That the government’s experts acknowledged that the thumbnail was likely created in October 2021 also gets him nowhere. Mr. Gish clarified that a thumbnail can be replaced with another, newer thumbnail if the video is viewed on a later date. So the fact that the probation officer’s view may have generated the thumbnail on October 16, 2021, did not foreclose the possibility that Mr. Nelson had watched the video previously.
U.S. v. Nelson
Sixth Circuit Appellate Court
July 29, 2026
Why is this case important?
U.S. v. Nelson is significant because it provides one of the Sixth Circuit’s clearest discussions of how digital forensic evidence can establish knowing possession of files stored on a cell phone. The court recognized that ownership of a device alone is insufficient, but explained that ownership combined with metadata, file organization, creation dates, sequential naming conventions, storage location and expert testimony can collectively permit a jury to infer knowing possession.
Registered Sex Offender
My Phone – But Not My Pictures
On October 16, 2021, Tennessee probation officers conducted a routine compliance check at the home of Scott Michael Nelson, a registered sex offender. Mr. Nelson had prior convictions for possession of photos depicting sex with a child, promotion of a sexual performance by a child, and unlawful sexual activity with a minor. His probation terms required him to submit to warrantless searches of his person, home, and vehicle. As part of this compliance check, probation officers searched Mr. Nelson’s Alcatel flip phone. Officers discovered a video depicting six still images of a minor female who was nude and touching her vaginal area. Mr. Nelson admitted that the cell phone belonged to him but denied ownership and knowledge of the video. Law enforcement then seized Mr. Nelson’s phone, obtained a search warrant, and recovered the video through a forensic extraction.
Mr. Nelson possessed an Alcatel flip phone similar to the one pictured. This is not a picture of the actual phone Mr. Nelson possessed.
Indicted
A grand jury indicted Mr. Nelson on one count of possession of child pornography, in violation of 18 U.S.C. §2252A(a)(5)(B), (b)(2). Mr. Nelson proceeded to trial.
Digital Forensic Examiner Testimony
At trial, the government introduced the child-pornography video, the thumbnail for the video from October 16, 2021, several images of Mr. Nelson’s personal documents that were extracted from his phone, and Cellebrite extraction reports noting the dates of the images and videos and their naming conventions. Mr. Nelson did not object to the admission of any of this evidence. The government also presented testimony from Chad Gish, a forensic consultant at the Metro Nashville Police Department, regarding his extraction of data from Mr. Nelson’s cell phone. Mr. Nelson did not object to Mr. Gish’s admission as an expert in digital forensics. Mr. Gish testified that the images and videos on Mr. Nelson’s phone were named sequentially and that the child-pornography video followed this same convention. Additionally, he explained that the video was created in November 2020 and stored around the same time as images of Mr. Nelson’s paychecks and license plate. At the close of the government’s case-in-chief, Mr. Nelson moved for a judgment of acquittal under Federal Rule of Criminal Procedure 29. The district court denied the motion.
Competing Digital Experts Testify
Mr. Nelson then offered his own expert, Kyne Marshall, a chief digital forensics analyst at BWI Investigations and Forensics. Mr. Marshall explained that he performed nine extractions on a phone with the same model as Mr. Nelson’s over a forty-eight-hour period, and no thumbnails were created just by recording a video. He also testified that he did not see the thumbnails update after every viewing, and he believed that no one had viewed the video in question before October 2021. The government presented a rebuttal expert, Denzel Washington from Homeland Security Investigations, and Mr. Nelson again did not object. Mr. Washington recognized that the video may have been viewed for the first time in October 2021. However, he also noted that the phone’s “garbage collection process” can routinely delete thumbnails after they are created. Mr. Nelson did not renew his motion for acquittal after he rested his case or the government’s rebuttal.
Mr. Nelson Sentenced to Ten Years in Federal Prison
The jury found Mr. Nelson guilty as charged. The district court sentenced Mr. Nelson to 120 months’ imprisonment. This appeal followed.
Child Pornography 18 U.S.C. §2252A
Established Case Law – Child Pornography Elements
18 U.S.C. §2252A(a)(5)(B) prohibits “[A]ny person” from “knowingly possess[ing], or knowingly access[ing] with intent to view, any . . . material that contains an image of child pornography.” Thus, the government was required to prove beyond a reasonable doubt that Mr. Nelson “(1) knowingly [possessed or] accessed with intent to view, (2) any material, (3) that he knew contained an image of child pornography.” United States v. Ammons, 806 F. App’x 378, 382 (6th Cir. 2020).
Established Case Law – Child Pornography
Mr. Nelson’s sufficiency challenge centers on the first element. But he has failed to show that the record is wholly devoid of evidence that he knowingly possessed child pornography. Critically, Mr. Nelson admitted that the Alcatel flip phone containing the video belonged to him. And, before officers located the video, Mr. Nelson had registered this phone with probation. “Where a defendant possesses child pornography in a personal computer or in his files, the ‘jury may infer that the individual knowingly possessed the images.’” United States v. Preston, No. 23-5675, 2024 WL 4590865, at *3 (6th Cir. Oct. 28, 2024) (quoting United States v. Oufnac, 449 F. App’x 472, 476 (6th Cir. 2011)); cf. United States v. Lowe, 795 F.3d 519, 523–24 (6th Cir. 2015) (reversing conviction where defendant had two roommates who could have used the laptop containing child-pornography images). Therefore, the jury was free to infer that he knew that he had the video.
Mr. Nelson Feebly Attempts to Use the ‘Not Mine’ Defense
The record also includes additional evidence beyond Mr. Nelson’s conceded ownership of the phone. For example, the government presented evidence that the video was created in November 2020, near the same time as other photographs of Mr. Nelson’s paychecks and license plate. And the government’s expert explained that the video followed the same sequential naming convention as other images and videos on Mr. Nelson’s phone. Though Mr. Nelson denies that he knew about the video, the jury was permitted to rely solely on the government’s circumstantial evidence to reach its guilty verdict. See United States v. Rogers, 769 F.3d 372, 377 (6th Cir. 2014).
Mr. Nelson’s counterarguments lack merit. He first suggests that “file presence alone is not enough” to show knowing possession, especially where the files are not easily accessible to the defendant. However, as discussed, the government offered several types of evidence to demonstrate knowing possession—including Mr. Nelson’s ownership of the phone, the naming sequence of the videos and images on the phone, and the date on which the video was created. And the video was stored in an application on Mr. Nelson’s phone, not in an inaccessible or unfamiliar location. United States v. Keefer, 405 F. App’x 955, 958–59 (6th Cir. 2010) (vacating and remanding where child-pornography images were saved in the computer’s “unallocated space”); United States v. Dobbs, 629 F.3d 1199, 1201, 1204 (10th Cir. 2011) (concluding that the government failed to prove knowing possession where child-pornography images were saved by the computer’s “automatic-caching function”). So, even assuming that Mr. Nelson’s argument is accurate, it does not align with the evidence presented at trial.
Note: On January 5, 2011 the Tenth Circuit Appellate Court issued U.S. v. Dobbs, 629 F.3d 1199 (10th Cir., 2011) and explained the Automatic Caching Function:
The forensic specialist also testified that the charged photographs recovered from Mr. Dobbs’s hard drive were found exclusively in the computer’s cache. As he explained it, when a person visits a website, the web browser automatically downloads the images of the web page to the computer’s cache. The cache is populated with these images regardless of whether they are displayed on the computer’s monitor. In other words, a user does not necessarily have to see an image for it to be captured by the computer’s automatic-caching function.
Mr. Gish clarified that a thumbnail can be replaced with another, newer thumbnail if the video is viewed on a later date.
That the government’s experts acknowledged that the thumbnail was likely created in October 2021 also gets him nowhere. Mr. Gish clarified that a thumbnail can be replaced with another, newer thumbnail if the video is viewed on a later date. So the fact that the probation officer’s view may have generated the thumbnail on October 16, 2021, did not foreclose the possibility that Mr. Nelson had watched the video previously. And Mr. Washington explained that Mr. Nelson’s phone could have routinely deleted older thumbnails to free up space. As such, the record was not devoid of evidence that Mr. Nelson knowingly accessed the video at an earlier date.
[I]t was within the jury’s purview to credit the government’s experts over Mr. Marshall.
Lastly, Mr. Nelson contends that his expert refuted the government’s expert testimony. For example, Mr. Nelson’s expert Mr. Marshall testified that, in the experiments he performed on the test phone, a thumbnail is not created until the video is viewed, and this thumbnail is not replaced with a newer one after a later view. However, “challenges to the credibility of a witness are not challenges to the sufficiency of the evidence, but instead to the quality of the government’s evidence.” United States v. Baskerville, 164 F.4th 459, 476 (6th Cir. 2026). And “credibility determinations are left to the jury.” United States v. Ledbetter, 929 F.3d 338, 355 (6th Cir. 2019). Here, it was within the jury’s purview to credit the government’s experts over Mr. Marshall, so we decline to disturb its verdict on this basis.
Digital Forensic Evidence
Next, Mr. Nelson asserts that the district court erred in admitting digital forensic evidence, including “thumbnails, cached data, and Cellebrite extraction results.” He broadly argues that the district court violated Federal Rules of Evidence 401, 403, and [Federal Rule of Criminal Procedure] 702 because the digital evidence “risk[ed] misleading jurors into treating ambiguous evidence as proof of a mental state.”
Was the Evidence Technically Ambiguous
Though not immediately clear, Mr. Nelson appears to assert that the government’s digital evidence was irrelevant because it was “technically ambiguous” and did not “reliably reflect[] intentional user conduct.” This argument seems to reprise his challenge to the sufficiency of the government’s evidence, rather than its admissibility. But, because Mr. Nelson roots his contention in Rule 401, we consider the relevance of the digital evidence here.
This threshold is low, and evidence is relevant if it advances the ball one inch.
Rule 401 provides that evidence is relevant if “it has any tendency to make a fact more or less probable than it would be without the evidence,” and “the fact is of consequence in determining the action.” Fed. R. Evid. 401. For criminal cases, “a fact is ‘of consequence’ if it makes it more or less likely that the defendant committed the charged conduct.” United States v. Hazelwood, 979 F.3d 398, 409 (6th Cir. 2020). “This threshold is low, and evidence is relevant if it advances the ball one inch.” United States v. Betro, 115 F.4th 429, 449 (6th Cir. 2024). “[R]elevant evidence is admissible unless another rule says otherwise.” United States v. Lester, 98 F.4th 768, 776 (6th Cir. 2024).
Courts do not require that each piece of evidence directly prove or disprove an element of the offense.
The evidence from Mr. Nelson’s cell phone was relevant to the charged crime of possession of child pornography. As Mr. Nelson recognizes, the government was required to prove beyond a reasonable doubt that he knowingly possessed child pornography. See 18 U.S.C. § 2252A(a)(5)(B). The video itself led to the charge; the Cellebrite reports noted the dates of the photographs and videos on Mr. Nelson’s phone, including the creation date of the child-pornography video, as well as the sequential order of the file names; and the photographs of Mr. Nelson’s paychecks and license plate taken between 2020 and 2021 reflected that he accessed his photograph and video applications near the date of the crime. Although Mr. Nelson challenges the jury’s inference of knowing possession from this evidence, the evidence was relevant and therefore admissible. See Hazelwood, 979 F.3d at 409 (“Courts do not require that each piece of evidence directly prove or disprove an element of the offense.”).
Mr. Nelson Argued that the Pictures of the Naked Juveniles Confused the Jury
Even if relevant, Mr. Nelson argues that the district court should have excluded the digital evidence because it “created a substantial risk of juror confusion and unfair prejudice.”. In particular, he suggests that its admission caused the jury to “overvalue technical evidence carrying an aura of specificity unsupported by the underlying proof.” We disagree.
The district court “may exclude relevant evidence if its probative value is substantially outweighed by a danger of . . . unfair prejudice” or “confusing the issues.” Fed. R. Evid. 403. Unfair prejudice is “defined as the ‘undue tendency to suggest a decision based on improper considerations.’” Hazelwood, 979 F.3d at 412. This balancing “test is strongly weighted toward admission,” United States v. Asher, 910 F.3d 854, 860 (6th Cir. 2018), and the district court enjoys “broad discretion” in its determination, Wilder, 87 F.4th at 819 (citation omitted).
The Digital Evidence was Relevant and Probative
We observe no plain error in the admission of the digital evidence. As explained, the government’s evidence was relevant and probative of Mr. Nelson’s knowing possession of the video. The “legitimate probative force” of the video, images, thumbnails, and Cellebrite reports may have “damage[d]” Mr. Nelson’s case, but this does not rise to the level of unfair prejudice. See United States v. Smith, 70 F.4th 348, 353 (6th Cir. 2023) Similarly, the mere possibility that extracted information from Mr. Nelson’s cell phone could confuse the jury does not automatically warrant exclusion. Rather, the challenged digital evidence was “highly probative of a crucial issue” and had a “limited prejudicial effect,” so the district court did not plainly err by admitting it. United States v. Clark, 24 F.4th 565, 582 (6th Cir. 2022).
Mr. Nelson Argues and Inapplicable Federal Rule of Criminal Procedure
Mr. Nelson brings his last evidentiary challenge under Rule 702. The government argues that Rule 702 is inapplicable because Mr. Nelson does not challenge the admissibility of any expert witness testimony. Mr. Nelson counters that his argument focuses on the “unreliability of the government’s inference chain” and therefore “implicate[s] Rule 702 concerns.” We agree with the government that this claim falls outside the scope of Rule 702.
Courts evaluate whether to admit expert witness testimony under Rule 702. See, e.g., United States v. Ganier, 468 F.3d 920, 925–27 (6th Cir. 2006); United States v. Beverly, 369 F.3d 516, 528 (6th Cir. 2004). For example, Rule 702 requires, in part, that a proponent of expert testimony show “that it is more likely than not that . . . the testimony is the product of reliable principles and methods.” Fed. R. Evid. 702(c).
Conclusion and Holding
Here, Mr. Nelson has not identified any unreliable principles or methods upon which a government expert allegedly based their testimony. Nor does he challenge Mr. Gish or Mr. Washington’s testimony outright. Instead, he again argues that the government offered “technically ambiguous forensic evidence to supply the missing proof of knowledge.” For the reasons stated, this argument fails.
Note: There was an additional appeal on jury instructions. That appeal was also denied but is not evaluated in this article. Mr. Nelson did not renew his Rule 29 motion after presenting his evidence, and he did not object at trial to the admission of the digital evidence or expert testimony.
Information for this article was obtained from U.S. v. Nelson, No. 25 – 5427 (6th Cir., 2026). Digital Forensics technical clarification for this article was provided by Mr. Kevin Horan and Columbus Police Sgt. LeVon Morefield.
U.S. v. Nelson, No. 25 – 5427 (6th Cir., 2026) is an unpublished Sixth Circuit decision issued on July 29, 2026. Although it is not binding precedent, it provides a useful illustration of how multiple items of digital and circumstantial evidence may collectively support an inference of knowing possession
Lessons Learned
Child Pornography Possession – The prosecution established that Mr. Nelson had accessed the files, that he claimed were only on his phone but he did not access those specific files. As the court explained “The video itself led to the charge; the Cellebrite reports noted the dates of the photographs and videos on Mr. Nelson’s phone, including the creation date of the child-pornography video, as well as the sequential order of the file names; and the photographs of Mr. Nelson’s paychecks and license plate taken between 2020 and 2021 reflected that he accessed his photograph and video applications near the date of the crime.”. Here, the prosecution established the video creation date, sequential files names, video storage location, contemporaneous photographs of Nelson’s personal documents and thumbnail information. Collectively, this reasonably led the jury and the judge that Mr. Nelson ‘knowingly possessed … child pornography’ in accordance with; 18 U.S.C. §2252A(a)(5)(B) prohibits “[A]ny person” from “knowingly possess[ing], or knowingly access[ing] with intent to view, any . . . material that contains an image of child pornography.”
Must the Prosecution Prove Mr. Nelson Accessed the Digital File or is Simple Possession Enough to Convict? The court explained “[T]he government offered several types of evidence to demonstrate knowing possession—including Mr. Nelson’s ownership of the phone, the naming sequence of the videos and images on the phone, and the date on which the video was created. And the video was stored in an application on Mr. Nelson’s phone, not in an inaccessible or unfamiliar location.”
Not My Thumbnail – Mr. Nelson argued that the thumbnail associated with the child pornography video was not created until probation officers viewed the video during the October 16, 2021 compliance check. Therefore, he claimed the government could not prove that he had previously accessed the file.
The Sixth Circuit rejected that argument. The government’s digital forensic experts explained that a thumbnail can be replaced with a newer thumbnail each time a video is viewed. They also testified that the phone’s “garbage collection” process can automatically delete older thumbnails to free storage space. Consequently, the fact that the existing thumbnail may have been generated during the probation search did not eliminate the possibility that Mr. Nelson had previously viewed the video.
More importantly, the thumbnail evidence was only one piece of the government’s case. The video was stored in an ordinary application on Mr. Nelson’s phone, its file name followed the same sequential naming convention as his other photographs and videos, and the video’s creation date coincided with personal images of his paychecks and license plate. Viewed together, the digital evidence permitted the jury to reasonably conclude that Mr. Nelson knowingly possessed and had previously accessed the video.
Investigators should avoid focusing on a single digital artifact. Thumbnails, metadata, file names, creation dates, storage locations, and other forensic evidence should be evaluated collectively. While one artifact may be susceptible to multiple interpretations, the totality of the digital evidence may establish knowing possession beyond a reasonable doubt. Digital forensic examinations are strongest when multiple independent artifacts corroborate one another.
Garbage Collection Clarification – In digital forensic circles, “Garbage collection” typically refers specifically to flash memory controller management; however, in the context in U.S. v. Nelson, describes device cache purging/cleanup algorithms.
Thumbnail Clarification – Thumbnail generation depends on the device’s media framework (function of the OS version). Some devices and applications update or overwrite a cached thumbnail when a file is viewed or refreshed, while others create a single static thumbnail upon indexing or initial viewing and never update it.
The government was not required to rely upon the thumbnail alone. Mr. Nelson’s ownership and registration of the phone, the file’s location in an ordinary application, its naming convention, its associated date information, and the presence of contemporaneous personal images collectively permitted the jury to infer knowing possession. The thumbnail evidence did not conclusively establish when Nelson first viewed the video, but it also did not foreclose the possibility of prior viewing.
Avoid a One-Size-Fits-All Approach to Digital Evidence – The digital forensic issues discussed in this case—including thumbnail replacement, thumbnail creation, cache management and the device’s garbage collection process—are specific to the hardware, firmware, operating system, applications, and forensic extraction methods used on Mr. Nelson’s phone. These processes can vary significantly between devices and operating systems. Accordingly, investigators and prosecutors should avoid treating the testimony in this case as universally applicable to all digital devices. A forensic conclusion regarding one feature phone should not be automatically extended to other platforms such as iPhones, Android devices, or even different versions of the same operating system. Before drawing conclusions about user activity or file access, investigators should understand how the particular device, operating system, application, and forensic software manage thumbnails, cached data and other digital artifacts.
Does your agency train on investigations?
Don’t fail your training.
Don’t let your training fail you!
Be safe, smart and objectively reasonable!