In a recent child pornography case, two software programs of interest were installed on a suspect’s laptop computer: LimeWire 5.2.13 and iTunes 9.0.1.8. The user did not modify any default settings in LimeWire and therefore downloaded files from the peer network were shared with the world. However, the prosecution took the distribution charge off the table and focused primarily on possession of child pornography. The user downloaded numerous videos from the peer-to-peer (P2P) network using LimeWire with filenames indicative of child pornography. The video files were found in the default LimeWire folders (Incomplete and Saved), which were located under the user’s profile. The Saved folder contained the fully downloaded files found in the Public Shared List of LimeWire. But the main focus from the prosecution’s standpoint was mainly the iTunes program and how it shares files on a local network. Although the distribution charge was no longer a consideration, discovery in the capability of iTunes and the interaction with P2P programs might indicate the user’s possible intent, or at least their knowledge, of sharing video files from the iTunes Library on a local network.

Based on testing and the discovery of the iTunes functionality…

• Upon initial startup and with default settings (users can disable), iTunes will scan a computer system to search for audio files only (early iTunes versions) or audio and video files (later versions) and add the multimedia files to the iTunes Library.
• With the exception of the above fact, iTunes does not dynamically add files to the Library; it takes user interaction to add compatible multimedia files individually or adding groups of files from a parent folder to the Library.
• Any text entered in the Library Name under the iTunes preferences is displayed to other iTunes users on a local network.
• Sharing is not enabled by default, and therefore takes user action to enable sharing of either the entire Library or specific playlists in the Library.
• It cannot be determined when the Shared Library feature was enabled on a user’s system.
• Shared Library only allows other iTunes users on the network to access (stream) shared files for listening or viewing of music or videos, respectively; the files cannot be saved to their system.

From: iTunes Forensic Analysis by Paul B. Ciaccio