A city police detective's undercover software discovered a computer used by a Sault Ste. Marie man was making child pornography available on the Internet, a judge heard this week.
Det. Const. Doug Erkkila's online investigation flagged and monitored an IP address that was tracked to Robert Capancioni, whose trial got underway Monday at the courthouse.
Capancioni has pleaded not guilty to possessing child pornography and making child pornography available
In December 2012, the technological crime unit officer's computer connected to the suspected computer and successfully downloaded 13 pieces of files that he called relevant to the investigation, Superior Court Justice Edward Gareau was told.
The information included pictures of young girls, but they did not meet the Criminal Code definition of child pornography, Erkkila said.
The officer said he continued to monitor the IP address to collect more information to substantiate grounds that might result in a search warrant.
On Dec. 31, Erkkila said he downloaded 734 files of which he determined 244 were child pornography and obtained a search warrant, which was executed at Capancioni's residence on January 15, 2013.
During the search, a number of devices, including a laptop computer, were seized.
Erkkila said the computer hard drive had been partitioned into two sections, one of which was untitled and the other was labeled as a disk with Capancioni's wife's name on it.
He was provided with passwords, but none of them would open the disk section and so he could only analyse part of the computer, the officer told assistant Crown attorney David Kirk.
The disk was encrypted and Erkkila said he was never able to get into it.
Despite attempts to break the password code that included a $30,000 investment for special software by the police service, he could not crack the password.
Erkkila testified that he had a list of names and titles downloaded on Dec. 31 from his online investigation and he ran a word search on the laptop and time capsule seized from the residence.
There were 16,000 separate entries for these words on these devices, he said.
"Based on the key word search I was confident the devices I had seized were the devices used to make child pornography available," said the officer, who has spent nearly 12 years in the tech crime unit.
Erkkila said he was trying to locate the pictures and videos he had downloaded, but they weren't on any of the devices he could analyse.
But he indicated he was able to conclude that a person using Capancioni's laptop was responsible for making child pornography available.
The court heard Erkkila then narrowed his investigation down to what persons could be using the computer at the specific times the child porn was made available.
He said he knew there were two people who had access to the hard drive and there were two separate user accounts on that computer.
From that, Erkkila said he tried to develop a timeline to identity the user account and person responsible for creating the encrypted disk.
As he continued his investigation, he discovered Capancioni's user account searched Google on July 31, 2012 for "encrypting on a Mac" computer.
As well, the account searched how to partition a hard drive and add it to a Mac, he said.
On that same date, the two partitions were created and were identified as untitled and the disk.
"It was clear to me" that someone using Capancioni's user account created the disk and encrypted it," Erkkila said.
On Tuesday, he gave the court a sampling of artifact evidence of different records that identify Capancioni as using the account.
He noted that the day after the one partition was encrypted, the accused's user account began Google searches for sites about teens, and by the middle of the month was searching for teen nudists.
On August 20, the account entered a search for what Erkkila described as "a notorious website hosting child pornography, where a number of Internet luring investigations are conducted."
The site not only hosts pictures, but chats with like-minded people, he said.
Queries were made on that website about 12, 14 and 15 year old girls.
Erkkila will continue his evidence today.
Defence counsel Bruce Willson is slated to cross examine him Thursday.