An automatically saved file can be evidence, but its presence in a browser or application cache does not by itself prove or disprove knowing possession. The investigation must distinguish the technical existence of data from what a person knew and whether that person controlled it. A charge and its proof depend on the precise statute, alleged material, and forensic evidence.
Penal Code section 311.11(a) concerns specified sexual material depicting a person under 18. It requires knowing possession or control and knowledge of what the material depicts; not every cached or downloaded image falls within the statute. CALCRIM No. 1145 separates those knowledge questions: knowledge of possession or control is different from knowledge of the content. Physical contact is not required if a person controls, or has the right to control, the matter. The statute also contains detailed categories and exceptions, so the exact subsection and allegation must be reviewed rather than generalized. Penal Code § 311.11; CALCRIM 1145.
What a cache artifact can and cannot show
A cache is temporary storage used to keep data available for faster processing. A cache entry may show that data existed in a particular technical location. It is not, by itself, a legal finding about who caused it to be stored, who knew it was there, whether anyone knew what it depicted, or whether a person could control it. NIST definition of cache.
A qualified examiner may need to interpret the original device image and relevant forensic records, including the file path, browser or application behavior, user profile, account access, timestamps, and any search, view, download, movement, or export artifacts. No single artifact necessarily answers all the questions. SWGDE identifies browser databases and cache, user profiles, file permissions, and application artifacts as potential sources for understanding activity and control; conclusions should be supported and repeatable. SWGDE computer-forensics guidance.
The presence of an item in automatic storage does not automatically establish knowing possession. It also does not automatically rule it out. The same caution applies to a file associated with a user profile: the association may be relevant, but the inference about the actual user and knowledge requires context.
Preserve the device without handling suspected material
Do not open, search, copy, move, transmit, or delete suspected unlawful material. Do not try to test a theory by browsing the device. If the device or account is relevant to an investigation, direct questions about preservation and forensic examination to counsel and a qualified examiner. Preserve lawful records that do not require accessing or reproducing the suspected material, and avoid discussing facts with others or changing device contents.
A focused review asks what the forensic method actually established, whether the artifacts can be attributed to a user, what the user could access or control, and what evidence supports knowledge of the content. Each is a factual question; automatic storage is not an automatic verdict in either direction.
The Law Offices of David S. Chesley handles California sex-offense defense. To discuss the allegation and available case records, call (800) 755-5174.