In this case such prove should be possible. Files creation dates would show that the files were downloaded when the teacher was absent. The dates would make it easy to associate this accident with your class and then, after asking a few questions, with your classmate.
The real problem is that the minute it was found the teacher would probably be fired, or at a minimum put on administrative leave, the media would catch word of it and publicly tarnish him, parents would demand swift action, and before the investigation even had a chance to get going the guy's life would be ruined. In the end, even if he was found innocent, the lasting damage would done.
This is basic criminal defense stuff, actually. "What time did you go to the cafeteria? Did anyone else see you there?" Then talk to the people who he says saw him.
Are there any cameras in the school that might have captured his visit to the cafeteria? Review the footage.
How did he pay for his food? Did that create a record that can establish a time and location?
Are there any witnesses who saw the kid sit down at the computer? Like the substitute teacher, for instance?
None of this is unique to child porn cases. Establishing or disputing time and location is basic trial strategy. All a defendant has to do is create reasonable doubt, not conclusively prove innocence.
>This is basic criminal defense stuff, actually. "What time did you go to the cafeteria? Did anyone else see you there?" Then talk to the people who he says saw him.
And they'd remember they saw him after 6 months, and even more so that they saw him leave in 15:20 instead of 15:10, because?
>None of this is unique to child porn cases.
No, but all this make "I didn't change them because filestamps in file are in an hour I wasn't there" difficult.
Heck, the teacher himself will probably not remember where he was at the time the timestamps show...
And easily sold to a jury as proof positive after they were altered. I've feared for a lot time that this type of thing is currently in the government arsenal of threats and weapons.
Honestly, even if you can prove you were framed 100% and are found not guilty, the media has likely already run several stories regarding the teacher who's computer had child porn on it. The school will be forced to fire them. The school board will likely bar them from ever working in another school in that city again. When you Google that person's name the top categories will likely be regarding their trial / arrest.
Once an accusation of child pornography (creation or possession) is put out there if any of it gets exposed to the public by the way of the media (and it will) that person's life is seriously ruined even without prison time.
The problem seems to get worse, too and I certainly don't have any good ideas regarding it. Except maybe re-tooling a new search engine that somehow can take context / validity into account but that's exceptionally difficult to do. And even then if someone gets their news or information from any other source you're still screwed.
