FAYETTEVILLE -- Josh Duggar was at his used-car lot every time child pornography was downloaded or viewed on a desktop computer at the business, prosecutors told jurors Friday.
Duggar, 33, of Springdale is charged in federal court with two counts involving receiving and possessing child pornography. He faces up to 20 years of imprisonment and fines of up to $250,000 on each count if convicted.
A lawyer for Duggar, Justin Gilfand, told jurors in an opening statement that someone other than Duggar either downloaded or placed the child pornography on the computer, possibly even doing it remotely. Gilfand characterized the case as "a classic, old-fashioned whodunit."
GPS data and time stamps on photos as well as the photos themselves and text messages were compared with logs of the child pornography by computer forensic analysts to reach the prosecution's conclusion, according to testimony Friday from James Follett.
Follett heads up a computer crime forensic analysis unit at Homeland Security Investigations in Washington, D.C. He was the only witness Friday.
Follett said he found a copy of what was on an old iPhone 8 belonging to Duggar on Duggar's laptop. Duggar had used it around the time of the child porn downloads and much of Follett's corroborating information came from it, Follett said. The actual phone was not found by police.
The same type of data showed that Duggar was at the car lot when a car payment receipt was created, Follett said. That receipt was found on a hidden computer partition also used to download child pornography, he testified.
At the bottom, the receipt said the sales agent for the transaction was "Josh."
Duggar was also present at the car lot when a computer partition and operating system later used to download pornography was installed, according to Follett's testimony.
Follett testified that the password for the computer operating system that was used to download child pornography was a version of passwords Duggar had used extensively for at least five years before that.
Follett said he saw no evidence of anyone remotely accessing Duggar's computer.
Gilfand questioned Follett about not analyzing all of the electronic devices found by police. He also asked Follett about connecting a virtual version of Duggar's computer to the internet after Follett had told jurors he hadn't done that.
Follett chalked that up to a misstatement on his part. He said he had to update the software he was using, and it had minimal impact on the overall investigation because the forensic examination had already been done before he received the computer imaging.
Gilfand asked whether the exhibits Follett showed jurors were really the same as what were on Duggar's computer. Follett said they were substantially the same.
Earlier examinations found evidence of child pornography that Follett confirmed, he said.
Follett said analysts already knew what was on the computer. His role was to take the information on the copy of Duggar's computer and make it easier for the jury to understand.
Gilfand got Follett to admit that some of the images he showed jurors were not actually on Duggar's computer. Follett said he used the information on Duggar's computer to find the exact copies of the images in archives used by investigators. He assured jurors that the images were identical, based on the information used to download them.
Follett said evidence from Duggar's computer indicated that the actual files existed at some point on Duggar's computer but they were then deleted. It is less common now for individuals to keep libraries of child porn on their computers because it's easier and safer to stream the content, Follett said.
Gilfand was critical of police for not taking a router that was in the car lot office for analysis. Follett said routers contain little data and are seldom useful to investigators.
There was also disagreement about a thumb drive that was never found that Gilfand argued could have been used by someone to install a computer partition and Linux operating system on Duggar's computer. Follett said it was not needed because the government's case was based on child porn files being downloaded to Duggar's computer from a peer-to-peer network.
Follett said the evidence in the case indicated to him that Duggar installed the computer partition as well as the Linux operating system and browser using encryption to provide a degree of user anonymity.
Duggar, best known for being part of his family's cable television reality show, is accused of using the internet in May 2019 to download and possess the material, some of which depicts the sexual abuse of children younger than 12, according to court documents.
The trial is to resume Monday morning and is expected to wrap up by midweek.