If you equate that to a non-expert computer user sitting at the keyboard opening folders and looking at files while using no special skills or tools, you have basically the same operation. Any file the user can open and view without adding a tool, using special expert knowledge or forensic tools, should be able to regard evidence they see as part of the search as being in plain view. This is the essence of a computer search.

Another example of equating a search in the physical world to a computer search would be the recycle bin on the computer. It is the same as an officer looking through the trash can at a scene. If there is trash in the bin, he can search it and see things in plain view. However, if the trash was picked up, (the recycle bin was emptied in computer parlance), then nothing that was previously in the trash could come into plain view. To find items that have been put in the computer trash bin and subsequently emptied requires a special forensic examination or recovery tool. That would the same as having an officer on scene go to the county dump and recover the trash from the suspect’s home.

What I am advocating is that for the plain view doctrine to work in digital evidence cases there must be the possibility of the evidence to come into plain view without the use of special computer skills, tools, or software.

There are hundreds to thousands of files on a computer hard drive. Many of them are not available to the user of the computer. Files that are deleted, files that are resident in unallocated space, files in the internet cache, all places that the computer operating system itself provides no method of getting to by the user.

In order for any of these items to come into plain view, it would require a further intrusion beyond what is possible using the computer itself or non-special skills.

The underlying problem is that law enforcement uses boilerplate affidavit language for search warrants for computers and digital evidence that outlines all the ways that digital evidence can be hidden or protected by a person suspected of a crime. That language indicates clearly that such a search cannot satisfy the plain view doctrine since it insists that there is a need to expose evidence that would not be available without special forensic tool and skills. This is a forensic examination of digital evidence; it is not a computer search.

The table below illustrates the difference between a computer search and a forensic examination of digital evidence. While this is not an exhaustive listing, it provides a foundation for understanding the difference in the two types of searches for digital evidence.