Operation Snapshot: Timeline of a child porn investigation

A major child pornography bust that led to the rescue of New Brunswick girl all started with a tip from a Toronto police officer who was perusing a file-sharing website and found a vast collection of child exploitation material from a single IP address.

It was just one of several shocking cases uncovered in a national RCMP sweep called Operation Snapshot.

Here is a timeline of the investigation that followed, to which a small team from CBC News was granted exclusive, behind-the-scenes access.

• Child porn arrests: Investigators must track moving targets
• Child porn bust: 5 children saved, RCMP lay 343 charges
• FAQ: Child porn arrests in investigators' own words

Day 1: Tip from Toronto

Toronto police Det. Const. Chris Purchas is a veteran online child exploitation investigator on secondment with the RCMPs National Internet Child Exploitation Centre in Ottawa.

On April 5, he noticed an IP address with a large collection of disturbing child pornography images.

Purchas discovered the account holder was in the area of Moncton, N.B. He passed the tip on to the RCMPs internet child exploitation unit in New Brunswick, led by Cpl. Jean-Marc Par.

The internet has no boundaries and the police world has understood that, said Par, whose unit handles between 80 and 100 cases a year.

Day 18:IPaddress is 'just the start'

The case was then assigned to RCMP Const. Tonia Williams, an investigator in Moncton.

I have not seen these particular images before, said Williams. However, there are new images and videos unfortunately appearing on the internet every day, every minute, as we speak. Because everywhere in the world, there is a child who is being sexually abused, and these images and videos are actual recordings of crime scenes.

Williams prepared a Law Enforcement Request a two-page, warrantless request to get the account holder's name and address from their internet service provider.

• Cyberbullying bill needed to fight child porn, police say

Day 23: 'Old-fashioned police work'

Once Williams learns the physical street address, she does a background check on who lives at the home, checks to see whether the man is known to police and tries to determine whether the suspect is in regular contact with children.

The next step is surveillance.

We do basically old-fashioned police work and try to observe and identify those persons who may be frequenting the location, Williams explained.

Day 28: 'He departs the residence with a young child'

In this case, Williams kept a close eye on the street address. The suspect was in his 30s, a local who worked full time and appeared to live alone.

Her assessment changed during the second week of surveillance.

What I've been seeing recently is early in the morning, he departs the residence with a young child approximately eight, nine, 10 years old, said Williams. She's been there all this week, so my guess is it's dual custody ... But I don't want to leave it too much longer.

She immediately prepared an application for a search warrant.

Day 33:Prepping for a search

Once Williams had a search warrant, she and Par put together a team of RCMP officers to help execute it. The team was comprised of other internet child exploitation investigators, two local RCMP members and officers from the tech crimes unit.

The teams goal was to find child exploitation material in the home.

In order for the arrest to take place, we just have to be able to substantiate one piece of the warrant, said RCMP Cpl. Aaron Gallagher of the tech crime unit based in Fredericton.

Another key consideration in planning the search: the child Williams observed during her surveillance.

Our goal is to conduct the search without the child being there, so we don't subject any child to her home being searched by police officers, said Williams.

Day 34: 'We're here to execute a search warrant'

At 6:45 a.m., members of the RCMP team have gathered and are getting ready to execute the search warrant.

There is the conventional police gear, such as bullet-proof vests and sidearms, but the team is also equipped with a mobile tech lab, filled with the equipment needed for online forensic investigation.

Par is stationed near the suspects house, acting as lookout to make sure the child leaves for school and the suspect remains at home. Everyone else waits at a nearby parking lot.

Once the child left, the officers move in.

At 7:35 a.m.: We're the RCMP. We're here to execute a search warrant.

The officers converge on the residence and begin their search, which lasts most of the day.

Later, officers told CBC News that among the first things they noticed were cameras mounted outside the door.

Once inside, they saw computers everywhere.

Cameras were found throughout the house, including under tables, in the shower, even wired up through the heating and ventilation units in the house and mounted inside wall plugs in bedrooms. The computers were collecting their video feeds.

On one of the many computers, investigators were able to find an image listed on the search warrant.

Less than an hour after the officers arrived, a man in his 30s is taken into custody and charged with possession and making available child pornography.

Day 35: Examining evidence

Now begins the laborious process of sorting through evidence gathered at the home.

The process of cataloguing evidence would take several days.

The tech crime team copied all of the hard drives to preserve the integrity of the originals, a process that can take hours or even days depending on the size and condition of the hard drive.

They will then work with the copies, extracting all videos and images.

A lot of people think that just viewing child exploitation material and downloading it and sharing it is a victimless offence, says Gallagher. But somebody had to be in that video. So that's our goal, to eventually wiggle our way through and find out where that video was recorded or created and hopefully save someone on the other end.

New charges

The officers made a chilling discovery in the case.

When you go into a residence and then you see all these cameras, your senses start to wonder. OK there's a child in this residence, what else is going on? said Gallagher.

As a result, new charges were laid against the suspect sexually touching someone under the age of 14, invitation to sexual touching and making child pornography.

Were in the business of rescuing children, says Par.

We work hard, we put in long hours here, we don't always see very positive things online. To rescue a child like that is a big morale booster for our unit and the people here. It's what keeps us going.

Par called this case one of the more satisfying ones we've done. He says it shows the importance of collaboration between police departments. The sharing of information online is so important, he said. And it leads to the results we're seeing here today, where basically a person is being rescued.

That is the ultimate goal of a tough job , says Purchas, who had originally passed the tip on to the team in New Brunswick.

Every officer that works in child exploitation it's a very dirty job, it's a mentally stressful job, it's a hard job and we do it for one reason. We do it because we share a passion for rescuing children. And that is why we go to work every day. It's about the kids."