Erik Hentzen v. United States

NOT RECOMMENDED FOR PUBLICATION
File Name: 23a0522n.06
No. 22-5573
UNITED STATES COURT OF APPEALS
FILED
Dec 13, 2023
FOR THE SIXTH CIRCUIT
KELLY L. STEPHENS, Clerk
)
ERIK HENTZEN,
)
Petitioner-Appellant, ) ON APPEAL FROM THE UNITED
) STATES DISTRICT COURT FOR
v. ) THE EASTERN DISTRICT OF
) KENTUCKY
UNITED STATES OF AMERICA, )
) OPINION
Respondent-Appellee.
)
Before: BOGGS, SUHRHEINRICH, and READLER, Circuit Judges.
BOGGS, Circuit Judge. Erik Hentzen was convicted of receipt and possession of child
pornography, in violation of 18 U.S.C. § 2252(a)(2) and 18 U.S.C. § 2252(a)(4)(B), and was
sentenced to 20 years in prison. Hentzen then appealed to this court, arguing that the prosecution
presented insufficient evidence to convict and that the admission of a “grooming” video was
improper. United States v. Hentzen, 638 F. App’x 427 (6th Cir. 2015) (“Hentzen I”). Finding that
the body of evidence showed that Hentzen affirmatively sought out child pornography and the
admission of the video was harmless error, this court affirmed the judgment and sentence of the
district court. Id. at 427-35.
Hentzen filed a timely motion to vacate his conviction and sentence under 28 U.S.C.
§ 2255, asserting that his trial counsel was ineffective for failing to obtain and prepare qualified
expert testimony to expose inaccuracies in, and otherwise contest, the government’s
computer-forensics evidence. A magistrate judge recommended that Hentzen’s 28 U.S.C. § 2255No. 22-5573, Hentzen v. United States
be denied and the district court adopted the findings. Hentzen filed a timely notice of appeal,
asking this court to issue a certificate of appealability (COA). (Hentzen v. United States, No.
18-6168 (“Hentzen II”) Order at 1-2). We granted Hentzen relief as to some of his ineffective-
assistance-of-counsel claims, namely (1) his failure to obtain and prepare a competent expert, (2)
ineffective assistance of trial counsel at the sentencing hearing, and (3) ineffective assistance of
Appellate counsel claims. Ibid. The United States then moved to reverse the district court’s denial
of Hentzen’s motion to vacate and to remand the case to the district court, as he was entitled to an
evidentiary hearing with respect to the claims allowed by the COA. Hentzen II, 2019 U.S. App.
LEXIS 14831, at *1 (6th Cir. May 17, 2019). This court vacated the district court’s judgment and
remanded the matter. Id. at *2-3.
In August 2021, a two-day evidentiary hearing was held. The court heard testimony from,
among others, Dr. Andrew Cobb, a former University of Louisville professor, about the computer-
forensics examination of Hentzen’s computers and computer-related devices. Dr. Cobb opined
that the investigators breached universally accepted procedures of computer forensics and analysis
at the time Hentzen’s equipment was seized and that the court heard inaccurate testimony with
respect to how certain features of the Windows XP operating system functioned. Hentzen himself
also testified during the evidentiary hearing about his trial counsel’s representation of him and the
evidence. Additionally, Kentucky Attorney General’s Office Cyber Crimes Unit Forensic
Examiner and Detective Michael Littrell also testified regarding certain “triage” procedures
conducted on Hentzen’s equipment at the time of seizure. He opined that the time stamps found
on Hentzen’s files that post-dated seizure were the result of the triage software used at the time
Hentzen’s computers and computer devices were seized.
-2-
No. 22-5573, Hentzen v. United States
In February 2022, Magistrate Judge Ingram issued a comprehensive Report and
Recommendation, recommending denial of Hentzen’s motion to vacate on his three remaining
grounds: (1) his ineffective-assistance-of-trial-counsel’s failure to obtain and prepare a competent
expert, (2) his ineffective-assistance-of-trial-counsel at allocution at sentencing, and (3) his
ineffective-assistance-of-appellate-counsel at sentencing claims. Magistrate Judge Ingram,
however, also recommended the issuance of a COA only as to the first ground—Hentzen’s
ineffective-assistance-of-trial-counsel counsel claim—finding that reasonable jurists could find
that Hentzen was prejudiced. The district court subsequently entered judgment in favor of the
United States.
Hentzen now appeals, asserting that his trial counsel failed to provide him constitutionally
adequate assistance of counsel as to the presentation of expert testimony regarding the computer-
forensic evidence. Hentzen has failed to establish that his trial counsel’s performance was either
deficient or prejudicial, and we affirm.
I. BACKGROUND
A. Hentzen I
In 2014, a jury convicted Erik Hentzen of knowing receipt and possession of child
pornography and he was sentenced to 240 months in prison. At the time, he was a 25-year-old
student at the University of Kentucky. Hentzen I, 638 F. App’x at 428. Hentzen had a keen interest
in computers, possessing seven computers and seventeen other computer-related devices capable
of storing a combined seventeen terabytes of digital data. He also avidly downloaded and collected
internet files including music, videos, and pornography using peer-to-peer networks like eDonkey.
Ibid. To access eDonkey, Hentzen used a software client called eMule.
-3-
No. 22-5573, Hentzen v. United States
The Kentucky Attorney General’s Cyber Crime Unit surveils peer-to-peer networks,
including eDonkey, for the distribution of child pornography. To surveil these networks, the Unit
uses remote forensics tools, including an automatic software that searches networks for common
keywords associated with child pornography. When a computer shares files containing those
keywords, the IP address of the computer and the hash values of the files are documented. A hash
value is a unique digital fingerprint for each file that the Unit can use to identify files that match
those of known child pornography. Between September and November of 2012, an agent detected
many child-pornography files being shared by a single IP address on an unsecured internet router
in Hentzen’s apartment building. These files were traced to a laptop in Hentzen’s apartment.
In March 2013, state law-enforcement officials executed a search warrant at Hentzen’s
apartment. Among the state law-enforcement officials were also computer-forensics experts with
the Kentucky Attorney General’s Office Cyber Crimes Branch, including investigator Thomas
Bell.
Investigators testified that they found “the largest collection of computer equipment” they
had seen in executing over 200 warrants. A total of seven computers, multiple external hard drives,
and USB storage devices were seized from Hentzen’s home. Investigators examined the devices
on the scene and conducted a preliminary review of a laptop. The laptop’s IP address matched the
IP address that had previously been identified as downloading known child-pornography files prior
to the execution of the search warrant. When investigators opened the laptop, it was running and
showed all active downloads and uploads at the time. Recent and current downloads visible on
Hentzen’s computer screen included files with keywords that were clearly associated with child
pornography. Hentzen was subsequently arrested.
-4-
No. 22-5573, Hentzen v. United States
Hentzen’s computers and computer devices were submitted to forensic examination and
were found to contain child pornography. Investigators found a total of 1,348 child-pornography
images and 4,144 child-pornography videos on Hentzen’s laptop. An additional 4,006 images and
2,461 videos, all believed to contain representations of child sexual abuse, were also located in a
deleted state or stored within unallocated space, indicating that these files had been deleted or
moved to another storage device. Further, investigators discovered a digital catalogue for
commercial-grade child pornography and child-sexual-abuse images and videos for sale and
multiple videos of animated child pornography depicting children engaging in sexual activity with
adult men. Videos relating to exactly how to molest a child and how to “groom” a child into
participating in abusive activities, as well as videos and images depicting bondage, torture, sado-
masochistic behavior, and bestiality involving children were also contained within Hentzen’s
devices. All the evidence above was presented at trial.
The only contested issue at trial was whether Hentzen knew that the child-pornography
files that had been found on his computer were, in fact, child pornography when he downloaded
and possessed them. Hentzen I, 638 F. App’x at 429. The government presented a document
detailing his last 30 searches on eMule as evidence that Hentzen knew that he was downloading
child pornography. This document contained several known keyword terms pertaining to child
sexual abuse and pornography, all entered individually. The government also presented evidence
that two still images had been opened on an internet browser and some files had been opened using
a view that shows the thumbnails of videos and images. The government introduced into evidence
several examples of the files that were found on Hentzen’s computer, including the catalogue and
nine child-pornography videos, portions of which were played for the jury. These included a video
-5-
No. 22-5573, Hentzen v. United States
depicting a girl forced to engage in sexual activity with an animal as well as recordings of adult
men sexually abusing young girls and, in one video, an infant.
Hentzen testified on his own behalf, asserting that he did not know that the files he was
downloading were child pornography. Hentzen I, 638 F. App’x at 429-30. He testified that the
files were on his computer through two different ways: (1) as a result of his side business of fixing
his friends’ computers in which he would copy all their media files onto his hard drives, or (2)
because of his habit of searching the internet and batch downloading the top searches of the day.
Hentzen explained that he developed a text file of all possible pornography keywords and would
copy those keywords into the eMule search box and download any files that the program told him
he did not already have. Hentzen maintained that he would generally not look at the names of the
files, but rather the size of the file and how quickly it could download onto his computer. Using
this batch downloading method, Hentzen testified that he downloaded at least 100,000 media files
and had not watched most of them. Upon downloading the files, Hentzen would immediately open
25 different files at once to see if the files prompted an alert that they contained a virus or were
otherwise corrupted. He testified that he would then move the uncorrupted files into a new labeled
folder. If a folder was automatically created by the downloading software for a group of files,
Hentzen would search for other files with that keyword and place them together in that folder.
The government presented rebuttal testimony from William Baker, investigating forensic
examiner and investigations manager for the Cyber Crimes Unit at the Kentucky Attorney
General’s Office, regarding the files that were actively downloading when Hentzen’s computer
was seized. Baker testified that, for some of the child-pornography files, there was no evidence
that any other downloads had begun during the downloading process for those files found actively
-6-
No. 22-5573, Hentzen v. United States
downloading on Hentzen’s computer at the start of the seizure. Additionally, the forensic examiner
noted that the still-downloading files had been downloaded individually.
After hearing the evidence, a jury convicted Hentzen. Hentzen I, 638 F. App’x at 430-31.
He received a below-Guidelines sentence of 240 months of imprisonment. Ibid. Hentzen
appealed, contesting the sufficiency of the evidence supporting his conviction, but this court
affirmed. Id. at 431-37.
B. Hentzen II
Hentzen then filed a timely motion to vacate his conviction and sentence under 28 U.S.C.
§ 2255. Hentzen II, 2019 U.S. App. LEXIS 14831, at *1. Among other things, Hentzen argued
that his counsel was ineffective because his defense attorney failed to obtain and prepare qualified-
expert testimony to expose alleged inaccuracies in, and otherwise contest, the government’s use
of computer evidence. Id. at *3. To support his claim, Hentzen submitted an affidavit from
Andrew Cobb, Ph.D., a forensic examiner and partner at One Source Discovery. Hentzen II,
No. 18-6168 Order at 5. Ultimately, this court vacated and remanded the case to the district court
so that an evidentiary hearing may be held. Hentzen II, 2019 U.S. App. LEXIS 14831, at *1.
In his affidavit, Dr. Cobb reviewed the evidence and averred that the Kentucky Attorney
General’s investigators “breached universally accepted procedures” of computer-forensic data
collection and analysis. Hentzen II, No. 18-6168 Order at 5. He argued that this compromised the
integrity of the evidence after Hentzen’s hard drives were taken into custody, “call[ing] into
question the quality of the evidence, and all findings and opinions based on such evidence.” Dr.
Cobb also averred that examiner William Baker provided false testimony about certain features of
the Windows XP Operating System, namely the creation and existence of “shortcut evidence,”
such as .lnk and thumbs.db files, on Hentzen’s devices. Dr. Cobb contends that the government
-7-
No. 22-5573, Hentzen v. United States
used this piece of evidence to persuade the jury of Hentzen’s guilt. Ibid. Hentzen argued that his
counsel’s failure to mitigate the government’s “shortcut evidence” with evidence akin to Dr.
Cobb’s findings was “fatal” to his case.
Hentzen also argued that trial counsel was ineffective because he failed to obtain a “more
reliable, competent, and persuasive” computer-forensics expert. Hentzen II, No. 18-6168 Order at
6. Hentzen contends that Brian Ingram, the forensics expert that his counsel retained, was “grossly
inadequate” and compromised his counsel’s ability to formulate sound trial strategy.
This court rejected Hentzen’s argument that trial counsel was ineffective because of a
failure to obtain a “more” competent expert. Explaining that the selection of a trial expert is a
“paradigmatic example” of a “virtually unchallengeable” strategic choice, Hentzen had
accordingly failed to demonstrate a reasonable probability that the outcome of his trial would have
been different had counsel consulted another expert. We noted that counsel’s investigation was
thorough; he contacted several computer-forensics entities in search of a competent expert for
Hentzen’s case, a fact Hentzen himself admitted. Further, Hentzen noted that, after determining
that Mr. Ingram’s expertise was insufficient, counsel sought and retained another expert for the
defense, Emmanuel Kressel. We concluded that, apart from mere speculation, Hentzen had failed
to demonstrate a reasonable probability that the outcome of his trial would have been different had
counsel retained a different, “more competent” expert.
With respect to Hentzen’s “shortcut evidence” claim, however, this court remanded the
issue for further proceedings. Explaining that this ineffective-assistance-of-counsel claim relied
on off-the-record conversations between Hentzen and his counsel, Hentzen should be afforded an
evidentiary hearing. Id. at 7. The court further noted that Hentzen had already met the burden for
an evidentiary hearing through his § 2255 petition and affidavit. Because reasonable jurists could
-8-
No. 22-5573, Hentzen v. United States
debate whether Hentzen is entitled to an evidentiary hearing, the court explained that, logically,
this would also mean that reasonable jurists could debate having resolved of Hentzen’s “shortcut
evidence” claim without such an evidentiary hearing.
On remand, the district court considered whether trial counsel was ineffective for failing
to obtain and prepare qualified-expert testimony to expose inaccuracies in, and otherwise contest,
the government’s computer-forensics evidence. Following an evidentiary hearing, a magistrate
judge recommended denying the motion to vacate but issuing a certificate of appealability (COA)
for only this ground due to the fact-intensive nature of the inquiry. The district court agreed and
adopted the magistrate judge’s recommendation, denied the motion, and issued a COA. In issuing
the COA, the district court noted that the question is very fact-intensive and reasonable jurists
could debate whether Hentzen was prejudiced by the failure to introduce evidence as described by
Dr. Cobb. Hentzen appeals.
II. ANALYSIS
A defendant must make two showings to succeed on an ineffective-assistance-of-trial-
counsel claim. First, he must show that counsel’s performance “fell below an objective standard
of reasonableness.” Strickland v. Washington, 466 U.S. 668, 687–88 (1984). This means that
“counsel made errors so serious that counsel was not functioning as the ‘counsel’ guaranteed the
defendant by the Sixth Amendment.” Id. at 687.
When reviewing counsel’s performance, we “indulge a strong presumption” that, “under
the circumstances, the challenged action ‘might be considered sound trial strategy.’” Id. at 689(citation omitted). Disagreement over trial strategy is not a basis for ineffective assistance of
counsel. Ibid. In particular, “strategic choices made after thorough investigation of law and facts
relevant to plausible options are virtually unchallengeable.” Id. at 690. This standard is extremely
-9-
No. 22-5573, Hentzen v. United States
deferential, as counsel is “strongly presumed to have rendered adequate assistance and made all
significant decisions in the exercise of reasonable professional judgment.” Ibid. The inquiry
involves eliminating “the distorting effects of hindsight . . . to evaluate the conduct from counsel’s
perspective at the time.” Id. at 689.
Second, the defendant must establish that counsel’s “deficient performance prejudiced the
defense.” Id. at 687. For counsel’s error to be prejudicial, “[i]t is not enough… that [it] had some
conceivable effect on the outcome of the proceeding.” Id. at 693. Instead, there must be a
“reasonable probability that, but for counsel’s unprofessional errors, the result of the proceeding
would have been different.” Id. at 694. A reasonable probability is a “probability sufficient to
undermine confidence in the outcome.” Ibid. Counsel must have engaged in errors “so serious as
to deprive the defendant of a fair trial, a trial whose result is reliable.” Id. at 687. “An error by
counsel, even if professionally unreasonable, does not warrant setting aside the judgment of a
criminal proceeding if the error had no effect on the [ultimate] judgment.” Id. at 691.
Defendants alleging ineffective assistance of counsel bear “a heavy burden of proof.”
Whiting v. Burt, 395 F.3d 602, 617 (6th Cir. 2005). The “threshold issue is not whether [counsel]
was inadequate; rather, it is whether he was so manifestly ineffective that defeat was snatched from
the hands of probable victory.” United States v. Morrow, 977 F.2d 222, 229 (6th Cir. 1992). In
reviewing ineffective-assistance-of-counsel claims, the goal is not to ensure that a criminal
defendant is afforded perfect counsel, but rather “to ensure that the adversarial testing process
works to produce a just result under the standards governing decision.” Strickland, 466 U.S. at
687. The “proper measure of attorney performance remains simply reasonableness under
prevailing professional norms.” Id. at 688.
-10-
No. 22-5573, Hentzen v. United States
This court reviews de novo the denial of a 28 U.S.C. § 2255 motion and will overturn the
factual findings of the district court only if they are clearly erroneous. Hamblen v. United States,
591 F.3d 471, 473 (6th Cir. 2009). Ineffective-assistance-of-counsel claims present mixed
questions of law and fact and are reviewed de novo. Railey v. Webb, 540 F.3d 393, 415 (6th Cir.
2008).
A. Battle of the Experts
In his 28 U.S.C. § 2255 motion, Hentzen relies heavily upon the affidavit and testimony of
his new expert, Dr. Andrew Cobb, at his evidentiary hearing to identify issues that he says his trial
counsel should have responded to or raised. Dr. Cobb’s affidavit was based on copies of evidence
introduced at trial along with spreadsheets and other data files provided in discovery. At the
evidentiary hearing, Dr. Cobb alleged that the computers and computer devices that were seized
from Hentzen’s residence and later admitted into evidence during trial were not properly handled.
The Kentucky Office of Attorney General’s Cyber Crimes Branch, according to Dr. Cobb’s
testimony at the hearing, mishandled Hentzen’s items because they did not comply with applicable
industry standards in their investigation. To support his claim, Dr. Cobb pointed to several
thousand files that contained time stamps and dates after the evidence was taken into custody. Dr.
Cobb testified at the evidentiary hearing that this could indicate “a variety of activity,” but did not
opine as to what caused the post-custody time stamps on those files.
During cross-examination, however, Dr. Cobb contradicted himself. Cobb admitted that
the on-scene “triage” that investigators used on Hentzen’s computer and computer devices, which
involves running a particular program—OS Triage—to examine for suspect activity on devices
during the execution of a search warrant, can result in post-custody timestamps. Moreover, Cobb
-11-
No. 22-5573, Hentzen v. United States
testified that on-scene triage is, in fact, acceptable practice in this precise investigatory situation:
when investigators see contraband on the screen and suspect that file encryption may be involved.
This acceptable practice is in line with the testimony of Detective Mike Littrell, a forensic
examiner and detective with the Kentucky Attorney General’s Office Cyber Crimes Unit, who
testified that triage is (1) a part of basic forensic protocol; (2) can be performed on site without a
further search warrant; and (3) results in additional post-seizure dates being placed on a file.
Further, Detective Littrell noted that the “created” file dates—the only forensic date of importance
in a child-pornography case—were not modified. Dr. Cobb acknowledged that none of Hentzen’s
child-pornography files in question contained any creation dates that post-dated the search warrant.
Dr. Cobb also contested the testimony of William Baker, the government’s forensic
examiner, with respect to how certain shortcut files—.lnk and thumbs.db files found on Hentzen’s
computer—were created. Examiner Baker testified that a .lnk file is created when a file is opened
and a thumbs.db file is created by Windows software when a file is either viewed or opened in
icon or display view. Cobb argued, however, that .lnk files may also be created using two other
methods: right clicking on a file and creating a shortcut link, and moving an already existing .lnk
file from one device to another. Notably, however, Dr. Cobb conceded that the .lnk files, as well
as the actual child-pornography files, in question matched the existing file paths on Hentzen’s
computer, noting that there was no evidence that the .lnk files were copied or had traveled from
another computer onto Hentzen’s computer.
Likewise, Dr. Cobb also disagreed with Examiner Baker’s testimony about the creation of
thumbs.db files. Cobb testified that a thumbs.db file appears when a file is opened and viewed in
icon view or when a file is moved from one computer to another, even if it was never opened.
Cobb conceded, however, that there was no evidence that the thumbs.db files in question were
-12-
No. 22-5573, Hentzen v. United States
copied from another computer to Hentzen’s computer; the actual child-pornography files upon
which the thumbs.db files were created already existed on Hentzen’s computer. Stated simply, Dr.
Cobb concluded that the shortcut files in question, .lnk and thumbs.db files, as well as the actual
child-pornography files, both existed, and that they had matching file paths on Hentzen’s computer
and computer devices; there was no evidence that they were copied onto Hentzen’s devices.
Lastly, Dr. Cobb attempted to discredit Examiner Baker’s rebuttal testimony with respect
to Hentzen’s batch-downloading defense. While Hentzen testified that he did not have an
awareness of exactly what he was downloading because his practice was to download several files
at once, Baker testified in rebuttal that this was untrue because certain downloaded files on
Hentzen’s computer had different timestamps, rather than a single one indicative of batch
downloading. Cobb, however, noted that the creation times of the files revealed a pattern of many
files sharing a single timestamp on Hentzen’s eMule folder.
The magistrate judge recommended denying Hentzen’s motion to vacate, finding that
Hentzen’s counsel was not deficient or prejudicial. The magistrate judge explained that, had Dr.
Cobb testified at trial, the testimony would not have had any meaningful effect to undermine the
government’s credibility with respect to its data-collection methods.
Similarly, the magistrate judge explained that Dr. Cobb simply presented his own
speculation regarding how thumbs.db and .lnk files could have been copied and transferred from
another computer onto Hentzen’s own computer; there was no real evidence supporting this
method of shortcut file creation. Finding that the weight of the evidence clearly pointed to the fact
that the child-pornography files were accessed on Hentzen’s computer and computer devices, the
magistrate judge found that Dr. Cobb’s highlighting of “minor” inconsistencies was ultimately
insignificant. The magistrate judge found that, even taking Hentzen’s batch-downloading
-13-
No. 22-5573, Hentzen v. United States
testimony as true against that of Baker’s rebuttal, no prejudice resulted, considering the volume
and strength of evidence against Hentzen. The district court agreed and denied the § 2255 motion.
We agree. Hentzen has failed to show that, had Dr. Cobb’s speculative critiques of counsel
based on the evidentiary record at trial been presented to the jury at said trial, the result would have
been different. In fact, at the evidentiary hearing, Dr. Cobb conceded on several key issues asserted
in his affidavit, including the industry standards of acceptable triage practice, the creation and
presence of “shortcut evidence,” and the time stamps associated with Hentzen’s downloading
patterns. Thus, Hentzen’s argument fails to demonstrate that counsel’s performance was deficient
or that the trial outcome would have been different. Considering the evidence, he has done quite
the opposite.
B. Preparation of Computer-Forensics Evidence
On appeal, Hentzen claims that counsel was unprepared to address the government’s
computer-forensics evidence. He argues that his counsel was deficient because he should have
been prepared to show that investigators mishandled seized computer-forensics evidence and that
the government’s expert provided inaccurate testimony. The jury, he argues, did not have the
opportunity to hear mitigating evidence as to how the computer evidence was seized. Had they
had that opportunity, Hentzen claims, the integrity of the government’s computer evidence would
have been undermined.
Hentzen’s failure-to-challenge argument fails. As acknowledged by Dr. Cobb himself, the
evidence was handled properly. Dr. Cobb’s own testimony noted that an exception to the general
industry practice of powering down devices upon seizure applied to this case—when contraband
was visible on the screen. Thomas Bell testified at trial that Hentzen’s computer was in the process
of actively downloading content using eMule software at the time the search warrant was executed
-14-
No. 22-5573, Hentzen v. United States
and that the names and keywords of those files were indicative of child pornography and
immediately visible to the investigators. Thus, the subsequent decision by investigators to triage
Hentzen’s computers and computer devices was a reasonable one.
Expert testimony, including that of Dr. Cobb, contravenes Hentzen’s argument. As
mentioned above, Dr. Cobb himself conceded that the post-custody timestamps that he once argued
were significant were a result of the triaging on Hentzen’s computer at the time the search warrant
was executed. Likewise, Detective Littrell testified that changes in the times and dates of files
were an “expected outcome” of the process. Both Dr. Cobb and Detective Littrell agreed that the
created dates of the child-pornography files were the most significant pieces of evidence and were
never modified in this case.
Hentzen’s counsel testified at the evidentiary hearing that he consulted not one but two
forensic experts, both of whom raised no issues with the forensic methods used by the government.
Counsel stated that, had his experts found an issue with the forensics, he would have made the
strategic choice to contest the evidence presented by the government. Counsel’s strategic choice
to forgo countering this evidence, therefore, was sound trial strategy that exercised reasonable
professional judgment. As such, counsel cannot be considered deficient or prejudicial for a failure
to challenge the computer-forensics evidence.
C. Importance of Computer-Forensics Evidence Admitted to Trial
Relying on Dr. Cobb’s opinion, Hentzen also challenges counsel’s failure to contest the
accuracy of the government’s expert testimony. He argues that counsel allowed the government
expert to testify inaccurately and did not provide appropriate factual context regarding the nature
of shortcut files on his devices. Hentzen argues that their existence does not necessarily mean that
he opened the original, existing child-pornography files upon which the shortcut files were made,
-15-
No. 22-5573, Hentzen v. United States
but rather that the files could be on his device through other means, such as transferring the files
from another device onto his own. This argument also fails under Strickland.
As mentioned, Dr. Cobb presents mere speculation, not evidence, relating to the alternative
ways in which .lnk and thumbs.db shortcut files can be created. Regarding the child-pornography
videos in question, Dr. Cobb conceded that the .lnk and thumbs.db shortcuts traced back to and
matched file paths with those found on Hentzen’s computer. Simply stated, the actual files upon
which the shortcut files were based were on Hentzen’s computer; there is no evidence that the
shortcut files were on Hentzen’s computer through other means.
Hentzen correctly identifies two instances in which Examiner Baker’s trial testimony was
incorrect: (1) eMule was installed on more than one, not just on one, of Hentzen’s computers, and
(2) Baker’s assertion that Hentzen downloaded some files individually or in small batches of a few
files at a time was not supported by Hentzen’s eMule history, which in fact favored Hentzen’s
claim that he mostly batch-downloaded his files in bulk.
For an ineffective-assistance-of-counsel claim to prevail, however, the question is whether
counsel’s failure to highlight these errors in Baker’s testimony fell below professional standards
and prejudiced Hentzen’s defense. While Hentzen’s counsel may have failed to highlight the
presence of eMule on multiple devices, Hentzen himself stated this fact to the jury in his own
testimony. As such, this point did not require a qualified expert to testify, and Hentzen cannot
fault counsel for deficiency on this ground. In addition, it would not seem that this discrepancy is
either relevant or harmful.
Likewise, whether counsel contended that some, most, or all of Hentzen’s contraband files
were downloaded individually or in batches does not render his performance ineffective. Hentzen
argues that, had trial counsel been effective, he would have been able to undermine the confidence
-16-
No. 22-5573, Hentzen v. United States
in the computer-forensics evidence. This would, in turn, provide the jury with reasonable doubt
that Hentzen knew he downloaded child pornography and produce a different result.
There is no doubt, however, that Hentzen had knowledge of what he was doing. Regardless
of the downloading method, it is uncontested that thousands of child-pornography files were
downloaded onto Hentzen’s computer. Accomplishing this necessarily required Hentzen to
knowingly search in specific places and for specific terms on the internet. A survey of Hentzen’s
last 30 searches on eMule alone showed terminology referring to known darknet child-
pornography production studios and websites, titles and abbreviations for child pornography
known to law enforcement, known terminology added to the ends of file names to disguise child
pornography files from the authorities, and the words “toddler” in Dutch and “daughter,” “sister,”
and “brother” in German. Counsel’s failure to challenge Baker’s testimony was not prejudicial to
Hentzen, considering the evidence. Under Strickland, Hentzen again fails to prove that counsel’s
performance was deficient and that the outcome of his proceeding would have been different.
Lastly, Hentzen claims that, had his counsel been constitutionally adequate, he would have
been able to keep out of the trial record an allegedly prejudicial animated “grooming video” that
he claims was erroneously introduced into evidence. This would, in Hentzen’s view, have
warranted a reversal for a new trial on his direct appeal. Hentzen also asserts that, had counsel
been effective, he would have been able to undermine this piece of “significant circumstantial
evidence.” Hentzen I, 638 F. App’x at 431.
Again, Hentzen’s argument fails. As this court previously held, the admission of the video
evidence was one of harmless error. Id. at 435. Whether the admission of improperly admitted
404(b) evidence “substantially swayed” a jury “generally depends on whether the properly
-17-
No. 22-5573, Hentzen v. United States
admissible evidence of defendant’s guilt was overwhelming.” Id. at 434. Again, Hentzen fails to
show that his counsel was ineffective or prejudicial.
The weight of properly admitted evidence in this case is overwhelming. For Hentzen to
acquire thousands of images and videos of minors engaged in sexual abuse and sexual conduct, he
intentionally inserted keywords and phrases that he knew related to child pornography into a search
box on a peer-to-peer network, directed the program to search for files that matched those known
terms, selected the files to download from a screen that revealed the file names, instructed the
computer to download those files, and eventually removed them from his incoming folder to other
locations. As this court previously held, the admission of an isolated video in light of the evidence
is not substantial or prejudicial. There was no undermining of the properly admitted evidence in
this case; the “limited” use of single video weighed against the body of “horrifying” evidence
presented did not materially affect the outcome of the case. Hentzen I, 638 F. App’x at 435.
AFFIRMED.
-18-