Defense Challenges Prosecution's Key Witness In Josh Duggar Trial

The defense tried to poke holes in the testimony of the prosecution’s key witness Friday as Josh Duggar’s child pornography trial continues.

James Fottrell, a computer forensics expert and High Technology Investigative Unit director, spent the day on the stand Friday, first laying out the in-depth forensic analysis that represents the crux of the prosecution’s case, describing how Duggar’s own phone placed him at the Arkansas car dealership when the child sexual abuse materials were downloaded onto a work computer at the same location in May of 2019, BuzzFeed News reports.

“Based on [your] review, who was present at the car lot every time child pornography was downloaded?” Prosecutor William Clayman asked in court.

“Josh Duggar,” Fottrell responded.

Duggar, a former reality television star who rose to fame on TLC’s “19 Kids and Counting” is facing charges of knowingly receiving and possessing child pornography after investigators said they found graphic images depicting sexual abuse of children on a desk top computer at Wholesale Motorcars. He's pleaded not guilty to the charges.

Fottrell provided jurors with a minute-by-minute analysis of when the images were downloaded onto a hidden Linux “partition” of the office computer that effectively split the hard drive in two to keep the internet activity hidden from an accountability tracker installed on the main portion of the hard drive.

He paired that analysis with iPhone photos, text messages and data from Duggar’s phone, which had been backed up on Duggar’s personal MacBook Pro, that placed him at the used car dealership at the time.

In one instance, Fottrell testified that that a photo of a sticky note on the desk of the car lot was taken on Duggar’s phone just two minutes after the video file “pedomom” was accessed, People reports.

In another instance, Duggar sent a text the morning of May 15 saying that he was “on the car lot now” just minutes before Fottrell said investigators discovered evidence that a file was downloaded using an anonymous browser known as uTorrent of an underage girl performing oral sex, BuzzFeed News reports.

Later that same day, Fottrell said Duggar sent a text message saying he planned to stay at the car lot until 6 p.m.

Not long after, someone downloaded a file of graphic and highly trafficked images of child sexual abuse known as the “Marissa series.”

Fottrel also dismissed a theory floated by the defense that someone could have been remotely accessing the computer and said that evidence found by investigators was “not fitting” that explanation.

“That’s not happening,” he said, adding that no remote access tools were found on the computer, according to local station KNWA.

Fortrell testified that the Linux partition of the hard drive—where the child sex abuse materials were discovered—could only be accessed by someone who physically switched to that portion of the computer when it was booting up.

According to his testimony, small “thumbnail” images are stored of every full-size image downloaded on a computer. Investigators were able to discover these thumbnails depicting child pornography on the back end of the computer, even though the full-size images may have been scrubbed from the computer.

"Some offenders understand it's dangerous to possess the material of this nature so they download it, view it and then delete it," he testified, adding that investigators had found full-sized originals of one collection of images.

Under cross-examination, defense attorney Justin Gelfand questioned why a router in the office and other electronic devices left behind had never been examined or seized by investigators.

"We don't want to seize the paint off the walls," Fottrell replied, according to People. "We're trying to find where the critical evidence is."

Although Fottrell was not present during the 2019 search, he testified that investigators typically already have a good idea of what they are looking for—in this case a Windows computer—before descending on a property.

"We're not on a wild goose chase," he said. 

Gelfand also questioned why investigators had never been able to recover a thumb drive someone had plugged into the desk top computer shortly before the operating system to create the partition was installed, suggesting the thumb drive could have held critical evidence in the case.

However, during redirect by Clayman, Fottrell testified that the thumb drive, which had two Word documents and a Powerpoint file on it, was “pretty inconsequential” to the case, KWNA reports.

Fottrell said the investigation was limited by his large case load and although he and federal agents did not have “perfect information,” he felt they still had “lots of good evidence.”

“In every case, there’s always more analysis you could do,” he said, according to People. “It’s certainly not perfect, it’s certainly not exhaustive.”

On the stand, Gelfand questioned Fottrell about technical aspects of the case, including how certain files were installed on the Linux partition and other ways Tor browers can be used for “totally legal, benign things.”

At one point, the defense attorney jumped on a mistake Fottrell made on the stand. The computer expert had repeatedly testified that a virtual copy of the computer used to show the jury the evidence had never connected to the internet, yet it was later determined it had connected to the internet for about five minutes for a software update.

Fottrell admitted the mistake and insisted that the device would not have been able to be accessed or changed during that time period.

Testimony in the case is expected to continue Monday.