Expert Forensic Testimony About Who Created And Transferred Certain Computer Images

Eleventh Circuit concludes that a computer forensic examiner may offer an expert opinion concerning about who "created" certain "illicit images that were found on" on the defendant's "cellphone and later downloaded them onto his computer"; the expert testimony on an ultimate issue of fact was permissible under FRE 704, since he did not dictate the result for the jury to reach or the legal implications, in United States v. Grzybowicz, _ F.3d _ (11th Cir. April 4, 2014) (No. 12-13749) (Carnes (CCJ), Hull, Garza (5th))

When it comes to computer forensic expert testimony, one important issue can be determining who was the user of a computer at the time key files were created, used or sent. While forensic examiners may be able to determine key computer activity, they may lack information about who was behind the keyboard at a particular moment or for an event. The Eleventh Circuit recently considered forensic expert testimony about who created images on a cell phone that were transferred to the defendant's computer.

Trial Court Proceedings: Forensic Expert Testimony

The opinion for the case begins: "The facts that gave rise to this case could make any parent reluctant to let a friend look after her child, even for as little as five or ten minutes, and even in a public place." Grzybowicz, _ F.3d at _. The case involved a very brief moment in which the defendant abused the two year old daughter of his co-worker at an amusement park.

Defendant Grzybowicz, a married man, met his co-worker, her boyfriend and two children at an amusement park, including her two year old daughter. After about four hours, the defendant suggested his co-worker and her boyfriend ride the roller coaster. He offered to watch the children. The ride last about 6 minutes, from about 2:08 p.m. to 2:14 p.m. The group left the park about 2:38 p.m. On the way home, the daughter "complained that her genital area was hurting." The mother also noticed the diaper straps appears to be moved.

Two days later, the defendant's wife reviewed his cellphone and noticed four photographs: "(1) a man’s hand opening the vagina of a small child wearing a yellow dress; (2) the man’s finger inserted into the child’s vagina; (3) the man’s hand pulling back a diaper to reveal the child’s vagina; and (4) the child’s diaper and exposed vagina." Grzybowicz, _ F.3d at _. She reported the matter to the police, showing the cellphone photographs. The defendant was awakened and went to the police station to be interviewed. He consented to a search of his laptop, cellphone and residence.

A forensic examiner discovered:

79 images of child pornography on the computer, including two of the four photographs of the little girl being exposed and molested that were also on Grzybowicz’s cellphone. Some of those 79 child pornography images on the user profile had been deleted, some were stored in temporary internet files, and some were saved in a file folder labeled “Pictures.” The images stored in that folder included depictions of infants and young girls with their vaginas exposed.

The “New” user profile’s internet history also contained links to Grzybowicz’s Yahoo account, which is the email address to which the four graphic photographs of the little girl’s vagina that were found on Grzybowicz’s cellphone had been sent. That was the same email address his wife had seen but not recognized when she inspected the cell phone the morning of February 19, 2011. In addition, the “New” user profile also contained download information, including the file name, for at least one of the images sent from his cellphone to that email address. And it had several links to a file-sharing website for child pornography.

Analysis of Grzybowicz’s cellphone revealed that the four photographs of a little girl’s vagina that his wife had discovered on his cell phone were created between 2:08 and 2:12 p.m. on February 17, 2011, which was during the five to ten minutes that he had been alone with Cochrum’s two-year-old daughter and five-year-old son. Those four digital images had been sent from Grzybowicz’s cell phone to his Yahoo account, links to which had been found in the user profile that he kept password-protected and hidden from his wife. They were sent from his cellphone to his Yahoo account that same day, around 2:45 p.m., which was seven minutes after he left the amusement park.

Grzybowicz, _ F.3d at _ (footnotes omitted). At trial, the agent examiner testified about his forensic examination. After explaining what he had found, he opined that the defendant "had taken the pictures" located on his "cellphone that had also been sent to, and downloaded onto, his computer." The defendant objected to this testimony as an impermissible opinion on an ultimate issue of fact under FRE 704. Following his conviction for production, distribution and possession of child pornography, he appealed the admission of this expert testimony.

Eleventh Circuit Review: Permitting Testimony On An Ultimate Issue Of Fact Based On The Forensic Examination

The Eleventh Circuit affirmed the admission of the challenged expert testimony allowing the examiner "to give his expert opinion that Grzybowicz created the illicit images that were found on his cellphone and later downloaded them onto his computer." The circuit noted that FRE 704 allows an expert to "testify as to his opinion on an ultimate issue of fact” as long as the expert does not “merely tell the jury what result to reach” or “testify to the legal implications of conduct.” Grzybowicz, _ F.3d at _ (citing Montgomery v. Aetna Cas. & Sur. Co., 898 F.2d 1537, 1541 (11th Cir. 1990); see also FRE 704(a) (“An opinion is not objectionable just because it embraces an ultimate issue.”)).

As the circuit explained:

Agent Ogden did not tell the jury what to decide or testify about the legal implications of Grzybowicz’s conduct. Instead, he gave his expert opinion, based on his examination of the cell phone and computer files, all of which was admitted as evidence at trial, that Grzybowicz had taken the amusement park photos with his cellphone and later downloaded them onto his computer. Agent Ogden readily admitted on cross-examination that he did not actually know who created those images, and the district court specifically instructed the jury that it was not required to accept Agent Ogden’s expert opinion.

Grzybowicz, _ F.3d at _.

The circuit affirmed the production and possession of child pornography convictions. However, the circuit reversed the distribution conviction on other grounds and remanding for resentencing.


The Grzybowicz case provides another example about computer forensic testimony and the ability of the examiner to opine about the creator or user of certain records. As the circuit noted, the opinion may be based on the examination. The examiner may be cross examined about the weight of that opinion.

For other comparable cases noted in the Federal Evidence Blog, consider:


Subscribe Now To The Federal Evidence Review

** Less Than $25 Per Month ** Limited Time Offer **

subscribe today button

Federal Rules of Evidence