In a real case scenario, investigators seized a laptop computer from a crime scene without a warrant. An allegation by the victim indicated the subject took pictures of an alleged sexual assault. Since investigators were in a lawful position to observe a picture of the subject and victim engaged in a sexual act on the computer’s screen, the seizure of the computer was justified. Subsequently, the investigator instructed the forensic examiner to recover picture files and/or movies from the computer’s hard drive. No search warrant was obtained. After creating a forensic image of the hard drive, the examiner analyzed (searched) the forensic image with the use of automated scripts and discovered hundreds of pornographic pictures and movies depicting underage children. He then exported all the incriminating data and the subject was charged with possession of child pornography. The question arises as to whether the search of the computer’s hard drive was legal and whether or not the child pornography would be admissible at the time of trial.

Is a Warrant Warranted?
Under the plain view exception to a warrant, evidence of a crime may be seized if an investigator is in a lawful position to observe the evidence and its incriminating character is immediately apparent. In the scenario, this standard was met. However, the examination of the computer’s hard drive without an additional warrant may become problematic. Initially, probably no additional warrant was needed since the examiner knew that there was at least one picture of the subject and victim engaged in a sexual act. He needed to discern if there were others. Manually searching and analyzing the forensic image for specific types of picture or movie files (.jpg, .jpeg, .tiff, .asf, .avi, .wmv, etc.) is virtually impossible. Thus the investigator ran automated scripts to search for these file types. This is an extremely efficient, time-saving feature of forensic software. (It does raise the interesting question as to whether the examiner or the forensic software is performing the analysis of the evidence). Unfortunately, the forensic software cannot separate out those files containing pictures of the subject and victim from all the other similar files with the same extensions. Thus, the examiner is faced with the daunting task of viewing literally hundreds or thousands of files, searching for those that contain the subject and victim. Of concern is whether or not the plain view doctrine would allow the examiner to view all the files without the benefit of a warrant since the files that must be viewed are not in “plain view.”1 Furthermore, the question also arises as to whether each file that is stored on a hard drive should be considered an individually closed and separate container. Not surprisingly, the courts have issued differing opinions and conclusions. For instance, in Carey2, a police detective with a warrant to search a hard drive for drug trafficking evidence opened a file and discovered child pornography. He then abandoned his search for drug-related evidence and spent several hours searching for and exporting hundreds of additional photographs of child pornography. At the time of trial, the defendant moved to have the child pornography excluded on the grounds that the detective exceeded the scope of his warrant. The court agreed and all the files except the first one that the detective discovered were disallowed. The interpretation appears to be that the first file that came into plain view during the execution of the search warrant could be seized, but that the plain view exception did not justify the continued search for child pornography. However, in Runyan3 and Slanina4, the Fifth Circuit suggested that the plain view of a single file on a computer’s hard drive could provide the basis for a more extensive search without an additional warrant.