 I am satisfied on the evidence that the Huawei mobile phone was in the accused’s possession on 1 April 2022. The 18 images in P4 were in the cache folder which was inaccessible to the accused without forensic software. They were generated by an automatic function of the mobile phone without input by the user of the phone. There is no evidence from which an inference could be drawn that the accused knew that this had occurred and was in possession of that software on 1 April 2022. 161 In order to commit the offence of possession of child exploitation material, the accused must knowingly acquire the material (in this case the 18 still images) and store them in a place under his or her control. There is authority for the proposition that the automatic caching of a file to a folder inaccessible to the accused without forensic software does not, without more, constitute possession. 162 In this regard, the decision of the Court of Appeal in R v Porter [2007] 2 All ER 625 is instructive and persuasive. In that decision, which considered a similar offence provision with a defence equivalent to the defence in s 63A (2) the Court held: …possession of indecent images of children on a computer presents special problems. It may seem superficially attractive to say that all that is required to prove a breach of s 160 (1) of the 1988 Act is that, to the knowledge of the defendant, the images were on the defendant’s hard disk drive within the computer which was in his custody and control at the material time. It can be argued that possession is an ordinary English word which should be given its normal meaning. Parliament has mitigated the harshness that would result from 115 Section 62 defines ‘a private act’ as an act or activity involving undressing to a point where the body is clothed only in undergarments. Section 63B CLCA makes it an offence to make a photographic, electronic or other record from which the image of a child under 17 years engaged in a private act may be reproduced. -- 37 of 43 -- [2026] SADC 19 36 giving the word its normal meaning by expressly providing three defences in section 160 (2) and impliedly providing that knowledge is an essential element of the offence. on this interpretation (which was adopted by the judge in the present case), the fact that the images may be difficult or even impossible to retrieve is irrelevant. But this interpretation could give rise to consequences so unreasonable that we are not willing to accept it unless we are compelled to do so by the express words of the statute or by necessary implication. Its unreasonableness is well illustrated by the present case. The only way in which the appellant could have retrieved the 2700 still images which had been saved by the ACDSee programme would have been by the use of specialist techniques and equipment supplied only with the authorisation of the United States Federal Government and which were not available to the general public. It is accepted by the Crown that in reality the appellant could not have retrieved these images. In our judgment, it offends commonsense to say that they were in the possession of the appellant on 5 November 2022. … …in seeking to elucidate the meaning of ‘possession’ in section 160(1) in the present context, we see no reason not to import the concept of having custody or control of the images. In the special case of deleted computer images, if a person cannot retrieve or gain access to an image, in our view he no longer has custody or control of it. He has put it beyond his reach just as does a person who destroys or otherwise gets rid of a hard copy photograph. For this reason, it is not appropriate to say a person who cannot retrieve an image from the hard disk drive is in possession of the image because he is in possession of the hard disk drive and the computer.116 163 It has not been proved beyond a reasonable doubt that the accused knew that those images were on the Huawei mobile phone, let alone that he was able to access or retrieve them. Counts 2 and 3 164 The prosecution case on both counts is that the accused committed the offence of obtaining access to child exploitation material/child pornography and not the offence of taking a step towards obtaining access to child exploitation material/child pornography. 165 The offence of obtaining access to child exploitation material does not require the degree of control over the images which the offence of possessing child exploitation material requires. It is sufficient for the person to view the material without having control over the medium on which the material is displayed.117 166 There is no dispute that a person obtained access to the child exploitation material the subject of count 2 and the child pornography the subject of count 3 on the dates particularised in the Information. 167 The issues in dispute on counts 2 and 3 are whether it has been proved beyond a reasonable doubt that it was the accused who obtained access to the child 116 R v Porter [2007] 2 All ER 625 at [16], [17], [20], [21]. 117 F, BV v Magistrates’ Court (2013) 115 SASR 232, [47]. -- 38 of 43 -- [2026] SADC 19 37 exploitation material/child pornography the subject of counts 2 and 3 and if so, whether the accused intended to obtain access to that child exploitation material. Cross-admissibility of evidence on counts 2 and 3 168 The prosecution case is that the similarities in the manner and mechanism of access to the Custom desktop computer and HP ProBook laptop renders the evidence on counts 2 and 3 cross-admissible to rebut innocent access by the accused of the images on the Custom desktop computer and HP ProBook laptop and to exclude any reasonable possibility that it was someone other than the accused who accessed each device on the dates particularised. 169 In order for the evidence on count 2 to be cross-admissible on count 3 and vice-versa, I must be satisfied that the probative value of the evidence admitted for the permissible uses identified outweighs any prejudicial effect it may have on the accused. 170 In R v MJJ; R v CJN118 Kourakis CJ set out the process by which the probative value of the evidence is weighed: The impermissible use identified in s 34P(1) of the Evidence Act is the drawing of an inference of guilt from the fact that the accused has engaged in other conduct which has no relevant connection to the offence other than to share the epithet discreditable. Evidence of discreditable conduct of that kind may, admittedly with some imprecision, be described as evidence of a mere, or general, propensity. Section 34P(2)(b) expressly provides for the admission of discreditable conduct evidence which shows a particular propensity or disposition of the defendant. The particular propensity or disposition must be strongly probative of the offence charged and outweigh its prejudicial effect. Discreditable conduct which has a permissible use, other than by way of demonstrating a particular propensity, need only have a probative value, whether weak, moderate or strong, which substantially119 outweighs its prejudicial effect. [Emphasis added] At the core of the assessment of the probative value of discreditable conduct evidence are two analytical steps. The first is to identify the particular fact which is in issue. The second is to consider how, if at all, the discreditable conduct evidence circumstantially increases, as a matter of human experience, the probability of the existence of that fact. Resorting to generalities such as “context”, “background” and “underling unity” will seldom illuminate the analysis. 171 The fact in issue is the identity of the person who obtained access to the child exploitation material/child pornography. If that person was the accused, the fact in issue is whether he did so, intending to access child exploitation material/child pornography. 172 I am satisfied that the evidence on one count has a probative value on the other count for the following reasons: 118 (2013) 117 SASR 81, 88-89, [18]-[19]. 119 The test is now whether the probative value of the evidence outweighs its prejudicial effect. -- 39 of 43 -- [2026] SADC 19 38 1. Each device was accessed by a username or profile (which was the accused’s first name) when access was obtained to the original child exploitation material/child pornography images. 2. At the time of each relevant access, the original child exploitation material/child pornography images on each device were stored in a TrueCrypt container. 3. The file path location for the thumbnail child exploitation material/child pornography images on each device contained the accused’s first name. 173 The probative value of this evidence lies in its capacity to circumstantially increase the probability that it was the same person accessing child exploitation material/child pornography on each occasion and that this person was the accused. The significant passage of time between the dates of each respective access and the possibility of access by other persons on each occasion means the probative value of this evidence is weak. However, the probative value need not be strong in order to outweigh any prejudicial effect. In the circumstances of this case, the prejudicial effect of this evidence is low. Its prejudicial effect derives only from its probative value. Accordingly, I am satisfied that the permissible use of this evidence can be kept sufficiently separate and distinct from the impermissible use so as to remove any appreciable risk of it being used for that purpose. I am satisfied that the evidence on each count is cross-admissible. 174 However, I direct myself that if I am satisfied that the accused obtained access to the child exploitation material the subject of count 2 and did so intending to obtain access to child exploitation material, I cannot reason that the accused is the sort of person who is more likely to have committed the offence charged in count 3. I direct myself in the same manner if I am satisfied that the accused obtained access to the child exploitation material the subject of count 3 intending to obtain access to child exploitation material. Count 2 175 I am satisfied on the evidence of Mr DeGuglielmo that the person who accessed the child exploitation material the subject of count 2 did so by scrolling through the 675 images. 176 I cannot make any finding as to when any or all of the original images were placed in the TrueCrypt folder or whether any or all of them were deleted on 25 and 26 February 2022. 177 I am satisfied that the person who accessed the 675 child exploitation material images the subject of count 2 did so by logging in to the desktop computer using the username (accused’s first name) and entering the password (accused’s eldest son’s name followed by the numeral 2) and then entered a password in order to access the subfolders in TrueCrypt in which the child exploitation material files were located. On the evidence before me it is not possible to determine whether the TrueCrypt container holding the images from which the 675 thumbnail images were generated was created on 25 February 2022 or at some earlier point in time. -- 40 of 43 -- [2026] SADC 19 39 178 It is an agreed fact that the accused used the Custom desktop computer. Clearly there is at least a reasonable possibility that he was the person who obtained access to the 675 thumbnail images of child exploitation material. In determining whether it has been proved beyond a reasonable doubt that it was the accused, I have considered the evidence as a whole. 179 In determining what reasonable inferences I can draw from the established facts I have taken into account the following matters: 1. There was only one user account for this computer. The name of that user account was the accused’s first name. The password was the name of the accused’s eldest son. The last time that password was changed was on 25 August 2018. 2. The computer was in a central location in the house occupied by the accused, his wife and their two sons. The computer was accessible to any occupant of the household. If the account was locked or the computer shut down any occupant of the household could log in if he or she knew the username and password. 3. There was no evidence as to whether the desktop computer was configured to dim and lock the account or to never dim and never lock. 4. There was no evidence led as to whether or not other occupants of the household were aware of the username and password and/or used that computer. In other words, the evidence did not establish that the accused had exclusive use of this computer or was the only person who knew the username and password. 5. There was evidence of other devices located by police in the house occupied by the accused, his wife and their two sons. There was no evidence led on the topic of whether there were devices (including those located by police) possessed or controlled exclusively by other occupants of the household which might tend against a finding that those occupants also used the Custom desktop computer. The evidence of Detective O’Callaghan that he assumed the members of the digital evidence section in attendance triaged any other devices and ruled out other members of the household is of no probative weight. 6. There is no direct evidence establishing who in fact had the ability to access to the Custom desktop computer at the home in Onkaparinga Hills on 25 February 2022 because they were present in the house between 11.47pm on 25 February 2022 and 12.25am on 26 February 2022. However, it is a reasonable possibility that the persons present on 28 February 2022 when police attended were also present on 28 February 2022 at the time access to the 675 child exploitation material images was obtained. 7. There is no evidence from which an inference could be drawn that the nature of the 675 child exploitation material images was such that the person who obtained access to them was of particular type, gender or age. 8. The virtual machine on the HP ProBook laptop was logged into under the same username or profile as the username for the Custom desktop computer when access was obtained to the original child pornography images. That username was the accused’s first name. 9. At the time of each relevant access, the original child exploitation material/child pornography images on each device were stored in a TrueCrypt container. -- 41 of 43 -- [2026] SADC 19 40 10. The file path location for the thumbnail child exploitation material/child pornography images on each device had the same file path which contained the accused’s first name. 11. I am not satisfied that there has been any significant forensic disadvantage to the accused by reason of the passage of time with respect to count 3. Counsel did not identify any specific forensic disadvantage said to have been suffered by the accused. 180 The location of the computer, the fact the password remained unchanged since 2018, the name used in the password, and the absence of any other evidence suggesting the computer was used exclusively by the accused, means that it is a reasonable possibility that other persons in the household knew the username and password for the Custom desktop computer. It is a reasonable possibility that any or all of the other occupants of the household accessed and used that computer. 181 The evidence leaves open the rational hypothesis consistent with evidence that another occupant of the house obtained access to the child exploitation material the subject of count 2. The similarities between the username and the mechanism for access to the child exploitation material and the similarities in the file paths in respect of the images the subject of counts 2 and 3 are not of such probative weight as to exclude this rational hypothesis beyond a reasonable doubt. Whilst it is likely, indeed probable, that it was the accused who obtained access, the evidence does not meet the exacting standard of beyond a reasonable doubt. Count 3 182 I am satisfied on the evidence of Mr DeGuglielmo that the person who accessed the child pornography the subject of count 3 did so by a combination of double clicking on an image and scrolling through the 238 images. It is not possible to determine which images were double clicked and which were scrolled through. 183 Clearly there is at least a reasonable possibility that the accused was the person who obtained access to the 238 thumbnail images of child pornography. In determining whether it has been proved beyond a reasonable doubt that it was the accused, I have considered the evidence as a whole. In determining what reasonable inferences I can draw from the established facts I have taken into account the following matters: 1. There is no evidence at all of the location of the HP ProBook laptop on or around 26 October 2013 or the identity of any persons who had access to it on or around 26 October 2013. There is no evidence of the password required to be entered to access the data on the device. 2. There is no evidence to support a finding that the accused was the only person on or around 26 October 2013 who had access to the device and the virtual machine within that device and who knew the username and the password, if any, for the virtual machine or the device itself. 12. The HP ProBook laptop was accessible to the accused on 28 February 2022. It was also accessible to his wife and two children at that time. -- 42 of 43 -- [2026] SADC 19 41 13. The file path location for the thumbnail child exploitation material/child pornography images on each device had the same file path which contained the accused’s first name. 14. The HP ProBook laptop was logged in under the same username or profile as the username for the Custom desktop computer when access was obtained to the original child pornography images. 15. Given the correspondence between the file path names for the child exploitation material/child pornography images located on each device, it is open to infer that the HP ProBook laptop and virtual machine in it were accessible to and used by the accused between October 2013 and 28 February 2022. However, there is no evidence upon which a finding could be made that they were in the accused’s exclusive possession or used exclusively by him on and between those dates. 16. Given the age of the youngest son of the accused, I am satisfied that there is no reasonable possibility that he accessed the child pornography images on 26 October 2013. 17. There is no evidence from which an inference could be drawn that the nature of the 238 child pornography images was such that the person who obtained access to them was of a particular type, gender or age. 18. At the time of each relevant access, the original child pornography images were stored in a TrueCrypt container. 184 The evidence relied upon to prove beyond a reasonable doubt that the accused was the person who obtained access to the child pornography images on 26 October 2013 is weaker than the evidence in support of count 2. There is a paucity of evidence regarding the location of and accessibility to the HP ProBook laptop on or around 26 October 2013. The evidence leaves open the rational hypothesis consistent with innocence that another person obtained access to the child pornography the subject of count 3. The similarities between the username and the mechanism for access to the child exploitation material/child pornography and the similarities in the file paths in respect of the images the subject of counts 2 and 3 are not of such probative weight as to exclude this rational hypothesis beyond a reasonable doubt. 185 Whilst it is likely that it was the accused who obtained access to the child pornography the subject of count 3, the evidence does not meet the exacting standard of beyond a reasonable doubt. Verdicts 186 I find the accused not guilty of counts 1, 2 and 3. -- 43 of 43 --