For some time now, various authors have suggested eliminating plain view from searches of computer hard drives and other digital evidence.

The issue with plain view in computer searches is a misunderstanding of what a computer search is versus a forensic examination of a computer hard drive. In his article, “Why the Plain View Doctrine Should Not Apply to Digital Evidence” in the Suffolk Journal of Trial and Appellate Advocacy, RayMing Chang writes:

“Searches pursuant to warrants for digital property are easily transformed into general searches of a suspect's digital property because police, by necessity, must perform a comprehensive search of a suspect's digital property in order to properly execute a digital property warrant. Courts have already begun to apply the plain view doctrine in a manner that allows police to use anything found during a search of digital property (e.g., computers) as evidence of crimes beyond the scope of the warrant. General searches are proscribed by the Fourth Amendment. Therefore, courts should stop applying the plain view doctrine to digital evidence.” ¹

More recently, the 9^th Circuit Court of Appeals of the Western District advocated eliminating the plain view doctrine from digital evidence altogether, citing the apparent impossibility of applying the rules in precedent cases to this new form of evidence. (United States v. Tamura, 694 F.2d 591 (9th Cir. 1982)²

The problem with the current approach to the plain view doctrine as it has been addressed by the courts and various legal authors like Orin Kerr in his 2006 article in the Harvard Law Review, “Searches and Seizures in a Digital World” is that they are making excellent legal arguments but are confusing a search of a computer with a forensic examination of a computer hard drive.

Kerr writes about the need to map the physical world to the virtual world of digital storage, because the laws are constructed based upon what happens in the physical world of a law enforcement officer examining a scene.³

While this is the correct approach, he falls into the trap of mistaking a forensic examination of a computer hard drive with a search of a computer. This is the fundamental disconnect between understanding how plain view doctrine should be applied in digital evidence cases; what constitutes a search versus what is a forensic examination.

In this article I will attempt to define the difference between the two, with the proposal that a computer search should be defined much in the same way as the physical search of a room, where the plain view doctrine can be applied.

Alternatively, I will define what a forensic examination of a computer hard drive is and why the plain view doctrine cannot be applied to the results of a forensic examination.