Unallocated Space in Military CSAM Cases: Why “Deleted” Files Can Decide the Outcome

A forensic report in a military child pornography case often reads like a verdict. Hundreds of images “recovered” from a laptop, phone, or external drive.

What the report doesn’t always make clear is where those files came from. That detail can change everything.

When files are recovered from unallocated space — the part of a drive that holds deleted data — the government has a real legal problem in a possession case. Military and federal appellate courts have held that files a service member cannot see or open without forensic software may not prove knowing possession. Viewing charges are different. The Court of Appeals for the Armed Forces has upheld a viewing conviction based on deleted files — because other evidence tied the service member to them. But in a case without such other evidence, the defense is live. CSAM Defense

What Is Unallocated Space?

When a user deletes a file and empties the recycle bin, the computer doesn’t erase the data. It simply marks that space as available. Until new data overwrites it, the old file — or pieces of it — stays on the drive.

Investigators recover that data with specialized forensic tools. The ordinary user can’t. There is no folder, no icon, and often no file name.

Recovered files frequently lose the information that matters most at trial: where the file came from, when it was saved, whether it was ever opened, and when it was deleted.

Possession and Viewing Are Different Offenses

Possessing and viewing child pornography are separate offenses under Article 134, UCMJ. Both require proof that the accused acted knowingly and wrongfully. The difference is in what else the government must show.

Possession requires control

The Court of Appeals for the Armed Forces has explained that possession means exercising control over something — and that it must be knowing and conscious. United States v. Navrestad, 66 M.J. 262 (C.A.A.F. 2008).

A file that was deleted, cannot be opened, and could only be recovered with tools the service member never had is difficult to call “controlled.”

Viewing does not

In United States v. King, 78 M.J. 218 (C.A.A.F. 2019), CAAF explained that an accused’s inability to access data may be fatal to a possession charge but does not similarly undermine a viewing charge. Viewing requires only that, at some point, the accused knowingly and wrongfully viewed the image.

The result: a deleted file can fail to prove possession during the charged period and still support a viewing conviction — if other evidence supplies the link.

The Real Battleground: Actual Knowledge

Whether the charge is possession or viewing, the government must prove the service member actually knew — that the file was there, or that he saw it. A file in unallocated space, standing alone, says very little about what anyone knew.

In King, CAAF affirmed the viewing conviction because of the evidence surrounding the files: searches using terms associated with child pornography, the airman’s own admissions, a password-protected computer, the images’ presence in his user account, and duplicate copies suggesting repeat visits.

The court acknowledged that files in a user-created folder carry more weight than files in a cache or unallocated space, and noted that the differences between cache and unallocated-space evidence may matter in future cases. The government also conceded at oral argument that the mere presence of images, without that kind of surrounding evidence, would be “a far harder case.”

That is where the defense focuses: on the surrounding evidence, not just the files.

Because knowledge is an element, an honest mistake or ignorance of fact — such as not knowing a file was on the device — is a defense even if it was not reasonable. R.C.M. 916(j)(1).

What the Courts Have Held

Federal courts

• United States v. Flyer, 633 F.3d 911 (9th Cir. 2011). The Ninth Circuit reversed a possession conviction based on images found only in unallocated space. The government had no evidence the defendant knew the files were there or had the software to access them. Deletion alone, the court held, did not prove knowing possession on or about the charged date.
• United States v. Moreland, 665 F.3d 137 (5th Cir. 2011). On a shared computer, access to the device alone was not enough. The government needed additional evidence tying the defendant to the images.

Military appellate courts

• United States v. King, 78 M.J. 218 (C.A.A.F. 2019). CAAF affirmed a viewing conviction for one image found in unallocated space and two in a browser cache, relying on searches, admissions, and other surrounding evidence. The court declined to apply the possession analysis from Navrestad to a viewing charge.
• United States v. Schempp, 2016 WL 873852 (A. Ct. Crim. App. 2016) (unpublished). The Army court dismissed one possession specification outright and set aside part of another. The files had been deleted years before the charged date, and nothing showed the soldier had the tools or skill to recover them.
• United States v. Kamara, 2015 WL 2438269 (N-M. Ct. Crim. App. 2015) (unpublished). The Navy-Marine Corps court found images from unallocated space on several devices legally insufficient to prove possession. The government charged a month-long window but offered no evidence of when — or whether — those files were accessed. Only saved files on one external drive survived.

The Charging-Date Problem in Possession Cases

Every possession specification alleges a date or a date range. The government must prove possession during that window — not at some unknown point in the past.

In Schempp, the forensic examiner testified the files were deleted in 2009. The charged date was June 2012. That gap was fatal to the government’s theory.

This argument is strongest against possession. Because a viewing charge does not depend on continuing control, the date a file was deleted carries less weight there.

Unallocated Space Is Not an Automatic Win

Courts have upheld convictions when other evidence fills the gap.

United States v. Davenport, No. ARMY 20150322 (A. Ct. Crim. App. Dec. 19, 2016), is an example. The government charged a broad, roughly 17-month window, and the soldier told investigators he had downloaded, viewed, and deleted the material during that period. The Army court affirmed the possession conviction.

Search history, file-sharing logs, saved copies elsewhere, and — most often — the service member’s own statements can connect him to files before they were deleted.

King shows the same is true for viewing.

So the real question is never just where the files were found. It’s what else the government has, and whether it proves what the service member actually knew.

How the Defense Uses This Issue

• Separate the evidence. Force the government to identify which images were saved files, which were in unallocated space, and which came from cache or thumbnail data.
• Retain an independent forensic expert. The government’s examiner works for the government. The defense needs its own expert to review the forensic image and the examiner’s conclusions.
• Test the charging window. In possession cases, compare the dates alleged against what the forensic data actually shows about when files were deleted.
• Attack the surrounding evidence. Who ran the searches? Who else used the device or account? In King, the government’s own examiner testified that a browser cache can capture images that never appeared on the user’s screen.
• Challenge the statements. Because admissions often bridge the gap, suppression and corroboration issues can decide the case.
• Litigate sufficiency. At trial through a motion for a finding of not guilty under R.C.M. 917 — and, if necessary, on appeal. Appeals
• Contest the image count. In United States v. Kuchinski, 469 F.3d 853 (9th Cir. 2006), the Ninth Circuit affirmed the conviction but vacated the sentence because thousands of cache images the defendant neither knew about nor controlled had been counted toward his guideline range. Federal guidelines don’t govern courts-martial, but the same logic supports arguing that an accused should be sentenced only for what he knew about.

Narrowing what the government can legitimately use affects the charges, plea negotiations, and how the case is presented at trial and sentencing.

Facing a CSAM Investigation or Court-Martial?

Digital evidence looks overwhelming on paper. It often isn’t, once it’s examined closely.

Cave & Freeburg, LLP defends service members worldwide in courts-martial and appeals, with over 65 years of combined experience and clients in 47 states. If you are under investigation, don’t talk to investigators before talking to counsel. Practice Areas

Prior results do not guarantee a similar outcome.

Frequently Asked Questions

Can deleted files still be used as evidence?

Yes. Recovered files can be admitted. The question is whether they prove knowing possession during the charged time frame — or, for a viewing charge, that the service member knowingly viewed them.

Can I be convicted of viewing images that were deleted?

Yes. In King, CAAF upheld a viewing conviction involving an image found only in unallocated space. The government relied on surrounding evidence — searches, admissions, and how the computer was used — to prove the airman knowingly viewed it.

Does unallocated space mean my charge will be dismissed?

No. It depends on whether the charge is possession or viewing, and on the rest of the evidence — statements, search history, other devices, and the dates charged.

What if I told investigators I deleted the files?

An admission can supply the link that unallocated space alone cannot, as in Davenport and King. Talk to a defense lawyer before making any statement.

Does it matter if others used the computer?

Yes. Courts have required more than access to a shared device to prove possession.

Can this issue be raised on appeal?

Yes. Schempp and Kamara were both decided on appeal as questions of legal sufficiency. So was King, where CAAF affirmed.

By Philip Cave and Nathan Freeburg at www.court-martial.com. (Last reviewed October 28, 2026.)