Skip to main content

Author: Jess Johnson

What to Expect at the Initial Appearance in Federal Criminal Cases


The initial appearance in federal criminal court is the first time that someone charged with a federal crime goes before a judge. What happens at initial appearance is governed by Rule 5 of the Federal Rules of Criminal Procedure.

What should I expect at the initial appearance?

The initial appearance happens quickly after you are arrested on federal charges or turn yourself into the U.S. Marshals. Normally, the initial appearance will take place within a couple of days. During the hearing, the Court will first advise you of a number of things, including:

  • The charges that have been filed against you;
  • Any statutory minimums or maximums that may apply to the charges;
  • That you have the right to retain a lawyer or have one appointed if you cannot afford one;
  • That you have the right to remain silent and that anything you say can be used against you in court;
  • Whether you have the right to a preliminary hearing; and,
  • Whether you can seek pretrial release.

The Court will also ask the Government if it has or intends to move for detention. In some cases, the Government may file a motion seeking to detain you and hold you without bond until the trial. If the Government does move detention, the Court will likely schedule a detention hearing a few days out. The purpose of a detention hearing is to determine if you should be released on bond. If the Government does not move for detention, the Court will likely set a bond in your case that is either an unsecured bond (meaning that you don’t have to put up any money) or a secured bond which requires you to put up money or property.

How will I know if the Government will move for detention?

Federal law allows the Government to move for detention in two situations: 1) when certain charges are brought, and 2) when the Government believes that you are a serious risk of flight or a serious risk of obstructing justice or threatening witnesses.

The type of offenses which usually cause the Government to move for detention include a crime of violence, an offense which has a maximum sentence of life or death, a drug offense which has a maximum term of imprisonment of 10 years or more, and in cases where the person have been convicted of two or more offenses which would fall under the three previous categories.

If the Government thinks that you might flee or somehow obstruct justice, the Government will often seek detention where someone has ties to other countries, has few ties to the community where the allegations occurred, has a criminal history, has failed to appear for court in the past, has access to a large amount of liquid assets, or has alleged ties to a larger criminal organization.

Hiring a defense lawyer for the initial appearance

Hiring an experienced federal criminal defense attorney before an initial appearance can make a significant difference in how the case is handled. If hired earlier enough during the criminal investigation, a defense lawyer can often arrange to have his client self-surrender (instead of being arrested at your home, workplace, during a traffic stop, or at the airport). A defense lawyer can also talk to the prosecutor assigned to the case to convince them that they should not move for detention. If the Government refuses, your defense lawyer can begin to prepare for the detention hearing by gathering evidence and witnesses to convince the court that you should be released on bond.

If you or someone you know is facing federal criminal charges, give Johnson/Citronberg a call at (703) 684-8000. Our federal criminal attorneys represent clients charged with serious federal offenses across the country. The initial consultation is always confidential and free.

Deleted and Temporary Internet Files: Defending Child Pornography Charges

Johnson Citronberg is a federal criminal defense law firm based in Alexandria Virginia.

Child Pornography Defense Lawyers

Deleted and Temporary Internet Files: Defending Child Pornography Charges

In federal court, possession of child pornography is typically prosecuted under 18 U.S.C. § 2252 and § 2252A. These statutes require that a person “knowingly” possess an image depicting child pornography for there to be a conviction. State child pornography laws also typically require that the user knowingly possess the image or video in question. (See our page on Virginia’s Child Pornography laws).

Contact Johnson / Citronberg | 703-684-8000

In many cases, however, the Government’s evidence shows that the images in question were either deleted or stored in the computer’s temporary internet files. To determine if a person “knowingly possessed” such an image, we must first understand how computer systems create and store deleted and temporary internet files.

For a full discussion on potential defense to child pornography offenses, view our main page on child pornography cases here. You can also learn about thumbs.db files here.

Deleted Files

There is a common misconception that deleting a file from one’s computer removes the file entirely from the computer. The process of deletion is much more complicated. When a user deletes an image, the image is first sent to the computer’s recycle bin. If the user deletes the file from the recycle bin (or if the bin runs out of space), the image is moved to an area of the hard drive called “unallocated space.” Unallocated space (or “free space”) is the area where new files can be stored by the computer. In addition to images, the following types of files can be stored in unallocated space:

      • Videos
  • Emails
  • Chats or instant messaging
  • Browsing History
  • Documents

The user won’t be able to see any images in the unallocated space portion of the hard drive, but a computer forensic expert can easily search this area with specialized software, such as EnCase. EnCase is a program favored by many law enforcement agencies when searching a computer for child pornography.

It should be noted that there are times when images or other files in the unallocated space can be fully overwritten (for instance, if the computer runs out of unallocated space, it can overwrite these files with new data). There are other times when the image or file may be partially overwritten and some evidence of it can remain.

When law enforcement only finds deleted files, the question becomes whether the user knowingly possessed the deleted files. While every case is different, innocent people may find themselves charged with a crime in these different scenarios:

Defense Scenario 1: A user unintentionally downloads child pornography and then deletes the file.

Defense Scenario 2: A user buys a computer not knowing that the original owner had downloaded and deleted child pornography.

Defense Scenario 3: A user lends his laptop to a friend who downloads and deletes images of child pornography before returning it to the user.

Temporary Internet Files or Cache Files

When a user views a website, the computer system automatically downloads all of the pictures and videos on the site to the hard drive’s “temporary internet files” or “cache files.” The number of images and videos stored in the temporary internet files is determine by the space allocated for these files as well as the amount of internet usage. It is very possible that an image might stay in the temporary internet files for months or even years after someone visits a website. It is important to note that even if the images or videos are bumped out of the cache or temporary internet files (due to a lack of storage), they may very well find themselves in the unallocated space portion of the hard drive.

Once again, if law enforcement only finds temporary internet files, the question becomes whether the user knowingly possessed such images. In addition to someone else the computer, there are other common defense scenarios that should be considered:

Defense Scenario 1: The user never intended to visit a website containing images of child pornography.

Defense Scenario 2: The user never saw child pornography on a website because the images were below the viewable screen or were hidden on the site.

What do the Courts say?

Courts generally recognize that a user may be innocent because possession was not knowing. The Ninth Circuit, for instance, stated the following: “Where a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images. To do so turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control.” United States v. Kuchinski, 469 F.3d 853, 863 (9th Cir. 2006).

Similarly, the Fifth Circuit reasoned: “courts have refused to find that a defendant constructively possessed child pornography located on his computer simply because the defendant exclusively possessed that computer, without additional evidence of the defendant’s knowledge and dominion or control of the images.” United States v. Moreland, 665 F.3d 137 (2011).

Building a Defense

Anytime the Government’s evidence only shows images of child pornography in unallocated space or temporary internet files, the defense should question whether the Government can prove that possession was knowing.

The defense lawyer should not simply take the Government’s forensic report at face value. It is often necessary for the defense to hire an independent computer forensic expert to evaluate the Government’s report and to conduct their own thorough investigation. An independent expert can poke holes in the Government’s report (including contradicting where the images are located), develop an alternative theory as to how the images came to be on the machine, and help the defense craft a list of thorough cross-examination questions for the Government’s expert.

By challenging the Government’s theory of the case with an independent expert, the defense can greatly increase its chances of winning a dismissal or reduction prior to trial. If the case proceeds to trial, the defense will have a credible and solid defense to the charges.

Contact Us

If you or someone you know has been charged with a child pornography offense, you should contact an experienced internet sex crimes attorney as soon as possible. Our law firm uses leading computer forensic experts to challenge the Government’s allegations and to prove our clients’ innocence.

Continue reading

Thumbs.db Files: Defending Child Pornography Charges

Washington DC

Child Pornography Defense Attorneys

Thumbs.db Files:
Defending Child Pornography Cases


When law enforcement searches computers for child pornography, they will often only find “thumbs.db files.” Understanding thumbs.db files is therefore critical to developing potential defenses to possession of child pornography charges.

Below are several points about thumbs.db files that anyone defending a child pornography case should know.

Point 1: Thumbs.db files are used by Windows to store thumbnail images of the actual files in a folder.

Point 2: Thumbs.db files are not intentionally created by the user. These files are cache files that are automatically created by Windows when an actual image is stored somewhere on the hard drive.

Point 3: A user is typically unaware when a thumbs.db file is created. Windows Explorer has a default setting which actually hides the file so that the user cannot see it.

Point 4: Thumbs.db files contain the same picture as the actual image containing child pornography. While the pictures are a much lower resolution than the actual images, law enforcement’s software will still detect the pictures.

Point 5: Thumbs.db files will stay on the computer even if the actual child pornography image is deleted.

Point 6: If the actual image is deleted from the computer, a user will typically not be able to access the thumbs.db file. A user would have to use specialized forensics software, such as Encase, to view the file. Encase is one of the preferred forensic tools used by law enforcement to search for child pornography on a device.

The best way to defend yourself against criminal charges is to hire a lawyer who is an expert in that field.

Contact Johnson / Citronberg | 703-684-8000

What Do the Courts Say?

In one federal case involving the possession of child pornography, the Eleventh Circuit summarized thumbs.db files the following way:

“[The agent] explained that all of the images of child pornography on the laptop were contained in ‘thumbs.db’ files. A ‘thumbs.db’ file is a database that is automatically created when a user chooses to view all of the files within a particular folder in a thumbnail view. A user might do that ‘to quickly identify image files or other files inside that folder without having to open up every file that they come across until they find the one they’re looking for.’ Even if a user deletes all of the images in a folder, the ‘thumbs.db’ file remains unless the folder itself is deleted.” United States v. Schaff, 454 Fed. Appx. 880 (11th Cir. 2012).

Building a Defense

To convict someone of possession of child pornography, the Government has to prove that the user knowingly possessed the image in question. As seen above, a user will rarely knowingly possess a thumbs.db file as Windows automatically creates and hides these files.

This creates a difficulty for the Government in proving its case. The Sixth Circuit Court of Appeals, for instance, noted that “[w]hen images are only recovered from a computer system’s cache, rather than organized on a hard drive or other storage media in a more intentional manner, it is sometimes more difficult for the government to show that a defendant knowingly possessed the child pornography.” United States v. Johnson, 775 F. App’x 794 (6th Cir. 2019).

Other courts have found that the defendant must have “the knowledge and ability to access the images and to exercise dominion or control over them.” United States v. Moreland, 665 F.3d 137, 150 (5th Cir. 2011); see also, United States v. Flyer, 633 F.3d 911, 919 (9th Cir. 2011), finding that “our precedent relating to cache files suggests that a user must have knowledge of and access to the files to exercise dominion and control over them.”

So if the evidence only shows thumbs.db files, the Government will have a difficult time showing knowing possession. This creates a powerful defense to use at trial, or at the very least, provides the defense with leverage to work out a more favorable plea agreement with the Government. The presence of only thumbs.db files can also make it more difficult for the Government to prove the more severe charges of receipt and distribution of child pornography.

Hiring a Computer Forensic Expert

An independent computer forensic expert should always be retained to review the Government’s forensic reports. In some cases, the Government’s expert report may not detail that the images were in fact thumbs.db files. In other cases, an independent expert can help the defense to establish that any thumbs.db files were not knowingly possessed by the defendant.

In a Northern District of Georgia case, we represented a schoolteacher accused of possessing child pornography after law enforcement raided his home. The Government initially argued that there were images intentionally saved to his computer. Our independent expert disputed the Government’s contention, and as a result, the Government dismissed all charged two days before trial.

Contact Us

Johnson/Citronberg is one of the few criminal defense law firms that specializes in internet sex crimes like possession of child pornography. By using independent computer forensic experts and cutting-edge technology, we have amassed an overwhelming number of dismissals and reductions prior to trial. If you would like to see if we can help, give us a call 703-684-8000. We have offices in Alexandria, Virginia and Atlanta, Georgia, and we represent clients in federal court around the country.

Thumbs.db Files are hidden files that users often are unaware of and cannot access

Contact Johnson/Citronberg, PLLC

Our experienced attorneys have the ability and resources to handle even the most complex criminal defense matters.

Our Practice Areas

Continue reading