Case Study 1 — The Routine Tuesday: A Recovery Tech and the File That Stopped the Job

No warrant, no investigation, no courtroom in view — just a reformatted external drive and a customer who wanted ten years of family photos back. What made this engagement matter was not clever carving but the five minutes after a thumbnail loaded that should not have existed, and a technician who had already decided, long before that Tuesday, exactly what she would do.

Background

The shop was a two-person consumer recovery bench of the kind Chapter 13 describes — the lawful, honest end of the trade. The job was the most ordinary one in this book: a 2 TB USB external drive, accidentally reformatted, a desperate customer, "everything is on there." It was, in every visible respect, the wedding-photos case (anchor #1) all over again. The technician did everything right by reflex. The original is sacred, so she imaged the drive first and worked only on the read-only copy. The MFT was partially overwritten by the quick format, so she fell back to file carving, pulling JPEGs by header and footer the way Chapter 7 taught.

The carver returned a few thousand recovered images. To verify the recovery had succeeded — to be able to tell the customer "your photos are back" — she began scrolling the thumbnail grid, looking for the wedding. Birthday parties. A beach. A dog. And then, somewhere in the grid, a thumbnail rendered whose subject was a child and whose nature was unmistakable and criminal.

The job changed in that instant. It was no longer a recovery job. For the moment, it was no longer hers at all.

What she did, in order

She had rehearsed this — not as drama, but as procedure, because she had read this chapter and treated the first five minutes as a drill. What she did mapped onto it exactly:

DISCOVERY LOG — case WED-1147   (content-free; this is the ONLY record made)
  STOP        14:38 local — ceased carving review at first apparent item.
              Did NOT open the file, did NOT scroll for "more to be sure."
  DO NOT COPY No export, no screenshot, no "sample for the file," nothing
              sent to anyone. (Possession/reproduction can be a crime —
              18 U.S.C. §2252/§2252A.)
  PRESERVE    Left image and original drive intact; nothing deleted/cleaned.
  ISOLATE     Working image moved to the locked, access-restricted folder;
              original drive resealed and placed in the safe.
  DOCUMENT    Path of the apparent item, the file's SHA-256, the time, and
              the method (thumbnail render during routine carving review).
              NEVER the content.
  ESCALATE    14:51 — called the local police non-emergency line; was routed
              to the regional ICAC task force. Called the shop's attorney.

She did not call the customer. The instinct to confront — "is this yours? can you explain?" — is the instinct to tip off a possible offender and to insert herself into an investigation that was never hers. She did not delete the file to "make it go away," which would have destroyed evidence and, depending on intent, broken the law. She did not keep looking to count how many there were; one apparent item had already triggered the duty, and confirming the scope was the job of the examiner who would take the case under proper authority.

The attorney's first question tested the chapter's most-misquoted statute. "Aren't you required to file a CyberTipline report?" The answer is the precise one: 18 U.S.C. §2258A puts the mandatory NCMEC CyberTipline duty on electronic-communication-service and remote-computing-service providers — hosting companies, cloud platforms, ISPs — not on a one-person recovery shop. But that absence of a federal provider duty was not permission to do nothing. The shop was in a state whose statute imposes a reporting obligation specifically on computer technicians who encounter apparent CSAM in the course of their work (the chapter cites Missouri's Mo. Rev. Stat. §568.110 and South Carolina's as examples of this growing category). And even where no statute had named her, every professional code and every legitimate lab treats report-and-cease as a standing, non-waivable policy. She had two independent reasons to do exactly what she had already done — and zero reasons, legal or moral, to do anything else.

The ICAC unit took custody of the drive and the image under proper authority, working from validated tools and the curated hash sets — Project VIC, distributed through tools like Griffeye — that let their examiners triage by hash without rendering every file. Her content-free discovery log became the clean record of how a private party lawfully encountered the material, stopped, secured it, and handed it off. Because she had logged the path, the hash, the time, and the method and nothing of the content, there was no question later about her own handling. "Every action leaves a trace" had worked in her favor: the trace she left was the trace of doing it right.

The cost, and the aftercare

The thumbnail did not leave her head that night, or for several nights. She had not gone looking for it; she had glimpsed it for a second and stopped — and it still cost her sleep. This is the part the tool manuals omit. She talked to her business partner (not the content — the weight), used the shop's small EAP referral to see a trauma-informed counselor for a few sessions, and the two of them wrote a one-page standing procedure so that neither would ever again have to improvise this at the bench. They also changed how they reviewed carved image sets: verifying recoveries against file counts, hashes, and a customer-provided list of target files wherever possible, rather than scrolling every thumbnail by eye — minimizing what a human must see, which is both better ethics and better self-protection.

The analysis

1. The hardest moment arrives during the most innocent work. There was no high-profile case here — a routine reformatted drive, a sympathetic customer, a Tuesday. Contraband does not announce itself only in dramatic investigations; every practitioner is "one carved thumbnail away" from this. The professional is the one who decided what to do before it happened.

2. The first response is the same for every role; only the escalation target differs. Stop, do not copy, preserve, isolate, document, escalate. A recovery technician's authority to handle the material is the narrowest of anyone's — her job was to recover files, not investigate them — and that narrowness made "stop and report" the obviously correct response rather than a judgment call.

3. "Do not copy" and "do not keep looking" are legal lines, not squeamishness. Reproduction and possession are themselves crimes under §2252/§2252A, and the statute's narrow affirmative defense runs precisely through not accumulating and reporting promptly. Counting the files or saving a copy "for the case" would have converted a clean handoff into personal exposure.

4. Know the reporting law's true shape. §2258A binds providers, not a recovery shop — but state computer-technician statutes and professional duty filled the gap completely. The lesson the chapter insists on: "I'm not a provider" never means "I have no duty." She knew her jurisdiction's law before she opened her doors, exactly as a professional should.

5. The human cost includes you — plan for it. A second's exposure cost her sleep, and that is normal, not weakness. The aftercare (peer support, trauma-informed counseling, a written standing procedure, and a review workflow that minimizes what a human must see) is the well-being discipline the chapter treats as a professional duty, not an afterthought.

Discussion questions

1. The technician's discovery log recorded the path, the SHA-256, the time, and the method — but never the content. Walk through how each recorded element would later protect her, and explain why recording anything about the content would have been a mistake.

2. She deliberately did not contact the customer. Give two distinct reasons this was correct, and describe a plausible bad outcome for each had she "just asked them about it."

3. The attorney raised §2258A. Explain in your own words why the statute did not directly obligate her, and why she nonetheless had a clear duty to report. What two things should every recovery shop do before opening, rather than after a discovery?

4. ⭐ Imagine the same discovery, but the shop is in a state with no computer-technician reporting statute and the technician is unaware of any professional code. Construct the ethical argument that she still must stop and report, drawing on the chapter's claim that the duty "is rarely only statutory; it is professional and moral, and it is not waivable by the client." Where does that argument get its force if not from a statute?

5. The shop changed its verification workflow to rely on counts, hashes, and customer target-lists rather than scrolling every thumbnail. Argue that this change is simultaneously an ethics improvement, a legal-exposure reduction, and a well-being measure — and name one recovery scenario where it is hard to avoid eyeballing images anyway, tying your answer to the chapter's Limitation that minimization is "a discipline of the second look, not a guarantee about the first."