FAYETTEVILLE, Arkansas — Thumbnail images of child sexual abuse content that investigators say they found on the work computer of former 19 Kids and Counting reality star Josh Duggar — in addition to extensive geolocation data — prove that he was responsible for downloading the incriminating material, prosecutors argued Friday.
Expert witness testimony could link Duggar to the child sexual abuse materials he was charged with “knowingly” receiving and possessing in April. He pleaded not guilty and faces up to 20 years in prison and a fine of up to $250,000 for each count if he is convicted.
In court, federal prosecutor William Clayman asked James Fottrell, a top forensics investigator at the Department of Justice, about the in-depth forensic analysis he conducted through Duggar’s work computer at Wholesale Motorcars.
“Based on [your] review, who was present at the car lot every time child pornography was downloaded?” Clayman asked.
“Josh Duggar,” Fottrell said.
Fottrell’s testimony involved a minute-by-minute analysis comparing when child sexual abuse materials were downloaded on a discreet “partition” of the office computer with the time and place of photos and messages on Duggar’s old iPhone 8. Fottrell was able to access the backup of the phone via Duggar’s personal MacBook Pro. The times of the downloads on the work computer correlated with iPhone photos Duggar took at the car lot, as well as text messages he sent from the phone identifying he was at work, Fottrell testified.
Not only did the phone point to Duggar being at the lot, but any child sexual abuse material on the work computer would have had to be downloaded manually, Fottrell said. That’s because the computer had something known as a Linux partition, in which the computer is essentially “split” into two distinct operating systems — one Microsoft Windows, the other Linux. In order to select the Linux side, Fottrell said, someone would need to physically hit a keyboard command.
Remote access wouldn’t have allowed that function, he added, contradicting the defense’s assertion made in cross-examination that a remote user could have downloaded the materials on the office computer rather than Duggar himself.
Fottrell said that while the “possibility exists” for remote access to the Linux system, what he found on the computer “doesn’t fit” that theory.
The defense also questioned the speed and efficacy of Fottrell’s search, including a minor accident in which the internet turned on during his search through the computer, something that could have affected the viability of the evidence. But Fottrell said this had “minimal” effect on his evidence and conclusions.
Fottrell reviewed with the jury an extensive timeline he compiled based on his findings from Duggar’s computer and iPhone backup after they were confiscated from Wholesale Motorcars via a search warrant in November 2019.
The phone’s user took a photo at the car lot on May 11, and the Linux partition was downloaded the same day, Fottrell said. On May 13, the partition was installed in the afternoon around the same time the phone had a picture of a scale determined to be in the lot’s office, he added.
Fottrell said he found a photo dated May 14 in the iPhone back-up that featured the HP computer's screen with a YouTube video pulled up. A reflection of whoever is sitting at the office desk is visible, as is the baseball hat they're wearing with the Wholesale Motorcars logo on it. Fottrell said he found a photo taken that same day in the iPhone back-up of Duggar and his wife Anna apparently shopping together -- Duggar donning a baseball cap with the Wholesale Motorcars' logo.
Through text messages, Duggar had identified he was at the car lot on May 14.
Also on that same day, Fottrell said there was evidence that bookmarks were created on an anonymous browser called uTorrent in the Linux partition for sites associated with child sexual abuse materials, and thumbnails for explicit content of minor girls were created.
“I’m on the car lot now,” Duggar said in a text the morning of May 15. Minutes later, Fottrell said a file involving a minor girl giving oral sex was downloaded on the Linux partition via an anonymous browser called uTorrent. Minutes later, more child sexual abuse files were downloaded from uTorrent.
The expert explained that computers basically make small "thumbnail" images for every full-size image on the device. Fottrell said he found thumbnails of this child sexual abuse content in the computer’s backend in his review, meaning full-sized versions of these materials and other child abuse materials he also detected must have been there at some point.
Later that day, photos on the phone of a firetruck and an accident near the car lot were taken.
Also on May 15, the user of the cellphone sent a text message indicating that they would be staying at the car lot until about 6 p.m. Shortly after, a file “Marissa.zip” was downloaded from an anonymous browser on the Linux partition and thumbnails of the file were created, indicating that the files were viewed, Fottrell said. The “Marissa series,” he explained, is a well-known and highly traded series of child sexual abuse content featuring the same girl in multiple explicit poses, some nude.
The timing of the download aligns with the same moment that detective Amber Kalmer, who testified this week that her monitoring software flagged someone with an IP address in Springdale, Arkansas, downloading child sexual abuse materials. Kalmer was able to access the file herself, which included 65 images of the same minor girl in explicit poses.
In another, on May 16, a thumbnail of a nearly 30-minute video was created just two minutes before a photo of a sticky note on the desk in Wholesale Motorcars' office was taken, Fottrell said the iPhone’s backup showed.
The password “Intel1988” was also “ubiquitously used” by Duggar for over five years to access a range of accounts, including the Linux partition, Fottrell found.
Through analysis of Duggar's personal MacBook Pro, Fottrell discovered the same password or iterations of it, used across his bank accounts and applications.
Other potential proof involved a report from Covenant Eyes, the anti-porn software Duggar and his wife Anna had used that generated regular reports on each other’s exposure. Fottrell cited a report from the software, dated 2017, flagging that Duggar had attempted to download uTorrent and the service blocked him. The report and similar entries showed that he had made multiple attempts to access the same anonymous browser the witness would find on the Linux partition that was eventually used to download child sexual abuse materials.
Further, Fottrell said he found that the "recently played" history of a media player someone would have installed on the Linux partition indicated that files known to contain child sexual abuse materials were “streamed” right from the office computer, rather than an internet source.
Duggar gained widespread fame and a conservative following for his time on TLC’s 19 Kids and Counting, which tracked the ever-expanding family of his parents, Jim Bob and Michelle Duggar. Their large household and ultraconservative beliefs also led to spinoffs. But in a 2015 Fox News interview, Josh Duggar admitted that he had molested five girls when he was a teenager, including his four younger sisters and a family babysitter. In the interview, the family said he and the girls received counseling and that they did not believe there was any future threat of wrongdoing; in their view, he had only been “curious about girls.”
Duggar has been present for the past three days at court with his wife, Anna, sitting in the gallery with other family members. The couple exited the gallery holding hands during the court’s afternoon recess. His brother-in-law Derick Dillard has sat next to Anna for the last three days. His wife, Duggar’s estranged sister Jill Duggar, has been suggested as a potential witness in the case.