2025 IL App (4th) 240827 FILED NO. 4-24-0827 July 16, 2025 Carla Bender 4th District Appellate IN THE APPELLATE COURT Court, IL OF ILLINOIS FOURTH DISTRICT THE PEOPLE OF THE STATE OF ILLINOIS, ) Appeal from the Plaintiff-Appellee, ) Circuit Court of v. ) McLean County JOSEPH R. BONNETTE, ) No. 21CF252 Defendant-Appellant. ) ) Honorable ) William A. Yoder, ) Judge Presiding.

JUSTICE ZENOFF delivered the judgment of the court, with opinion.

Presiding Justice Harris and Justice Vancil concurred in the judgment and opinion.

OPINION ¶1 Following a bench trial, the trial court found defendant, Joseph R. Bonnette, guilty of possessing child pornography (720 ILCS 5/11-20.1(a)(6) (West 2018)) and sentenced him to four years in prison. Defendant appeals, challenging the sufficiency of the evidence and arguing that the court erred by allowing the State to amend the indictment during trial. We affirm.

¶2 I. BACKGROUND ¶3 A. The Charge and the Amendment to the Indictment ¶4 The investigation leading to this case took about three years to complete. Although authorities found evidence of numerous images constituting child pornography on devices seized from defendant’s home, the three-year statute of limitations prevented the State from charging defendant with possessing all but one of those images. See 720 ILCS 5/3-5(b) (West 2018).

Specifically, on March 4, 2021, the State charged defendant by information with possessing child pornography on or about March 6, 2018. According to the information, defendant “knowingly possessed a photograph or other similar visual reproduction or depiction by computer of a child depicted or portrayed in a pose, posture or setting involving a lewd exhibition of the transparently clothed pubic area of said child whom the defendant knows or reasonably should know to be under the age of 18 years.”

The information identified the subject image as a JPEG file that had an alphanumeric name consisting of 141 characters. On March 17, 2021, a grand jury returned an indictment that was identical to the information.

¶5 Defendant never invoked the statute of limitations as a defense. Although the parties may not have realized it before trial, the JPEG file listed in the information and indictment was modified (i.e., viewed) on defendant’s cell phone on March 2, 2018, which was just outside the statute of limitations. However, the same image was present multiple times on defendant’s cell phone, evidently with different file names and modified dates. One file depicting the charged image was modified on March 6, 2018, which was within the statute of limitations and corresponded to the date alleged in the information and the indictment. This file had a name consisting of 20 numbers.

¶6 The matter proceeded to a bench trial. The State’s first four witnesses detailed the investigation but did not testify about the specific image that formed the basis for defendant’s charge. Before the State’s final witness testified, the prosecutor realized that the indictment alleged “the wrong file name.” Maintaining that this was a formal defect, the prosecutor moved to amend the indictment to correct the name of the file that defendant allegedly possessed on March 6, 2018.

-2- Defense counsel objected on the basis that “we’re already a good way part through the trial.” He added, “I do think there are some issues with the dates, and depending on which date it would have been, it could have fallen outside of the statute of limitations.” The trial court asked defense counsel whether he thought this was a formal defect. Defense counsel responded, “I’m going to say not,” though he acknowledged he had not dealt with this issue before. The prosecutor then argued that there was no unfairness to the defense because the State’s witnesses had not yet testified about the charged image and the defense had been provided all images during discovery.

The court deemed the file name to be a formal defect in the indictment and allowed the amendment to correct it.

¶7 B. The Trial Evidence ¶8 The evidence showed that Bobby Wallace was a member of the Illinois Attorney General’s Internet Crimes Against Children Task Force. Part of Wallace’s job was to operate a computer with software that searched the BitTorrent network for torrents known to constitute child pornography and download them from users. On March 16, 2018, Wallace downloaded 109 files from a computer that was running software called qBittorrent version 3.3.14. Wallace viewed those files and determined that multiple ones contained child pornography. Through further investigation, Wallace ascertained that the account from which he downloaded these files was assigned to defendant at an address in Normal, Illinois. Wallace obtained a search warrant for defendant’s home and then turned the investigation over to other law enforcement officers.

¶9 On April 26, 2018, police officers executed a search warrant at the home where defendant resided with his wife and two children. Officers seized multiple electronic devices, including an iBuyPower computer tower, a Samsung Galaxy Note 8 cell phone, and a Samsung Galaxy Tab S3 tablet. It took almost three years for the Illinois Attorney General’s Office to

-3- complete the forensic examinations of these devices.

¶ 10 James Stapleton, a digital forensic examiner supervisor with the Illinois Attorney General’s Office, examined the iBuyPower computer tower. Inside that device, Stapleton found two hard drives: an Intel solid state drive and a Seagate Barracuda drive. He was unable to examine the Seagate Barracuda drive due to a mechanical failure. Upon examining the Intel drive, Stapleton discerned the following information. The username on the Intel drive was “JRBON,” and the full name associated with it was “Joe Bonnette.” Stapleton was unable to locate any digital data files related to child pornography, including the files that Wallace’s computer had downloaded.

However, Stapleton noted that there were references to media files associated with a “D” drive, yet no such drive could be located. Stapleton also found that there was a software application on the Intel drive called Eraser that would allow someone to delete files securely. This program had been run nine times, most recently on April 18, 2018. Stapleton identified “logs of interest” pertaining to the Eraser program, which contained references to a “D” drive and indicated that certain files could not be erased. The titles of those files contained references to “Lolita” and “Loli,” which Stapleton testified were terms commonly associated with child-exploitation investigations. There were similar logs of interest tied to the qBittorrent application. Stapleton determined that the Intel drive was running qBittorrent version 4.0.4, which was last updated on March 26, 2018.

¶ 11 On cross-examination by defense counsel, Stapleton acknowledged that qBittorrent could be used to download lawful materials, so there was nothing inherently nefarious about having that program. Stapleton explained that he believed “Loli” is short for Lolicon, which is animated cartoon pornography. Stapleton acknowledged that, aside from the username associated with the Intel drive, he could not determine who used that device and at what times.

-4- ¶ 12 Defense counsel directed Stapleton’s attention to multiple portions of the “logs of interest” set forth in his extraction report. Evidently, counsel meant to demonstrate that someone attempted to erase some of the files associated with the terms “Loli” and “Lolita” from the Intel drive shortly after they were downloaded, thus suggesting that the user of the device was not actively seeking out such material. However, Stapleton ultimately testified that he was unable to determine whether the items that defense counsel pointed out were all referencing the same files.

On redirect examination, Stapleton added that he was not trained or qualified to read those “logs of interest,” so he could not say whether they referenced files that were actually successfully downloaded on the Intel drive.

¶ 13 The State’s final witness was Jacob LaShure, who previously worked for the Illinois Attorney General’s Office as a digital and forensic examiner. He examined multiple devices seized from defendant’s home, one of which was a Samsung Galaxy Note 8 cell phone. LaShure found usernames, user accounts, and credit card information suggesting that defendant owned this phone.

LaShure found more than 100 cache images depicting either child pornography or child erotica on the phone. LaShure explained that cache images are copies of original images that are typically created automatically due to user interaction with an application. Relevant here, one such image was a file with the 20-number name that was specified in the amended indictment. That image, which LaShure testified constituted child pornography, was introduced at trial as State’s exhibit No. 2A. A larger version of that same image was introduced as State’s exhibit No. 2B.

¶ 14 Asked where this cache image was located on the phone, LaShure explained that it was associated with a program called “com.sec.android.gallery3D” and the Gallery application.

He testified that the Gallery application is a default application installed on Samsung devices that is used to view images and videos, functioning very similarly to the Photos application on Apple

-5- devices. Asked how the Gallery application generates cache images, LaShure responded: “So this application generates multiple different types of cache images, and so the two notable is [sic] a micro cache image and a large cache image. So a micro cache image is generated when the visually depicted photo appears in micro view of the Gallery Application. This micro view is generally the view when the Gallery is first opened, so typically there are multiple photos visible in the micro view.

And then the large cache image is generated by the application when it is viewed in large view or full screen view. So if a photo is selected from the micro view in full screen, then a secondary cache image is created called a large cache image. This is a large cache image that was located associated to that application.”

LaShure explained that, in other words, State’s exhibit Nos. 2A and 2B were a large cache image created when somebody selected this image from a screen in the Gallery application and viewed it as a larger image to fill the whole screen. Generating cache images in the Gallery application requires user interaction.

¶ 15 LaShure testified that he was unable to find the original “non-cache” version of the charged image on the phone, which suggests that it was deleted from the phone at some unknown point. Nevertheless, LaShure clarified that State’s exhibits Nos. 2A and 2B were cache images that “are visually depicting the original image that appears to have been deleted.” Data associated with State’s exhibit No. 2A showed that the modified date of the large cache image was March 6, 2018, at “12:02:45 a.m. UTC time” (Coordinated Universal Time). Thus, LaShure determined that the original image was viewed in large view in the Gallery application on that date.

¶ 16 LaShure also examined the Samsung Galaxy Tab S3 that was seized from defendant’s home. There were more than 200 “child pornography and child erotica cache images”

-6- on this device. The trial court allowed the State to introduce seven of those images into evidence to show propensity, opportunity, intent, knowledge, and absence of mistake or accident. See 725 ILCS 5/115-7.3(b) (West 2022) (allowing an uncharged instance of possessing child pornography to be “considered for its bearing on any matter to which it is relevant”); Ill. R. Evid. 404(b) (eff.

Jan. 1, 2011) (allowing evidence of other crimes to be used for purposes other than propensity).

According to LaShure, the path files for these images were “associated with a cache folder in the cloud agent directory.” In other words, the Samsung tablet synced with the Samsung phone via the cloud, and those images were present on both devices.

¶ 17 On cross-examination by defense counsel, LaShure acknowledged that some users may not be aware that cache images from the Gallery application are saved. He could not determine whether defendant had access to cache images created by the Gallery application. LaShure testified that he was unable to determine whether the image defendant was charged with possessing came from a specific website or how the image arrived on defendant’s phone. Asked whether he could determine whether this photograph was viewed, LaShure reiterated that the generation of the cache image through the Gallery application meant that it was indeed viewed. However, LaShure could not tell how long the photograph was viewed or how quickly defendant terminated possession of it. Artifacts indicated that the photograph was viewed on both the tablet and the phone.

¶ 18 On redirect examination, LaShure testified that he could not discern whether any of the cache images he found came from websites or BitTorrent downloads. According to LaShure, the creation of a cache image implies that an original photograph was on the device at that time.

Thus, because the original version of the charged image was on the phone as of March 6, 2018, but was not on the phone when it was seized on April 26, 2018, LaShure deduced that the image was deleted at some point between those dates. LaShure reiterated that the image was viewed on

-7- both the phone and the tablet. However, the tablet contained only a micro cache image, “which means that image was viewed in a micro view,” whereas there was a large cache view on the phone.

¶ 19 LaShure also testified that he found web activity on the phone associated with the term “Loli,” which typically refers to a young girl. Although LaShure had encountered that term in multiple child pornography investigations, he acknowledged that the term was not unique to child pornography. Accordingly, one could use that search term and access materials that do not constitute child pornography.

¶ 20 Defendant elected not to present any evidence.

¶ 21 C. Guilty Finding, Posttrial Motion, and Sentencing ¶ 22 The trial court found defendant guilty of possessing child pornography, reasoning as follows. The image contained in State’s exhibit Nos. 2A and 2B, which was recovered from a phone and a tablet, “clearly constitutes child pornography.” There was no question that the phone belonged to defendant, as it contained information tying him to it. The forensic evidence showed that the charged image was opened on March 6, 2018, at which point the full image was displayed on the phone. The court believed that “defendant possessed that image at that time.” The question thus became whether defendant knowingly and voluntarily possessed the image or whether he immediately deleted it because it was downloaded mistakenly. In determining that the State proved that the former occurred, the court considered that (1) the image was opened, not downloaded, at 12:02:45 a.m. on March 6, 2018, (2) there were “hundreds of images of potential child pornography on the defendant’s devices,” and (3) “[t]here had been clear efforts to delete images from those devices.” In the court’s view, the seven uncharged images located on the Samsung tablet that were introduced into evidence showed a “clear intent *** to download images of young

-8- victims of child pornography over a period of time” and “an absence of mistake.” The court also believed that defendant “clearly used search terms that result in images such as these being located.” Evidence of attempts to erase images further supported the court’s conclusion that “defendant understood the nature of this.” To that end, the court inferred that defendant removed the “D” drive from the iBuyPower computer tower “when the Eraser program didn’t work” on that drive.

¶ 23 In his amended postjudgment motion, defendant asserted, with no further argument, that the trial court “erred when granting the State’s motion to amend the Bill of Indictment over defendant’s objection.” At the hearing on the postjudgment motion, defense counsel elected to stand on the motion without presenting additional argument. The court denied the motion and sentenced defendant to four years in prison. The court later denied defendant’s motion to reconsider the sentence, and defendant filed a timely notice of appeal.

¶ 24 II. ANALYSIS ¶ 25 A. Amendment to the Indictment ¶ 26 Defendant first argues that the “trial court abused its discretion when it granted the State leave to amend the indictment late in the trial where the amendment addressed a substantive defect and the State failed to comply with statutory requirements governing the form of the charge.” Defendant reasons as follows. The original indictment referenced a JPEG file with a modified date of March 2, 2018, which was more than three years before the State charged defendant with possessing child pornography. Thus, on the face of the original indictment, “the offense was committed, if at all, outside the period of limitations,” and it was incumbent on the State to allege facts invoking an exception to the statute of limitations. The State did not invoke an exception, so the original indictment was “fatally deficient” and failed to “allege an essential

-9- element of the crime.” Because defendant ultimately objected to the State amending the indictment, the appellate court should consider whether the original indictment strictly complied with section 111-3(a) of the Code of Criminal Procedure of 1963 (Code) (725 ILCS 5/111-3(a) (West 2020)), which sets requirements for the form of charges, rather than invoking the more lenient standards that apply when a party challenges a charging instrument for the first time on appeal. Defendant maintains that the original indictment “did not strictly comply” with section 111-3(a)(4), as “[i]t did not set forth ‘the date *** of the offense as definitely as [could have been] done.’ ” See 725 ILCS 5/111-3(a)(4) (West 2020).

¶ 27 From these premises, defendant concludes that the defect in the original indictment was substantive rather than formal in nature, so the indictment could not be amended at trial pursuant to section 111-5 of the Code (725 ILCS 5/111-5 (West 2020)). Additionally, defendant argues that allowing the State to amend the charge at trial prejudiced him, as doing so took away his “complete defense to the original charge.”

¶ 28 The State responds that the trial court properly allowed the amendment to the indictment to correct a formal defect. According to the State, the indictment met all the requirements of section 111-3(a) of the Code and alleged that the offense occurred on March 6, 2018. In the State’s view, the amendment corrected “the name of a file which was misstated[ ] and was not required to be plead[ed] in the indictment.” The State proposes that because defendant failed to file a motion to dismiss the original indictment, for purposes of evaluating the sufficiency of the charge, we should look to the liberal pleading standards that apply when a party challenges a charge for the first time on appeal. The State insists that defendant suffered no prejudice from the court allowing the amendment, as defendant “never enjoyed [a statute of limitations defense] in the first place.”

- 10 - ¶ 29 To address defendant’s challenge in the most logical way, we will first consider his contention that the original indictment was fatally defective and did not strictly comply with section 111-3(a)(4) of the Code. In light of our analysis on that issue, we will then consider whether the trial court properly allowed the State to amend the indictment during trial pursuant to section 111-5 of the Code. ¶ 30 1. The Original Indictment Was Not Fatally Defective ¶ 31 Section 111-3(a) of the Code provides that a criminal charge must (1) state the name of the offense, (2) cite the statute that was violated, (3) set forth the nature and elements of the offense, (4) state the date and county of the offense as definitively as can be done, and (5) state the name of the accused, if known. 725 ILCS 5/111-3(a) (West 2020). The “failure to charge an offense implicates due process concerns,” so a defendant may raise this issue at any time. People v. Libricz, 2022 IL 127757, ¶ 36.

¶ 32 “However, the timing of the challenge to the charging instrument is important in determining whether reversal of a defendant’s conviction is required.” Libricz, 2022 IL 127757, ¶ 36. If a defendant files a pretrial motion challenging the charging instrument, “ ‘the charging instrument must strictly comply with the requirements in section 111-3(a).’ ” Libricz, 2022 IL 127757, ¶ 37 (quoting People v. Carey, 2018 IL 121371, ¶ 21). On the other hand, if a defendant challenges a charging instrument for the first time on appeal, a more liberal standard applies.

Libricz, 2022 IL 127757, ¶ 37. Specifically, “[i]n that instance, it is sufficient that the indictment apprised the accused of the precise offense charged with enough specificity to (1) allow preparation of his defense and (2) allow pleading a resulting conviction as a bar to future prosecution arising out of the same conduct. [Citation.] In other words, the appellate court

- 11 - should consider whether the defect in the information or indictment prejudiced the defendant in preparing his defense. [Citations.]

In determining whether prejudice exists, the reviewing court may resort to the record. [Citation.] Thus, the question is whether, in light of the facts of record, the indictment was so imprecise as to prejudice [the] defendant’s ability to prepare a defense. [Citation.] If the reviewing court cannot say that the charging instrument error inhibited the defendant in the preparation of his or her defense, then the court cannot conclude that the defendant suffered any prejudice.” (Internal quotation marks omitted.) Libricz, 2022 IL 127757, ¶¶ 37-38.

A defendant’s argument that the charging instrument is insufficient presents an issue of law that the reviewing court considers de novo. Libricz, 2022 IL 127757, ¶ 34.

¶ 33 Defendant argues that the original indictment did not strictly comply with the requirements of section 111-3(a)(4) of the Code. However, defendant never argued in the proceedings below that the charging instrument was deficient, even when objecting to the State’s request to amend the indictment during trial. Accordingly, this a new issue raised for the first time on appeal. We must review defendant’s contentions pursuant to the liberal standard that applies where a defendant challenges the adequacy of a charge for the first time on appeal. Notably, defendant makes no attempt to argue that reversal is required under that standard. With that said, as explained below, the outcome of this appeal would be the same under either standard, as the original charge strictly complied with the Code’s requirements for charging an offense.

¶ 34 We reject defendant’s claim that the original indictment was “fatally deficient” and failed to “allege an essential element of the crime.” The indictment included all the information required by section 111-3(a) of the Code, including (1) the name of the offense (“child

- 12 - pornography”), (2) the statute that defendant allegedly violated (“720 ILCS 5/11-20.1(a)(6)”), (3) the nature and elements of the offense (“defendant knowingly possessed a photograph or other similar visual reproduction or depiction by computer of a child depicted or portrayed in a pose, posture or setting involving a lewd exhibition of the transparently clothed pubic area of said child whom the defendant knows or reasonably should know” was under age 18), (4) the date and county of the offense (“on or about the 6th day of March, 2018,” in “the County of McLean”), and (5) the name of the accused (“Joseph R Bonnette”). Notably, in a prosecution for possessing child pornography, section 111-3(a) of the Code does not require the State to define the details of the images that it intends to introduce at trial with further specificity. See People v. Hirsch, 221 Ill. App. 3d 772, 777 (1991) (explaining that the requirement of section 111-3(a)(3) to set forth the nature and elements of an offense in a charging instrument does not require the State to “identify in minute detail the subject matter of each individual photograph or magazine expected to be introduced at trial”). In other words, the State is correct that the name of the file that defendant possessed on March 6, 2018, “was not required to be plead[ed] in the indictment” to satisfy the minimum requirements for alleging an offense. Thus, the original indictment strictly complied with section 111-3(a) of the Code. ¶ 35 Moreover, defendant acknowledges that “the date of the offense is not an essential element in child sex offenses.” Nevertheless, in arguing that the original indictment was deficient, he maintains that the original indictment showed that “the offense was committed, if at all, outside the period of limitations.” In his reply brief, defendant goes so far as to assert that the original indictment charged him with possessing child pornography on March 2, 2018, which was outside of the statute of limitations. This argument is contradicted by the record. The original indictment expressly alleged that the offense occurred on or about March 6, 2018, which was less than three

- 13 - years before the State charged defendant with child pornography on March 4, 2021. Thus, the original indictment properly alleged a timely prosecution for the offense of child pornography with the specificity required by section 111-3(a) of the Code. ¶ 36 We recognize that the original indictment included an incorrect file name corresponding to the image that defendant allegedly possessed on March 6, 2018. According to the prosecutor’s representations to the trial court, the file name listed in the original indictment contained another version of the same image that defendant apparently viewed on the same phone on March 2, 2018. However, as explained above, the error pertained to information that was not required to be alleged in the charging instrument. Thus, the erroneous file name did not render the original indictment fatally defective. We also note that defendant knew before trial exactly which image the State was charging him with possessing and on what date, so there is no concern here about whether he had adequate notice of the charge he faced.

¶ 37 For all these reasons, we reject the portion of defendant’s appellate challenge premised on the notion that there was a fatal defect in the original indictment.

¶ 38 2. The Trial Court Acted Within Its Discretion by Allowing the State to Amend the Indictment ¶ 39 The remaining issue is whether the State was entitled to amend the indictment to correct the name of the file that defendant allegedly possessed on March 6, 2018. Section 111-5 of the Code provides: “An indictment, information or complaint which charges the commission of an offense in accordance with Section 111-3 of this Code shall not be dismissed and may be amended on motion by the State’s Attorney or defendant at any time because of formal defects, including:

- 14 - (a) Any miswriting, misspelling or grammatical error; (b) Any misjoinder of the parties defendant; (c) Any misjoinder of the offense charged; (d) The presence of any unnecessary allegation; (e) The failure to negative any exception, any excuse or proviso contained in the statute defining the offense; or (f) The use of alternative or disjunctive allegations as to the acts, means, intents or results charged.” 725 ILCS 5/111-5 (West 2022).

The list of defects identified in this statute “is not intended to be exclusive.” People v. Kincaid, 87 Ill. 2d 107, 123 (1981). In general terms, “[f]ormal defects are distinguished from substantive changes that alter the nature and elements of the offense charged.” People v. Ross, 395 Ill. App. 3d 660, 668 (2009). “ ‘[A]n amendment is substantive and therefore improper if (1) it materially alters the charge, and (2) it cannot be determined whether the grand jury intended the alteration.’ ” Ross, 395 Ill. App. 3d at 668 (quoting People v. Milton, 309 Ill. App. 3d 863, 866 (1999)). By contrast, formal amendments are “warranted especially where there is no resulting surprise or prejudice to the defendant or where the record clearly shows that he was otherwise aware of the charge against him.” Ross, 395 Ill. App. 3d at 667.

¶ 40 We review the trial court’s allowance of the amendment for an abuse of discretion.

Ross, 395 Ill. App. 3d at 668. When reviewing for an abuse of discretion, the question is “whether the trial court’s decision is arbitrary, fanciful, or unreasonable to the degree that no reasonable person would agree with it.” (Internal quotation marks omitted.) People v. Morgan, 2025 IL 130626, ¶ 23. Where “no hint of surprise or prejudice to the defendant is shown,” an amendment to a charging instrument will be deemed proper. People v. Jones, 53 Ill. 2d 460, 465 (1973).

- 15 - ¶ 41 Here, the trial court allowed the State to amend the child pornography charge during trial to correct the name of the file that defendant allegedly possessed on March 6, 2018. The prosecutor explained to the court that defendant had multiple files on his phone containing the same image, with different modified dates for the files. The original indictment referenced the incorrect file name. The court deemed this to be a formal defect. For the following reasons, we agree and deem the file name to be a misnomer that was correctable pursuant to section 111-5 of the Code. See Jones, 53 Ill. 2d at 462, 465 (holding that a “misnomer” of the victim in a prosecution for armed robbery was “a mere formality”).

¶ 42 As explained above, defendant was aware before trial which specific image the State was accusing him of possessing and on what date. The amendment merely conformed the charge to the proof by correcting the file name for this image. Nevertheless, defendant argues that “unfair prejudice ensued” because he lost his statute-of-limitations defense, which he claims was “a complete defense to the original charge.” This argument is unpersuasive. Defendant never asserted a statute-of-limitations defense. Nor was there “a complete defense” available to defendant based on the statute of limitations. The original indictment alleged a timely violation of the child pornography statute based on March 6, 2018, being the date of possession. That is exactly what the State proved at trial.

¶ 43 Furthermore, the loss of a statute-of-limitations defense that was never asserted is not the type of prejudice that would preclude the State from amending a charge. To the contrary, case law indicates that amending a charge to address a statute-of-limitations problem may qualify as a formal correction that is within the scope of section 111-5 of the Code. In People v. Martin, 266 Ill. App. 3d 369, 371 (1994), over the defendant’s objection, the trial court allowed the State to amend the information on the day of trial to include allegations that the statute of limitations

- 16 - was tolled. The Fourth District affirmed this decision, reasoning that “the amendment did not change the substance of the original charge” and the defendant “was neither surprised nor prejudiced by this amendment.” Martin, 266 Ill. App. 3d at 374. Similar to what happened in Martin, the amendment to the indictment here did not change the substance of the child pornography charge, nor did it prejudice the defense. The grand jury plainly intended to charge defendant with possessing child pornography on March 6, 2018, and the amendment comported with that intention.

¶ 44 Notably, defendant cites no case where a trial court was deemed to have abused its discretion by allowing the State to amend a charging instrument. Rather, the parties’ cases illustrate the broad authority of courts to allow amendments in myriad contexts. See, e.g., Kincaid, 87 Ill. 2d at 120-21, 125-26 (affirming a decision to allow the State to amend an indictment immediately before trial to add an allegation that the victim was under the age of 16); Jones, 53 Ill. 2d at 462, 465 (affirming a decision to allow the State to amend an indictment on the morning of trial to correct the name of the victim in an armed-robbery charge); Ross, 395 Ill. App. 3d at 663, 673 (affirming a decision to allow the State to amend the indictment during a criminal sexual assault trial to correct the name of the victim and to change the allegation as to the manner in which the defendant committed the offense); People v. Flores, 250 Ill. App. 3d 399, 400, 403 (1993) (affirming a decision to allow the State to amend an indictment during trial to allege that the defendant delivered cocaine rather than heroin); People v. Barlow, 188 Ill. App. 3d 393, 397, 403 (1989) (affirming a decision to allow the State to amend an indictment on the day of trial to change the dates that the defendant allegedly committed the offense of aggravated criminal sexual assault).

¶ 45 Accordingly, we hold that the trial court did not abuse its discretion by allowing the State to amend the indictment during trial.

- 17 - ¶ 46 B. Sufficiency of the Evidence ¶ 47 Defendant also challenges the sufficiency of the evidence. In doing so, he does not dispute that the original version of the charged image both constituted child pornography and was once present on devices that he used. Rather, he maintains that the State failed to prove that he knowingly and voluntarily possessed the charged image. In presenting his argument, defendant mentions that (1) he never made inculpatory statements, (2) investigators never found digital data files constituting child pornography on the Intel hard drive contained in his iBuyPower computer tower, (3) the words “Loli” and “Lolita” had innocent meanings and were terms connected with file names rather than searches on his devices, and (4) there was no evidence suggesting he knew that images were being automatically cached on his devices or knew how to access that cache.

Defendant also emphasizes that it is unknown from the record (1) how the charged image arrived on his devices, (2) where that image came from, (3) how long it was viewed, (4) when the original version of that image was deleted, and (5) how quickly defendant “terminated the image.”

Defendant further reasons that “[b]oth the Eraser software and Bit Torrent program can be used for non-criminal activity.” At one point in his argument, defendant asserts that portions of the prosecutor’s response to defendant’s motion for a directed verdict “incorrectly argued the law” and “mis-stated the evidence.”

¶ 48 The State argues that the evidence was sufficient to support the conviction.

According to the State, the evidence showed that the original version of the charged image was on defendant’s cell phone on March 6, 2018. The State points to circumstantial evidence supporting an inference that defendant knowingly and voluntarily possessed that image. The State deduces that defendant must have viewed images constituting child pornography on the Internet, “downloaded them to one or more of his devices,” and “then viewed these images again from his

- 18 - phone and tablet.”

¶ 49 “A challenge to the sufficiency of the evidence in a criminal trial requires us to determine whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the defendant guilty beyond a reasonable doubt.” People v. Gumila, 2012 IL App (2d) 110761, ¶ 61. “We will reverse a criminal conviction only if the evidence was so unreasonable, improbable, or unsatisfactory as to create a reasonable doubt of the defendant’s guilt.” Gumila, 2012 IL App (2d) 110761, ¶ 61.

¶ 50 Defendant was convicted of child pornography pursuant to section 11-20.1(a)(6) of the Criminal Code of 2012 (720 ILCS 5/11-20.1(a)(6) (West 2018)), which provides that a person commits child pornography who, “with knowledge of the nature or content thereof, possesses any film, videotape, photograph or other similar visual reproduction or depiction by computer of any child *** whom the person knows or reasonably should know to be under the age of 18 ***, engaged in any activity described in subparagraphs (i) through (vii) of paragraph (1) of this subsection.”

Another subsection of this statute states: “The charge of child pornography does not apply to a person who does not voluntarily possess a film, videotape, or visual reproduction or depiction by computer in which child pornography is depicted. Possession is voluntary if the defendant knowingly procures or receives a film, videotape, or visual reproduction or depiction for a sufficient time to be able to terminate his or her possession.” 720 ILCS 5/11-20.1(b)(5) (West 2018).

Thus, the State must prove that a defendant possessed child pornography both knowingly and

- 19 - voluntarily. Gumila, 2012 IL App (2d) 110761, ¶ 51.

¶ 51 In presenting his argument, defendant relies heavily on three cases addressing situations where authorities found material constituting child pornography in temporary Internet files (TIFs) on electronic devices. See Gumila, 2012 IL App (2d) 110761, ¶¶ 20, 30; People v. Josephitis, 394 Ill. App. 3d 293, 296 (2009); United States v. Kuchinski, 469 F.3d 853, 856 (9th Cir. 2006). TIFs are created automatically as a person browses the Internet, and they are stored on a device whether a person knows about it or not. Kuchinski, 469 F.3d at 862. The courts deciding Gumila and Josephitis explored how the State may prove that a defendant knowingly and voluntarily possessed child pornography in prosecutions based on images located in TIFs. The court in Kuchinski addressed how child pornography found in TIFs relates to federal sentencing guidelines.

¶ 52 Defendant invokes language from these cases in arguing that the State did not prove that he knowingly and voluntarily possessed child pornography. For example, quoting Kuchinski, 469 F.3d at 863, he asserts: “ ‘Where a defendant lacks knowledge about the cache files and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images.’ ” Defendant’s reliance on this reasoning is unpersuasive, as the State did not prosecute him based on possessing cache images located in TIFs. Rather, the prosecution was based on evidence that authorities found a cache image that was associated with the Gallery application on defendant’s Samsung phone, which allowed for the conclusion that defendant had once possessed the original version of that image in his phone’s photo application. LaShure testified that the Gallery

- 20 - application is a default application installed on Samsung devices that is used to view images and videos, functioning very similarly to the Photos application on Apple devices. Common life experience teaches that, unlike TIFs, images end up stored in the photo album of one’s smart phone through user input rather than as an automatic and hidden function of Internet browsing. See G.T. v. Samsung Electronics America, Inc., 742 F. Supp. 3d 788, 793 (N.D. Ill. 2024) (noting that Samsung’s Gallery application saves and stores all videos and photographs that are captured by the device’s camera); State v. Lancial, No. 2022AP146-CR, 2023 WL 105714, at *5 (Wis. Ct. App. Jan. 5, 2023) (unpublished case reciting trial testimony that “an image can be saved into the gallery application [of a Samsung phone] if the user of the cell phone takes a photo with the phone’s camera, downloads the image from the Internet or from a text message, or takes a screenshot”). Depending on the circumstances, prosecutions based on images contained in TIFs may give rise to legitimate concerns that the accused involuntarily encountered child pornography on the Internet and that the TIF files merely documented that encounter without the accused knowingly “possessing” illegal material. The present case does not raise those same concerns.

¶ 53 Here, the evidence showed that defendant’s credit card information, usernames, and user accounts linked him to the Samsung phone. Defendant never argued that his wife or children were responsible for the presence of child pornography on the devices seized from the family home. Contrary to what defendant’s attorney suggested at oral argument, there is likewise no basis in the evidence to suspect that defendant might have been the victim of hacking or malware.

LaShure explained that the available cache evidence allowed him to conclude that someone viewed the original image that was depicted in State’s exhibit Nos. 2A and 2B on the Samsung phone at 12:02:45 a.m. UTC on March 6, 2018. LaShure also testified that the cache image was generated when somebody selected an image from the Gallery application and viewed it as a larger image to

- 21 - fill the whole phone screen. The phone was connected to a Samsung tablet via the cloud. LaShure deduced that someone had deleted the original version of the subject image sometime before the police seized those devices on April 26, 2018.

¶ 54 “Possession is generally defined as ‘[t]he fact of having or holding property in one’s power; the exercise of dominion over property,’ with courts frequently including ‘control’ over property within this definition.” Josephitis, 394 Ill. App. 3d at 299 (quoting Black’s Law Dictionary 1201 (8th ed. 2004)). Accordingly, “possession may be established by either proof of actual and knowing physical possession or constructive possession.” Josephitis, 394 Ill. App. 3d at 299. Here, the evidence supported a conclusion that defendant actually possessed the original version of the image that was depicted in State’s exhibit Nos. 2A and 2B on March 6, 2018, because he had that image in his Gallery application and clicked on it to enlarge it to a full-screen view. See Lancial, 2023 WL 105714, at *5 (in an unpublished decision involving cache images of child pornography that were associated with the Gallery application on a Samsung phone, the appellate court held that the evidence was sufficient for the jury to conclude that the defendant “affirmatively accessed the images of child pornography at least twice—once when saving the images to the gallery application, and once when clicking on the thumbnail image in the gallery application”).

¶ 55 Defendant emphasizes that the State failed to prove that (1) he knew his actions in the Gallery application created cache images or (2) he had access to those cache images. These arguments are red herrings, as the evidence showed that defendant possessed and engaged with the original image on March 6, 2018, via the Gallery application. For the same reasons, defendant’s criticisms about the prosecutor’s arguments in response to the defense’s motion for a directed verdict do not change our analysis of whether the State proved that defendant possessed child

- 22 - pornography.

¶ 56 The only remaining question is whether the State proved that defendant knowingly and voluntarily possessed the charged image. Again, “[p]ossession is voluntary if the defendant knowingly procures or receives a film, videotape, or visual reproduction or depiction for a sufficient time to be able to terminate his or her possession.” 720 ILCS 5/11-20.1(b)(5) (West 2018). The purpose of this requirement is “to protect against any concern regarding the inadvertent receipt of pornographic images.” Josephitis, 394 Ill. App. 3d at 301. The totality of the circumstances reasonably supports the conclusion that defendant knowingly and voluntarily possessed the charged image on March 6, 2018.

¶ 57 We reiterate that the evidence showed defendant accessed this image through the Gallery application on his phone. LaShure testified that the charged image was also viewed on the tablet. Thus, there was no realistic possibility that defendant encountered this image inadvertently while browsing the Internet and immediately closed his browser to disassociate himself from the image. Rather, the evidence showed that defendant engaged with this image by clicking on it and enlarging it to a full-screen view on the phone.

¶ 58 Moreover, the trial court admitted evidence of seven uncharged images constituting child pornography that were found on defendant’s tablet for the purposes of showing propensity, opportunity, intent, knowledge, and lack of mistake or accident. The fact that there were other unlawful images of children on defendant’s devices makes it much more likely that defendant voluntarily sought out and accessed the charged image when he enlarged it in the Gallery application of his phone.

¶ 59 The trial court was also entitled to consider that defendant had a history of using software to delete files, and perhaps even an entire drive, from his devices. We recognize that

- 23 - using erasing software or frequently deleting one’s files is legal in itself. However, such behavior takes on a special significance here because (1) defendant repeatedly used such software around the time that an investigator testified that he downloaded child pornography from a device connected to defendant and (2) there were hundreds of cache images constituting either child pornography or child erotica on defendant’s devices, yet investigators were unable to locate any of the original files. A reasonable inference to draw from the evidence is that defendant had a pattern of downloading child pornography and later deleting it from his devices to avoid detection.

Such behavior is not unheard of in child pornography prosecutions. See People v. Daigle, 2024 IL App (4th) 230015, ¶ 15 (stating the defendant admitted to the police that he repeatedly downloaded child pornography and then wiped his computer by restoring it to manufacturer’s settings).

¶ 60 The trial court was also entitled to consider that there were references on defendant’s devices to “Loli” and “Lolita.” We recognize that material relating to those terms might be lawful, depending on the context. However, where defendant had hundreds of cache images depicting child pornography or child erotica on his devices and repeatedly used software to erase files on his computer, the references to “Loli” and “Lolita” tend to support the court’s conclusion that defendant sought out illicit material.

¶ 61 The totality of the evidence reasonably supported the trial court’s conclusion that defendant committed the offense of child pornography. Thus, the State proved the offense beyond a reasonable doubt.

¶ 62 III. CONCLUSION ¶ 63 For the reasons stated, we affirm the trial court’s judgment.

¶ 64 Affirmed.

- 24 - People v. Bonnette, 2025 IL App (4th) 240827

Decision Under Review: Appeal from the Circuit Court of McLean County, No. 21-CF- 252; the Hon. William A. Yoder, Judge, presiding.

Attorneys Douglas H. Johnson, of Naperville, for appellant. for Appellant:

Attorneys Erika Reynolds, State’s Attorney, of Bloomington (Patrick for Delfino, David J. Robinson, and Timothy J. Londrigan, of Appellee: State’s Attorneys Appellate Prosecutor’s Office, of counsel), for the People.

- 25 -