ST. JOHN'S, N.L. — Two forensic computer analysts involved in the search for child pornography at the home of a Kilbride man took the stand at his trial Wednesday, saying hundreds of images of child abuse had been located on multiple devices.
Wednesday was the second day of trial for 53-year-old Thomas O'Grady, who has pleaded not guilty to one charge each of possessing and distributing child pornography. He was arrested in April 2017 after police received information about a local IP address - a specific computer identification number - being involved in accessing child pornography online.
Craig Collins and Mark McHugh were civilian members of joint RNC/RCMP team that executed a search warrant on O'Grady's residence, where he lived with four other people. The court heard earlier in the week that a tech triage unit was set up in the basement, while another mobile unit was stationed outside.
Collins was working at the basement unit, reviewing items located in the home by investigators and helping to determine if any of them had any evidentiary value. Among the items seized by police were two cellphones located in O'Grady's bedroom, a portable hard drive, multiple jump drives, a desktop computer and an iPad.
On the desktop computer alone, police found 914 images of child pornography, a police officer testified on Tuesday.
Collins told the court he examined the items by first plugging them into a write blocker, a device used to protect the information on a drive from damage or alterations, then looking at the contents.
"In this case I was looking for the presence of images or video of child abuse material," Collins said. "There were some devices where I didn't see anything. There was one where I did."
It was a purple jump drive, Collins said. Another device, an external hard drive, contained images that appeared to be of young people nude, though he wasn't sure they would be classified as child pornography, he told the court. Collins said he alerted police investigators to both devices, and they were both seized.
Collins said he had been instructed to look for a Yahoo account under O'Grady's name that had been involved in accessing child pornography, and he suspected it to be on the desktop computer.
Collins said he noticed the Yahoo Messenger application was running on that computer.
Collins told the court he had used an internet evidence finder dongle - a USB containing software to find and recover existing and deleted data on a hard drive - when he had triaged the desktop computer. As the investigating team was packing up to leave O'Grady's home, Collins said, he realized the dongle was missing. It was never located.
"Was the information taken by the program examined?" asked prosecutor Paul Thistle.
"It was lost, but I did look at it when I was there (in the home)," Collins replied.
Defence lawyer Rosellen Sullivan asked Collins whether the dongle had the capability of altering the computer.
"Minimally, yes," Collins replied. "Just me moving the mouse on the computer, me plugging in the device will make changes to that computer."
Sullivan asked Collins why he had not searched for the Yahoo email address on the computer.
"I would submit one thing you should have looked for is the address on that desktop, do you agree?" she asked.
"It's not something I'd normally do," Collins responded. "That comes later, at the office by investigators. I knew right away that we were going to seize that computer because there was child pornography on it. I wasn't concerned with finding that email address after that."
McHugh told the court he had located 355 images of child pornography on an external hard drive that investigators had located under a coffee table in O'Grady's rec room. All the files had been deleted or were otherwise not accessible on the drive, he said.
He said there were more than 200 other accessible files that included information police could use to identify the owner of the hard drive. He did not elaborate.
McHugh testified he located 211 images of child pornography from a jump drive seized from O'Grady's bedroom. All were inaccessible, he said.
McHugh will continue his testimony before provincial court Judge Lori Marshall Thursday morning.
Twitter: @tara_bradbury
Related
