Audio Revealed from When Josh Duggar Learned He Was Being Investigated for Child Pornography

Before searching Josh Duggar's car lot for signs of child pornography two years ago, the Homeland Security agents on his case — who were either bringing him to justice or railroading him, depending on the lawyer arguing — took their time. They wanted to be sure.

That November afternoon in 2019, Homeland Security Investigations (HSI) Special Agents Howard Aycock and Gerald Faulkner tracked Duggar's Wholesale Motors from afar, surveilling his business from the shoulder of the nearby highway.

Through binoculars, they watched Duggar, 33, arrive in an RV and also saw him with two men, later identified as an employee and a customer. This added to previous surveillance, when HSI sent in an undercover agent the week prior and observed Duggar with a phone and laptop. Before moving in, the team gathered for a "pre-op" meeting, to assign duties and brief everyone.

For more on Josh Duggar's child pornography trial and other top stories, listen below to our daily podcast on PEOPLE Every Day.

Then the group of approximately seven — agents and computer forensic analysts — "rallied" about a half mile from the business and began their work.

Faulker and Aycock knew who they were looking for already, and they had questions: Six months earlier, a device with an IP address registered under Duggar's name at his car lot had been caught sharing child sexual abuse material with a police detective in Little Rock, Arkansas, who had been sweeping the internet for just such material using a specialized program, Torrential Downpour.

RELATED: Josh Duggar's Past Molestation Case Allowed to Be Used in Child Porn Trial, Judge Rules

What happened and why after the Little Rock detective, Amber Kalmer, first found the illicit material under Duggar's IP address is the subject of ongoing debate at Duggar's federal trial for knowing receipt and possession of child pornography.

The proceedings, in Fayetteville, Arkansas, are in their second day after a jury was picked Tuesday. Duggar has denied the allegations.

After initial arguments to the jury from both sides early Wednesday, Kalmer and then Faulkner took the stand where the prosecution talked them through highlights of their investigation while the defense then pressed them in cross-examination on what Duggar's attorney, Justin Gelfand, suggested was sloppy, too-slow police work that let the real perpetrator — whomever else had access to the desktop computer at Duggar's car lot — slip away.

Much of what the investigators testified to repeated and expanded on testimony at Duggar's detention hearing this summer, when he was freed under certain restrictions.

For the first time, however, authorities put some of the words in Duggar's mouth: During Faulkner's testimony about obtaining and executing the search warrant at Duggar's business on Nov. 8, 2019, (which describes the opening scene above), prosecutors played excerpts from a 51-minute interview Duggar gave the HSI agents while they were sweeping the property.

Danny Johnston/AP/Shutterstock Josh Duggar

According to Faulkner's testimony — though he remains on the stand as his cross-examination by the defense continues Thursday — Duggar agreed to waive his Miranda rights (to remain silent, to have an attorney) and spoke with the agents during the execution of the warrant.

The audio played Wednesday showed Duggar to be agreeable and responsive, to a point. But he was also vigilant — careful, in his words, not to say too much to the police. "I've watched my friends answer things and they get 'em," he said in the recording. "Statutes are broad," he added.

Faulker said on the stand that Duggar was "calm," with "no visible reaction" after agents arrived with their warrant.

But Duggar said some things that surprised them: Faulkner testified that Duggar spontaneously brought up the nature of the investigation, without any prior warning, after getting into the agents' truck for his interview.

"Mr. Duggar turned in his chair, facing me and Mr. Aycock, and asked, 'Is this about someone downloading child pornography?'" Faulkner recalled.

The defense was incredulous, given that it was the only comment not captured on audio. Faulkner said Duggar spoke right before Aycock turned his recorder on. "That's the second before?" Gelfand asked.

Elsewhere, according to the audio the court heard, Duggar spoke freely about his personal electronic devices on the property (a phone, a Mac laptop and the HP desktop in the car lot's office). He told the agents he used his devices about equally for work and personal needs and that his children and wife and others had ready access to his phone and laptop while "the guys at work here are the ones" that use the desktop.

RELATED: Josh Duggar Trial: Evidence, Witnesses and Looming Arguments Become Clearer as Jury Is Seated

Answering questions, Duggar — whom prosecutors say used sophisticated techniques to mask his criminality, while his attorneys say it was well beyond his expertise — detailed how the Wi-Fi worked at the car lot: how he had "daisy-chained" the routers, including one recently re-configured, to expand network coverage.

He also said he was familiar with peer-to-peer networks and that all three of his devices had the software, which prosecutors say is telling because such a tool was used to access child pornography on the desktop in his office.

This, though, was strange, the HSI agent testified: While discussing torrenting (a kind of peer-to-peer network), Duggar mentioned the Tor browser, which is used for various reasons — including illegal ones — because it greatly masks Internet activity. Prosecutors noted it was infamous for its connection to the so-called "Dark Web," but Duggar told the agents he was using it for his business, to upload photos.

"I would not think the 'Dark Web' would be the best place to do that," Faulker said on the stand.

In audio from his interview in 2019, Duggar sounded confused after mentioning Tor. So did the agents. They wondered, Did he mean torrent? Duggar said a friend recommended that he download Tor.

"I guess I better not say if I don't understand … I don't see any difference," he said in the audio.

At this point in the interview, the agents explained why they had really arrived: to investigate child exploitation.

"So is that what you're saying is going on?" Duggar said. "What is the scope?" he said, adding, "Is something going on on my devices?"

"In the scope of your investigation, I guess you'll narrow it down … [and] know if it's any of the devices here," he said.

Josh Duggar

The agents asked Duggar: Had there been any red flags before today? Any reason to worry something accidentally might have happened? "Not at all," he said.

And once the agents were specific about their suspicions as to Duggar's property, explaining how a device on his IP address was sharing sexual abuse material, he started to ask questions until the agents advised that "at this point it's probably best if you just listen."

In later questioning, according to the audio, Duggar said he was wary of incriminating himself in any way: "I'm not saying that I'm guilty or not."

Under cross-examination, Faulker, like Detective Kalmer who testified earlier Wednesday, faced questions about why he didn't pursue the case more quickly and investigate more broadly, including at the home where they initially served Duggar's search warrant.

Faulkner said there was a record-keeping error on the part of the internet service provider that initially led them to the wrong address with their warrant. But Gelfand, Duggar's attorney, contended that they had already narrowed in on Duggar because of his high profile.

As to the timeline, Faulkner said that while Kalmer initially relayed her tip to him in June 2019 — a month after first connecting with the suspicious device on Duggar's internet — he was busy with a higher-priority case throughout that summer.

Separately, Gelfand led Faulkner through some photos from the search, showing Duggar's car lot including the main office — a metal, tollbooth-sized building that fit a desk and two chairs. Gelfand called it a "fishbowl" surrounded by windows (though two of them had shades pulled) and noted that the desktop computer in question had a program and labels on it indicating it was a shared computer for business purposes.

Gelfand probed Faulkner on whether and why not the devices of other men connected to the car lot were not seized and forensically examined given that IP addresses do not identity the device or person at the time the content was accessed.

Faulker said in one instance, with Duggar's employee, an analyst did a manual examination at the scene. Faulkner didn't elaborate. The customer that day left rather than speak with agents.

RELATED: Jill and Jedidiah Duggar Included on Potential Witness List in Josh Duggar's Child Porn Trial

As the prosecution laid out earlier Wednesday, law enforcement believes there is convincing evidence tying Duggar himself to the desktop at the dates and times that the child pornography was downloaded — not just known passwords but a pattern of text messages and photos from his phone on two key dates that place him at the car lot and sometimes right next to the desktop around the time the illegal material was accessed.

While Gelfand, in his argument, called it a "mystery" not yet solved, with forensic evidence giving "more questions than answers" and authorities having buried "their head in the sand," Assistant U.S. Attorney Dustin Roberts urged the jury of Duggar: "Hold him accountable."

"Throughout the trial, you're going to see images of minors, not actors, not actresses — children, some as young as seven years of age," Roberts said. "These children are being abused."

The trial is expected to last five to six days.