Our society generally agrees that possessing, producing, and distributing child sexual abuse material (CSAM)1 is morally reprehensible.2 This societal judgment is represented in sentencing outcomes for those convicted of federal child pornography offenses. Of the individuals who were sentenced in 2023 for child pornography–related offenses, ninety-nine percent were sentenced to prison, with an average sentence of 114 months.3 But, despite the severity of these crimes, sentencing fails to consider certain forensic evidence that could help distinguish more and less culpable offenders.
Judges have discretion over sentencing outcomes but are also required to consider the Federal Sentencing Guidelines, which help calculate a recommended sentence for each offender based on his offense and criminal history.4 The Guidelines include several enhancements relevant to child pornography offenses.5
An oft-used enhancement in the Federal Sentencing Guidelines, section 2G2.2(b)(7), recommends additional years based on the number of images involved in an offense.6 Though the greatest number of images considered by this section is “600 or more images,”7 most nonproduction child pornography offenders far exceed this number, with a median of 4,265 images in each collection.8
But not all images are created equal. The forensics process extracts images from a device using two different methods: parsing and carving.9 A parsed image is accessible to any ordinary user when examining the device.10 A carved image was at one point accessible on the device but is no longer accessible to the ordinary user.11 “Ordinary user” is an important caveat here. Users with relevant technical backgrounds are able to access carved images,12 and they could even manipulate their devices on purpose so that images are carved and hidden from the detection of ordinary users.13 Both carved and parsed images may signal culpability in different ways. For example, the presence of parsed images may suggest a repeated or straightforward defiance of the ban on CSAM possession, while carved images might, in some factual circumstances, communicate a defendant’s intention to evade legal detection and enforcement by taking additional technical steps, such as creating a “hidden” partition to store and hide illegal images.14
At the same time, there are different, innocuous reasons that a carved or parsed illegal image could be present. For instance, if a user discovered and promptly deleted CSAM that someone else downloaded on his device, it would remain as a carved image.15 Contrariwise, if the user never discovered and deleted that material, it would appear as a parsed image following forensic examination.
Thus, the distinction between carved and parsed images has relevance for culpability: In individual cases, within the broader context of the case, whether an image was carved or parsed tells a story about that individual defendant’s actions relating to the illegal images. As a result, this distinction should be of the utmost concern to prosecutors and defense attorneys alike, and it should be of interest to courts in sentencing. Nonetheless, the Guidelines erroneously ignore the differences, considering every image as identical for the purposes of section 2G2.2(b)(7) and other sentencing enhancements.16
This Note argues that section 2G2.2(b)(7) of the Federal Sentencing Guidelines fails to capture individual culpability and that judges should use their discretion to adjust sentences in light of how the differences between carved and parsed images could implicate individual culpability. Other scholars have commented on various shortcomings of section 2G2.2(b)(7);17 this Note adds to the conversation by introducing the lack of differentiation between carved and parsed images as an additional concern. To the extent that the Guidelines are meant to capture culpability, section 2G2.2(b)(7) is flawed in treating carved and parsed images equivalently.
Part I discusses the Federal Sentencing Guidelines and section 2G2.2(b)(7) in depth. Part II provides an overview of forensic examinations, highlighting how most child sexual abuse offenders are convicted after a forensic examination, and also discusses the technical differences between “carved” and “parsed” images that are recovered during these examinations. Part III explores the lack of consideration of these forensic differences in the Federal Sentencing Guidelines and highlights the very limited case law in which judges have acknowledged those differences. That Part also argues that any legitimate purpose of section 2G2.2(b)(7) is undermined by its failure to consider the differences between carved and parsed images, obscuring discretionary determinations that should be made about individual culpability. Part IV argues that judges should incorporate a consideration of carved and parsed images into their individual determinations about an offender’s culpability in each case. This could be achieved by acknowledging the difference between carved and parsed images in section 2G2.2(b)(7) itself and encouraging judges to use this contextual evidence in the case to determine what that difference says about a defendant’s culpability.
I. The Guidelines
After a defendant has been convicted of a crime, the Federal Sentencing Guidelines provide judges with a recommended sentence based on the calculation of a variety of factors, including the seriousness of the offense and the offender’s criminal history.18 Culpability and proportionality, or the idea that a defendant should be punished in a way that reflects his crime and blameworthiness, at least partially motivated the development of the Federal Sentencing Guidelines.19 As it pertains to the first element — offense seriousness — the Guidelines provide forty-three levels of offenses.20 A higher offense level corresponds with crimes that have been deemed to be “more serious.”21 Each crime has a base offense level, but the Guidelines may call for increases or decreases to that level depending on the specific characteristics of the offense, leading to the final offense level.22 The final offense level then intersects with a defendant’s criminal history on the sentencing table to determine the defendant’s sentencing guideline range.23 For individuals convicted of possessing child pornography (which starts at offense level eighteen24), section 2G2.2(b)(7) provides specific increases for different numbers of images: an increase of two levels if there are ten to 149 offending images; three levels for 150 to 299 images; four levels for 300 to 599 images; and five levels for 600 or more images.25
This enhancement provision has been criticized by scholars and judges alike. For instance, Dean Jelani Jefferson Exum argues that calculating enhancements based on the number of images inaccurately “assumes that possessing more images means that a defendant has contributed more significantly to the child pornography market.”26 Jefferson Exum reasons that this provision is deficient “based on the failure of the Sentencing Commission to explain how the enhancements are in fact related to an incremental increase in the offender’s contribution to the child pornography market in a manner that justifies the increased sentencing range.”27 Even if the number of images possessed were proportional to culpability, section 2G2.2(b)(7) does a poor job implementing this in practice: Since the vast majority of offenders possess far more than 600 images,28 section 2G2.2(b)(7) fails to differentiate between the majority of offenders.
II. The Forensics
In the age of the internet, nearly all child pornography offenses are committed online; as a result, the vast majority of CSAM investigations also involve the use of digital forensics.29 Digital forensics is a way to collect and analyze digital evidence in a reliable manner, without changing any of the evidence.30 This process also ensures that the evidence is preserved and maintained in a manner that is admissible at trial.31
The digital forensic process can identify images that are on an electronic device, including illegal pictures and videos depicting child sexual abuse and exploitation.32 A wide variety of forensic tools can reveal such images.33 After forensic examiners have obtained the relevant information from a target device, any pictures or videos that they discover will be either “parsed” or “carved.”34 To understand the difference between these two categories, and their relevance to the Federal Sentencing Guidelines, it is first necessary to provide some background on the digital forensics process.
A. The Forensics Process
Though companies label the steps in a forensic examination differently, forensic examinations typically follow the same structure. After identifying a target device, examinations generally consist of three steps: (1) extraction or acquisition, (2) processing, and (3) analysis.35
1. The Extraction Stage. — The first step is known as “extraction” or “acquisition.”36 In this stage, forensic investigators use “specialized techniques to retrieve relevant data from identified devices.”37 For devices that are locked with a passcode or otherwise encrypted, the acquisition stage may also involve bypassing this encryption, and many forensic tools boast their ability to crack passcodes with ease.38 Forensic software ensures that the extraction process does not alter the data that is in the cell phone or other device in any way.39 After a digital forensics extraction is complete, a file is produced.40 The contents of such files are not readable by humans in this state,41 but any file present on the device during extraction is preserved and will remain unaffected by future user manipulation.42
2. The Processing Stage. — Since extracted files are not automatically in a readable form, they have to be processed.43 Processing puts the forensic images into “human-readable form” and in “easily reviewable categories.”44 At this stage, forensic analysts may customize their results, narrowing large files to ensure that the resulting data are only those that may be useful for the investigation.45 Examiners can specify if they would like to obtain carved photos and videos, and, if so, from which spaces on the device.46
3. The Analysis Stage. — Analysis is the final stage of the forensic examination process.47 During analysis, an investigator analyzes the processed data for evidence that is relevant to the investigation.48 There are several forensics programs that allow forensic analysts to conduct their analyses; some popular programs include Magnet AXIOM Examine49 and Cellebrite Inspector.50
B. “Carved” vs. “Parsed” Images
Most forensics tools allow examiners to identify media items through two separate processes: carving and parsing.51 An examiner can easily identify how a picture or video was recovered.52
1. Carving. — Carving is a recovery technique that can obtain images that an ordinary device user cannot access.53 Carved images are identified as part of the file carving process, which extracts files “without the assistance of the file system.”54 File systems are a method of data storage that can “store, retrieve, and update” files.55 Thus, file carving means that no file information is required to identify a particular file.56 Since carving does not require assistance from the file system, it overlooks the files themselves, allowing the process to identify modified or deleted data.57 As a result, carved images do not contain the metadata that is typically associated with parsed images, since metadata is stored in the file system.58 Carved images do not have file names or time stamps.59
Because carving does not rely on file information, the carving process can also identify renamed, relocated, and hidden data.60 In addition to deleted files, carving can identify data that was at one point visible on a website.61 This data is stored as temporary internet files (“cookies”) so that a webpage will load more quickly the next time that a user accesses it.62 Carved images might also include pop-ups and advertisements.63 Carved files can be recovered from a variety of areas outside of the file system, including unallocated space, free space, and slack space.64
Unallocated space is an area on the device that stores files without any file information, such as file name or creation date, even though that metadata may have been associated with an image if it were in the file system.65 In other words, it is a “physical space on [a] hard drive that does not belong to a partition.”66 A partition is a division within a computer’s hard drive that is treated as a separate unit by file systems and operating systems, and a device may have multiple partitions.67 Thus, information outside of a partition in unallocated space is “not recognized by the operating system,” meaning that any file in unallocated space is “generally unusable in regular means.”68 There are some ways that a user could access unallocated space, but these would typically require an advanced understanding of computers.69 For instance, unallocated space could be used if the user creates his own partition within that unallocated space, or if they expand an existing partition into that unallocated space.70 Other ways to write on unallocated space require “more advanced techniques.”71 Figure 1, below, shows unallocated space in the Windows disk manager.72
Figure 1: Example of a Windows Disk Manager and Its Storage, Including Unallocated Storage
Images can also be recovered from free space. Such space is “part of the allocated space on a drive that the operating system can use to write data to.”73 This space may be entirely empty, or it may be occupied by information from a deleted file.74 Free space includes information about deleted files because “deleting files does not physically remove them from the drive”; rather, it changes the status of the space they were occupying to “free,” allowing the operating system to use it for something else.75 As a result, files that were deleted can be identified by carving free space, that is, until a new file overwrites that data.76 When a user is wondering how much storage they have left on their device, they will typically reference their free space. To identify the amount of free space on a device, a user can simply navigate to their device’s properties (Figure 2).77
Figure 2: Example of the Allocation of Free Space and Used Space in a Device’s “Properties” Viewer
Lastly, images can also be recovered from slack space.78 Slack space occurs when there is a difference between a stored file’s actual size and the amount of space set aside by a computer system to store the file.79 Slack spaces are the portions of unused space that occur on the disk as a result of these file size differences.80 Slack space may include previously deleted files that can be recovered during the carving process if the files were previously stored in that space before they were deleted.81
In short, a carved image is an image that is not currently in an accessible area of the device (that is, for a user with a typical level of technical expertise) at the time of the device’s extraction. However, it would have been in an easily accessible area (like in the user’s camera roll, or in an attachment in a message thread) at one point. The image may be carved because the file was deleted, or because it is otherwise located in unallocated, free, or slack space. Often, if users buy a device secondhand, there may be image remnants in places like unallocated space; the users themselves would never be aware of this image, since the image in unallocated space is not easily accessible to the user. On the other hand, the presence of carved images in conjunction with evidence that a defendant created a hidden partition on his device may indicate that he was intentionally trying to hide nefarious activities. Even if an image’s status as “carved” is not sufficient alone to prove that a defendant is blameless or blameworthy, evidence of an image’s recovery method, when combined with other evidence in the case, helps us understand a defendant’s culpability. As a result, prosecutors, defense attorneys, and courts should consider it.
2. Parsing. — Unlike carved images, parsed media is identified within the file system itself.82 Most of the data recovered through the parsing process are items that an ordinary, everyday user might know are on their phone: pictures and videos saved in their camera roll, location history, search history, and account information saved in their settings.83 The image is on the device of extraction, and it has not been deleted. Often, a parsed image means that the user saved the image to their camera roll (or another storage location on their device), sent or received the image through a messaging application, or sent or received the image as an attachment in an email.84
III. The Current Role of Forensics in Sentencing
The difference between carved and parsed images can provide further granularity about an offender’s likely actions in a particular case. For instance, if the illegal images identified on a user’s device were all carved images, this means that the images were not accessible to a typical device user prior to the investigation. Many innocuous reasons could explain the existence of CSAM images in carved files. For example, perhaps the user bought a secondhand device, and the images had been deleted before that user obtained the device. Alternatively, the user might have accessed abusive material by mistake and immediately deleted the files upon realizing what those files contained. Similarly, if a pop-up advertisement appeared on a user’s device that contained CSAM, this image would often be stored in unallocated space as a temporary internet file, even if the user never sought out sexually exploitative imagery of children, if the user immediately closed such a pop-up, and if that user never saved the image.
On the other hand, the presence of carved images might indicate that a highly sophisticated user had taken steps to hide his actions and avoid detection. Some CSAM offenders have conducted their illegal activities entirely on separate computer partitions so that other users of the device would not find the images, suggesting an additional level of intentionality to view illegal imagery.85 For example, former reality television star Josh Duggar was convicted of possession of child pornography after he created a separate Linux partition on his office computer so that his illegal images would not be detected by a computer program that identified and blocked illicit images.86 In that case, the fact that the images were located on a hidden partition suggested that the perpetrator may have gone out of his way to avoid detection by both authorities and pornography monitoring software, which spoke to the defendant’s intentions and sophistication.87 Thus, an image’s forensic recovery method tells a crucial aspect of the story of the defendant’s conduct and is inseparable from his culpability.
Whether an image was carved or parsed can fill in additional details of the defendant’s crime. Moreover, in conjunction with additional evidence — such as an offender’s online presence, technical knowledge, or purchase history — a judge should be able to distinguish between innocuous and pernicious carved images. Regardless of precisely how an image winds up in unallocated, free, or slack space, there is a meaningful difference between a carved image and a parsed image, and this difference lends important context to a defendant’s culpability and sentencing.
So how do the Federal Sentencing Guidelines take this important distinction into account? Short answer: They don’t. Section 2G2.2 does not contain any mention of the words “carve,” “parse,” or “forensics.”88 This may be because the Guidelines are outdated. When the Guidelines were first established in the 1980s, CSAM was not primarily traded via the internet, but rather via magazines, physical disks, photos, and flash drives, and it was often exchanged in person or through snail mail.89 This reality is reflected in the Guidelines themselves; notably, the enhancement in section 2G2.2(b)(6) for “use of a computer” seemingly responds to a world in which a meaningful number of child pornography offenders did not use a computer or digital device to commit the crime.90 If the Guidelines are a relic from an era in which many offenders did not use a computer, then it should be unsurprising that the Guidelines do not reflect a nuanced understanding of the forensic differences between individual images that might be identified on a user’s device. However, at a time when six billion people — approximately seventy-three percent of the global population — use the internet,91 CSAM offenses will naturally occur more frequently online,92 forcing the resulting investigations to rely on digital forensics. The prevalence of CSAM online is also evidenced by outside reporting agencies: The National Center for Missing and Exploited Children received reports of 62,992,859 suspected online CSAM files in 2024 alone.93 As a result, the Guidelines must catch up to the digital age. Section 2G2.2(b)(7) should be revised to reflect the reality that digital forensic examinations identify evidence in a large majority of CSAM cases, and judges should be encouraged to view evidence of the image’s forensic recovery method as a pertinent indicator of culpability alongside other contextual evidence that sheds light on that culpability.
This Part uses a few cases to highlight misunderstandings about the forensic differences between carved and parsed images. Due to the relative infrequency of lengthy sentencing opinions in general,94 there are few cases that explicitly discuss the difference between carved and parsed images in the context of considering the section 2G2.2(b)(7) sentencing enhancement. However, other issues on appeal demonstrate how courts unfairly consider carved images to be equivalent to parsed images in the context of possession of child pornography offenses.95 Judges across the country are also not taking into account the difference between carved and parsed images for section 2G2.2 sentencing-enhancement purposes.96 Other judges more explicitly discount the difference between carved and parsed images in the context of the Sentencing Guidelines, even if the defendants do not always specifically challenge the “number of images” provision in section 2G2.2(b)(7).97 Overall, however, the issue of carved versus parsed images still comes up relatively rarely, even in the context of other appellate issues. This rarity alone suggests that defendants, counsel, and judges are not as aware as they should be about these forensic differences. After surveying some of the few salient cases on this issue that do exist, this Part argues that the forensic difference between carved and parsed images counsels revising section 2G2.2(b)(7).
A few cases demonstrate the need for judicial consideration of the difference between carved and parsed images. First, in United States v. Davis,98 the court failed to consider the unique forensic attributes of a carved image, functionally treating it as equivalent to a parsed image when establishing possession.99 However, the court’s reasoning in that case demonstrates that judges can leverage context to differentiate between culpable and innocuous carved images, making their distinction all the more valuable. Second, United States v. Messner100 demonstrates how the lack of consideration afforded to the difference between carved and parsed images when considering sentencing enhancements, at both the trial and appellate level, can lead to unintuitive sentencing results. Third, in United States v. Keefer,101 the court explicitly upheld a sentencing enhancement under section 2G2.2(b)(7) based on images that were counted from unallocated space.102 In upholding the enhancement, however, the court emphasized the relevant differences between carved and parsed images, seemingly holding the government to a higher standard of proof for carved images than parsed ones.103 The discussion in Keefer underscores the need to differentiate between carved and parsed images and suggests that the Sentencing Guidelines’ failure to do so is an inherent flaw.
A. United States v. Davis: Convicting Based on Carved Images Alone
In United States v. Davis, the Seventh Circuit held that illegal CSAM images recovered from “carved space,”104 without any parsed images, were enough to sustain a conviction of possession of child pornography under 18 U.S.C. § 2252A(a)(5)(B).105
In that case, a jury had found Edward James Davis guilty of one count of possession of child pornography.106 Three years earlier, FBI agents began investigating CSAM images that had appeared on the website Shutterfly.107 The FBI executed a search warrant on a Shutterfly page titled “bwbb722,” which had dozens of members who could access the page only after being invited.108 One of those users, named “Jimmy D,” had posted “over 2,000 images to the site” on August 30, 2013.109 Of those 2,000 images, FBI agents testified that at least 1,000 “depicted minors engaging in sexual intercourse with both minors and adults.”110 The other images also depicted minors in “sexually suggestive poses” or “partially clothed.”111 After this discovery, FBI agents determined that the “Jimmy D” account was associated with [email protected], an email address registered to the defendant.112 FBI agents then searched Davis’s home in 2014, which resulted in the seizure of one laptop and one desktop computer.113
An FBI special agent then performed a forensic examination of the two seized computers.114 The agent “testified that she found 350 images of child pornography on the desktop computer’s hard drive and 700 images of child pornography on the laptop’s hard drive.”115 All of “[t]hese images were located in the ‘carved space’ of the hard drives,”116 meaning that none of the images were parsed. At trial, an FBI forensic examiner described how carved space works, “testif[ying] that when a user deletes an image from a computer, it will remain in the carved space on a hard drive, even though the typical user may no longer be able to see or access it.”117 Ultimately, the jury convicted Davis of possessing child pornography.118
On appeal, Davis challenged the sufficiency of the evidence for his conviction, “argu[ing] that the government did not present sufficient evidence to establish that he knowingly possessed the pornographic images located on the seized computers.”119 To sustain this conviction, “the government was required to prove that Davis knowingly possessed material that he knew to be child pornography.”120 Davis argued that the government’s evidence was insufficient in this regard since all of the relevant images were located in the carved space of his hard drives.121 He emphasized “that the government presented no evidence to demonstrate that he had knowledge of the carved space’s function or location,” and he argued “that the jury could not reasonably conclude that he knew those images existed on his computer” without such evidence.122
The Seventh Circuit found this argument unpersuasive, holding that the government had presented sufficient evidence to convict Davis of possession of child pornography with images located exclusively in carved space.123 The court reasoned that Davis was not charged with possessing the images in 2014 when his computers were searched, but instead he was charged with possessing them “in or around August 2013,” or the month when they were uploaded to Shutterfly.124 Moreover, testimony from FBI agents emphasized that the presence of the images in carved space meant that they had been “deleted from another location on the hard drive where they were stored at a previous time.”125
In making this conclusion, the Seventh Circuit overlooked the important context that carved images provide. Notably, the panel did not acknowledge that carved images, by their nature, contain no metadata like date or time stamps, in contrast with parsed images.126 Similarly, it is impossible to determine when a file was deleted.127 As a result, a defendant could argue that he never had access to the images, especially if he had purchased the device secondhand or shared the device with another person. Without metadata, it is essentially impossible to prove from the images alone that they were accessible to an ordinary user at a time when the defendant had access to that device.
However, extrinsic context may support a conclusion that carved images were accessible at a specific time, before deletion. The court in Davis observed that “the government’s evidence demonstrated that the images had been uploaded from Davis’s computers to the Shutterfly site in August 2013.”128
Though the presence of carved images indicates that the images were present on the device at some point, the Seventh Circuit did not sufficiently emphasize the corroborative evidence as consequential. Without this distinction, the judges may have unintentionally suggested that the presence of carved images alone — without the additional context of the Shutterfly data in this case — was sufficient to determine that they were present on the device in August 2013. This is concerning. Imagine an analogous case with no Shutterfly evidence: The Seventh Circuit suggests that a defendant could theoretically be convicted on nothing more than images that may have been present on the device several years prior and deleted by a previous user, and the prosecution would not need to prove that the defendant had access to the offending images. In light of this, the Seventh Circuit’s implication that carved images alone might be enough to sustain a conviction for the possession of child pornography ignores relevant differences in the factual circumstances that carved and parsed images reveal.
Though Davis did not concern the enhancement provision in section 2G2.2(b)(7) in particular,129 the Seventh Circuit’s presumptions about carved images also bear on the Sentencing Guidelines. By holding that images obtained exclusively from carved space were sufficient to uphold a conviction of possession of child pornography, the Seventh Circuit effectively treated carved images as equivalent to parsed images. The panel found little relevance in the forensic distinctions between carved and parsed images and was satisfied simply that the images were accessible on the device at some point, and not necessarily at a time when the offender possessed the device. If carved images, just like parsed images, are enough evidence to demonstrate that the defendant violated the statutory provision, then, by extension, the same logic could lead sentencing judges to count the number of parsed images and carved images in the same way for the purposes of section 2G2.2(b)(7).
B. United States v. Messner: Enhancements Based on Carved Images Alone
In United States v. Messner, the First Circuit held that defense counsel’s failure to object to a sentencing enhancement because the relevant image was carved rather than parsed did not prejudice the defendant.130
In Messner, Karl Messner pled guilty to one count of possessing child pornography.131 He was then sentenced to forty-six months of incarceration, which was below the Guidelines’ range.132 On appeal, Messner claimed ineffective assistance of counsel, since his counsel “fail[ed] to object on constitutional grounds to a four-level Guidelines enhancement,”133 reasoning partly that his counsel should have objected to the enhancement because the relevant image was carved rather than parsed.134
At sentencing, Judge Laplante, the presiding district court judge, determined that section 2G2.2(b)(4), an enhancement for the sexual abuse of a toddler, applied to Messner’s offense based on a single image that was identified in the carved space on his device.135 Despite this determination, “Messner’s counsel did not object to any of the Guidelines calculations, thus conceding that . . . the four-level enhancement under section 2G2.2(b)(4) was legally sound.”136 In other words, Messner argued that his counsel should have raised the point that a carved image is relevantly distinct from a parsed image. His attorney could have argued that this difference rendered “the four-level enhancement . . . too harsh.”137 Messner suggested that a four-level enhancement based on a single image in a nonaccessible portion of his hard drive was unfair and defied the logic of the sentencing enhancements.138
The First Circuit rejected Messner’s argument, finding counsel’s failure to raise the image’s carved status not sufficiently likely to affect Messner’s sentence.139 In particular, the First Circuit did not find it notable that an image warranting an enhancement under section 2G2.2(b)(4) was carved, since “all the [other] images [leading to Messner’s conviction] . . . were also carved.”140 The panel also mentioned that “the district court was aware of Messner’s position that carved photographs should bear less weight,” but that did not affect its sentencing calculation.141 Though the district court applied the four-level enhancement, the court also applied a two-level downward variance.142 This departure was not based on any consideration of the difference between carved and parsed images, but rather “was based on the court’s belief in the harshness of the sentence relative to the number of images involved.”143 Thus, even though Judge Laplante must have determined the Sentencing Guidelines did not adequately capture the sentence that Messner should receive, he did not take the forensic technicalities of a carved image into consideration when making this determination.
Though the court in Messner did not consider a carved/parsed distinction in the context of section 2G2.2(b)(7) specifically, the lower court’s apparent dismissal of the relevance of carved images in the context of another section 2G2.2 sentencing enhancement is telling. While not passing judgment on the merits, the First Circuit effectively approved a sentencing enhancement based on a single image that was located in an inaccessible portion of the defendant’s hard drive. Its unwillingness to further explore the carved/parsed distinction beyond the district court’s findings exposes a lack of appreciation for the important differences between carved and parsed images and could set a dangerous precedent for counting carved images as equivalent to parsed images under section 2G2.2(b)(7).
Similarly, Judge Laplante’s lack of consideration for the carved status of the image for sentencing purposes — despite his willingness to apply other downward departures144 — is also salient. One can reasonably infer that Judge Laplante, by applying downward departures, was concerned with applying a fair sentence based on the individual characteristics of Messner’s offense — unlike some judges, who would have strictly applied the Sentencing Guidelines regardless of mitigating circumstances not recognized in the text.145
Thus, the Judge’s failure to take the carved nature of the image into account leads to one of three conclusions: (1) Judge Laplante believed that, in general, it is fair to impose equal sentences on two offenders with identical images — one with a carved image that was not accessible on the device at the time of extraction, and the other with a parsed image that was accessible on the device at the time of extraction; (2) Judge Laplante believed that, in the context of this case, the image’s carved status was not an indicator of diminished culpability; or (3) Judge Laplante did not understand the difference between carved and parsed images, but he would have viewed the difference as relevant if he had understood it and if counsel had raised it.
If the first conclusion about Judge Laplante’s reasoning is true, then he had a mistaken view of the implications of carved images for culpability. The carved or parsed status of an image, in context with the other facts about the case, reveal information about culpability that should be taken into account when determining a defendant’s sentence. If the judge’s reasoning mirrored the second possibility, the outcome emphasizes the importance of judges considering the difference between carved and parsed images only in the context of the rest of the case. The bare fact that the image was carved does not itself determine whether a defendant at one point had access to it. But in this case, that Messner admitted to accessing and saving child pornography146 likely led the judge to believe that Messner did have access to it at one point, given the commonsense conclusion that a known possessor of some CSAM is much less likely to have unintentionally had this additional CSAM on his device than one who was not a confirmed CSAM possessor. Finally, if the third possibility applied to Messner’s case, then section 2G2.2(b)(7) should be changed to help judges understand the difference. By not expressly including the distinction between carved and parsed images in its text, section 2G2.2 allows judges to treat carved and parsed images equally without considering the relevant distinction between the two.
Messner thus demonstrates the potential undesirable consequences of the Sentencing Guidelines’ failure to consider the difference between carved and parsed images. Overlooking the difference between carved and parsed images risks ignoring key evidence about a defendant’s individual culpability and actions. Consider three offenders, all with the same illegal image and criminal history. One offender has access to the image in his camera roll; another has never accessed that image, but it was at one time accessible on his device’s camera roll; and the third took additional steps to avoid legal detection by deleting that image. The Sentencing Guidelines, and section 2G2.2(b)(7) specifically, would fail to capture any difference in culpability between these three offenders, counseling for the same sentence for all of them — a conclusion that defies intuition. Moreover, since the Guidelines do not differentiate between carved and parsed images, district court judges may overlook arguments that are premised on this distinction. In Messner, the judge noticed that something may have been misaligned between the offender’s culpability and the ultimate sentence,147 but it would have been clearer why this was the case if the judge had been forced to account for the difference between carved and parsed images because that distinction was included in the Guidelines. In other words, since the Guidelines do not emphasize the difference between these two image recovery methods, many district court judges may never learn the relevance of carving and parsing, including how this difference may warrant different sentences for different offenders.
C. United States v. Keefer: Counting Thousands of Carved Images for Section 2G2.2(b)(7)
In United States v. Keefer, the Sixth Circuit upheld a sentencing enhancement under section 2G2.2(b)(7), even though 1,215 of the 1,254 images that were counted for purposes of that provision were identified in unallocated space of the defendant’s computer.148
In Keefer, Allen Keefer was convicted, among other charges, of one count of possessing child pornography in violation of 18 U.S.C. § 2252A(a)(5)(B).149 He was subsequently sentenced to 210 months in prison, which involved a five-level enhancement under section 2G2.2(b)(7).150 Keefer’s offense surpassed the numerical threshold of 600 images only because the police discovered 1,215 images in unallocated space on his computer; in allocated space, police discovered only 39 images.151 Though not stated explicitly in the Keefer opinion, the identification of the CSAM images in unallocated space means that the 1,215 identified images must have been carved.152
On appeal, Keefer argued that it was unreasonable to apply the five-level enhancement for “600 or more images” under section 2G2.2(b)(7) “based on the presence of images in the unallocated space on his computer.”153 Keefer argued that he had no knowledge of the images that were in unallocated space.154
Despite these arguments, the Keefer court upheld the application of the sentencing enhancement based on the images in unallocated space.155 Unlike in Davis and Messner, however, the Keefer court did find that the carved status of the images merited special consideration: The panel emphasized that “[t]he only issue [was] whether the testimony sufficiently established that Keefer did in fact view the images found in his unallocated space” at some point.156 Here, the Sixth Circuit emphasized that the prosecution had the burden to demonstrate that the defendant did actually view the images in unallocated space, indicating that the possession of child pornography alone, without viewing, cannot justify a sentence enhancement under section 2G2.2(b)(7), at least when it comes to images that have been carved and, thus, may not have been viewed by the accused.157 Citing an earlier decision in the same case, the Sixth Circuit underscored this point when it determined that “[p]resence . . . does not equate to knowing possession.”158 The Keefer court also emphasized in dicta the numerous innocent ways that a carved image could be found on a defendant’s device:
[A] defendant could counter the . . . evidence by explaining that he had opened full-sized email attachments with benign names only to discover and immediately delete child pornography. Or he could explain that he downloaded a folder of photographs believing them to be adult pornography, only to discover upon opening the files and immediately deleting them that they contained something else. Both of these scenarios would explain the presence of full-sized images in a defendant’s unallocated space but would be insufficient to justify the enhancement.159
Thus, if the government had failed to prove that Keefer himself viewed those carved images at some point, then the Sixth Circuit would likely have held that these unallocated images could not have been permissibly considered for the number of images enhancement in section 2G2.2(b)(7).
The court’s emphasis on the government’s ability to demonstrate that Keefer did, in fact, view the carved images in question underscores that the Sixth Circuit does have an adequate appreciation for the difference between carved and parsed images. Based on Keefer, the Sixth Circuit seems to understand that the nature of carved images, being inaccessible to the ordinary user at the time of a device’s extraction, requires that extra caution be taken to ensure that a defendant actually viewed those images when considering whether those images can properly be considered for sentencing enhancements. Though it is praiseworthy that the Sixth Circuit correctly identified the relevant distinction between carved and parsed images for sentencing purposes, its extended discussion also exposes how the Sentencing Guidelines do not reflect the reality of child pornography offenses in the digital age. The misalignment between section 2G2.2(b)(7) and the reality of CSAM investigations in the twenty-first century leaves judges to try and fit a round peg into a square hole, encouraging the most extreme “number of images” enhancement to apply even if the number of accessible images was far lower, or even if that enhancement does not mirror a defendant’s level of culpability in a particular instance.
IV. Where Do We Go From Here? The Case for Judicial Discretion and Considering Carved and Parsed Images
Collectively, Davis, Messner, and Keefer expose the irrationality of treating carved and parsed images equivalently any time a court must determine whether an individual had access to particular images, including in counting images for the purposes of section 2G2.2(b)(7) in particular.
There are meaningful differences between carved and parsed images. Compared with images in allocated space, there are more innocuous reasons why CSAM may wind up in the unallocated space of a user’s device, providing ammunition for defendants in some cases. Since unallocated space is inaccessible to the average device user, it is more likely that a defendant was genuinely unaware of the presence of illegal images in his unallocated space than in his allocated space. This argument is defense friendly, suggesting that images in a defendant’s unallocated space may not be the result of any morally blameworthy conduct and should thus be reflected in a reduced sentence. However, the distinction between carved and parsed images can bolster prosecution narratives as well. For instance, images in unallocated space may indicate that those images were intentionally deleted by the user, perhaps in an attempt to cover up evidence or avoid detection.160 Some of the most sophisticated offenders might also be accessing their illegal images in a hidden partition.161 The possibility for the government to make this type of argument suggests, again, that there is something meaningfully different about carved images and parsed images. Since the forensic origin of an image can provide additional context about a defendant’s actions, it should be considered as relevant information alongside other evidence at sentencing.
The Sentencing Commission can solve this problem by revising section 2G2.2(b)(7) to acknowledge the distinction between carved and parsed images, encouraging judges to consider that difference when paired with other evidence indicating culpability in each individual sentencing decision. Since carved and parsed images reveal different things about an offense that may be relevant to sentencing, section 2G2.2(b)(7) (which treats them as equivalent) fails to capture important information about culpability that is relevant to sentencing. If sentences are meant to capture culpability in a meaningful way, it is important for judges to use all information at their disposal to discern the most appropriate sentence in each case.162 After all, each defendant’s actions and situation are unique. Since the difference between carved and parsed images may relate to a defendant’s conduct and his culpability, it should be among the evidence considered by judges in determining the right sentence for that defendant.
To most effectively move away from the arbitrariness of section 2G2.2(b)(7) and to encourage discretion in sentencing, judges and attorneys should be educated about digital forensics and the difference between carved and parsed images. Though the Sixth Circuit recognized the relevant distinction in Keefer, such a recognition is relatively rare. As seen in Davis and Messner, district and appellate judges alike seem to dismiss any distinction based on the image’s recovery method. It seems likely that this oversight has occurred because judges are (understandably) a bit confused about the forensic technicalities of it all.
Conclusion
Though many positive advancements have accompanied the digital age, the internet has also led to the proliferation of CSAM. Now, when the vast majority of child pornography offenders are convicted based on images that they viewed, possessed, received, or distributed online or using a digital device,163 new complications arise. Unlike physical photographs and videos, which are possessed until they are physically destroyed, digital CSAM may unknowingly lurk in one’s devices. Moreover, while a defendant would need a physical space to hide physical CSAM, an offender in the digital age could also bury his crime in the depths of his computer. The digital age empowers offenders with a new way to hide their illicit activities, while also creating situations in which one might possess CSAM without ever becoming alerted to its presence. While carved images are located in unallocated, free, or slack space and are inaccessible to an ordinary user when the device is forensically extracted, parsed images are located in allocated space and are easily viewable by any user at the time of extraction. That difference has implications for an offender’s culpability. As a result, counting both carved and parsed images as equal for a “number of images” enhancement erases evidence of culpability in individual cases. This issue is just one of many reasons why the Guidelines of section 2G2.2(b)(7) should be revised to reflect the digital age, and why carved and parsed images should be used as another indicator of culpability when judges use their discretion to sentence an offender for the possession of CSAM.