ORIGINAL PROCEEDINGS: Petition for Writ of Review. Writ issued. (Super. Ct. No. LF007847A).
The opinion of the court was delivered by: Cantil-sakauye , J.
CERTIFIED FOR PUBLICATION
At the direction of the California Supreme Court, we consider two issues regarding the sufficiency of the evidence to support defendant Michael James Tecklenburg's misdemeanor convictions of knowing possession or control of child pornography in violation of Penal Code section 311.11, subdivision (a).*fn1 We conclude substantial evidence supports his convictions and affirm the judgment.
After a jury trial, defendant was found guilty of six misdemeanor counts of knowing possession or control of child pornography in violation of section 311.11.*fn2 The trial court suspended imposition of sentence and placed defendant on three years' formal probation and ordered defendant to serve 90 days in county jail. Defendant was also ordered, among other things, to register as a sex offender pursuant to section 290. Defendant timely appealed. We next describe the procedural route of the case and the issues framed for us by the Supreme Court.
On appeal to the appellate division of the San Joaquin Superior Court, defendant claimed (1) there was insufficient evidence to show it was defendant who possessed the child pornography found on the computers that were analyzed, (2) there was insufficient evidence to show he knowingly possessed child pornography in the absence of evidence that he knew of the existence of the computer's temporary Internet files, and (3) the reporter's transcript of the trial contained too many omissions to permit fair consideration of his appeal. The appellate division affirmed the judgment.
Defendant petitioned the appellate division for rehearing and applied for certification for transfer to this court. (Cal. Rules of Court, rules 8.708(c), 8.1005.)*fn3 The appellate division denied both the request for rehearing and the application for transfer. Defendant then petitioned this court directly for transfer. (Code Civ. Proc., § 911, rule 8.1008(b).) We denied his petition for transfer. Rule 8.500(a)(1) expressly precluded defendant from petitioning the California Supreme Court for review*fn4 of our decision to deny transfer.
Defendant filed an original "petition for writ of mandate or other appropriate relief" in the Supreme Court, claiming at this point he had no adequate remedy at law and that relief from the Supreme Court was "his only remaining avenue for justice for himself and a fair trial for other persons who might in the future be charged with a violation of Penal Code § 311.11[, subd.] (a)." Defendant repeated the same issues he raised on appeal to the appellate division and asked the Supreme Court to direct this court to transfer his appeal to ourselves (relief precluded by rule 8.500(a)(1)).
At the direction of the Supreme Court, the Attorney General filed two informal oppositions to defendant's petition. The Attorney General argued the prerequisites for extraordinary relief had not been met, there was substantial circumstantial evidence to support defendant's convictions, and the record was adequate for review.
The Supreme Court refiled defendant's writ of mandate petition "as a petition for writ of certiorari sub nom. 'Tecklenburg v. Appellate Division, Superior Court for San Joaquin County'" and granted it as such. The Supreme Court then transferred the cause to us with directions that we issue the writ of review*fn5 to the appellate division and decide the following questions: "(1) Was the evidence sufficient to establish [defendant's] personal possession of the child pornography files on his family's computer? (2) May [defendant] be convicted of possessing child pornography stored in a computer's cache files absent some evidence that he was aware those files existed? (See United States v. Kuchinski (9th Cir. 2006) 469 F.3d 853; Barton v. State (June 21, 2007, A07A0486)  S.E.2d , 2007 WL 1775565.)"
After the unusual procedural route of the case, we complied with the orders from the Supreme Court, vacated our order denying transfer, issued the writ of review as directed and now proceed to consider the questions posed by the Supreme Court.*fn6
We start with a review of the evidence presented at defendant's trial.
On September 9, 2004, the San Joaquin County Sheriff's Department received the hard drive from defendant's home computer to review in connection with another investigation. The computer had been kept in the kitchen of defendant's family home. The computer was used by defendant, possibly defendant's wife, and at least several of his five children. The computer hard drive was given to Dale Rogers, an examiner for the High-Tech Task Force in Sacramento.
Rogers explained that a hard drive is a storage medium for the content of the computer, that files deleted from a computer are not gone from the computer, that such deleted files remain in unallocated space on the hard drive until they get overwritten in whole or in part, and that such files can be recovered forensically from the unallocated space. Files recovered from unallocated space will not have their file name or date/time stamps. He also explained that computers have a folder, generally in their operating system, for temporary Internet files (TIF). Every time a Web page is accessed on the Internet by the computer, the computer automatically saves the material, without any affirmative action by the computer user, in a TIF.*fn7 If the TIF storage is filled up, it will spill over into unallocated space. Periodically, older TIF may be automatically deleted and become unallocated. Finally, TIF may also be manually deleted. Data or images found in unallocated space on a hard drive may, therefore, result from deleted, saved or downloaded files or come in various ways from TIF. There is often no way to determine the original source, but it can be said that at some point it was on the computer screen.
When Rogers received the hard drive from defendant's home computer, he went through standard forensic procedures to recover stored documents, graphics, e-mail, Internet history and other basic files from the hard drive. In the course of his examination, he found what he described as "pornography and incest material." Some of the pornographic material depicted obviously young children. Rogers made a copy of the hard drive to document it.
Rogers testified regarding five sexually explicit images of young girls (People's exhibits 2-6) recovered from unallocated cluster space on the hard drive of the home computer. There were six representations of the image in People's exhibit 2 on the hard drive: three thumbnails (a small picture of the main image) and three larger images. In his opinion, the image had appeared on the computer screen three times. People's exhibit 3 contained an image of the same young girl as in People's exhibit 2, taken from a further distance away. On People's exhibit 6, the image had the words "dark collection 141" embedded on the picture, indicating in Rogers's opinion that it was one of a series of child pornographic pictures downloaded from the Internet.
Rogers also testified regarding a further 30 or so images recovered from the home computer's TIF. One of these images (People's exhibit 7) included text identifying a specific Web site that offers images of "little" virgins. Other sexually explicit images were surrounded by a frame, again indicating to Rogers that they were part of a series from a child pornography Web site. Similarly, additional recovered images shared common characteristics indicating they were also part of a series of photographs. Some of the images contained references to "Lolita," a common term used to describe underage girls. One image included a banner that read "age14schoolgirls." One of the images was titled "Lola69topless." Another image contained text that included, among others, "daddy's babes," "Lolitas with old men," "young Lolita's shaved," and "exclusive collection incest pics." Another image apparently came from a Web site --which we do not identify by name -- that offers to "shock" viewers with images of incest. A couple of the images were repeated on the hard drive, indicating they had come in twice. Many of the images depicted explicit sexual acts between adults and young children. All the images came off Internet Web pages that were viewed on the home computer. Rogers could tell a number of the images were not pop-ups*fn8 because of their size and format.
Rogers recovered several Web pages from the home computer that had the actual words being used to search the Internet, including incest misspelled "insest,"*fn9 multiple references to "Lolita" and "underage." He found a search engine -- which we do not state by name -- that identifies Web sites offering images of "monster" "cocks." He noted 51 Web links to sites that appeared from their title to contain child pornography. Some of the names on the Web searches matched the names on the recovered images from the site.
Rogers found a "cookie" file*fn10 on the home computer with the file name of "Michael-Tecklenburg@www.theincest[2.txt[.]" The name was taken from the registered user of the computer. It did not necessarily indicate who was sitting at the keyboard at the time it was downloaded.
Rogers found a search engine Web page with a "softcom" banner at the top and the term "insest" placed in the search box. Defendant's e-mail address was at "softcom.net." The e-mail addresses of other family members were not at ...