E.D.Pa.: Use of forensic software to search a computer in a child pornography case is not a general rummaging

The use of forensic software to search a computer in a child pornography case does not exceed the scope of search defined in the warrant, and it does not constitute a general rummaging. United States v. Perez, 2015 U.S. Dist. LEXIS 71500 (E.D.Pa. June 2, 2015):

i. The Government’s Use of Forensic Analysis Software

Perez first argues that the Government’s use of the FTK software exceeded the scope of the warrant in violation of the Fourth Amendment. The Court rejects this argument. Given the limited nature of the forensic software’s examination, which consisted of cataloging and segregating files by file type into a viewable format, and the fact that Perez could have graphic and video files containing child pornography “virtually anywhere on his computer,” the Court concludes that the Government did not exceed the scope of the warrant by using the FTK software. United States v. Mann, 592 F.3d 779, 784-85 (7th Cir. 2010) (no reason to believe that detective’s use of FTK software to index and catalogue files, without more, exceeded scope of warrant where search warrant authorized search and seizure of evidence of voyeurism, and images of women in locker rooms could be “virtually anywhere on his computers”); see also United States v. Schlingloff, 901 F. Supp. 2d 1101, 1103 (C.D. Ill. 2012) (rejecting argument that FTK software exceeded scope of warrant per se); United States v. Giberson, 527 F.3d 882, 889-90 (9th Cir. 2008) (upholding as reasonable a search in which Government used “ILOOK” forensic software, which, like FTK, catalogs and segregates files based on file type into viewable format, where warrant authorized search for images associated with production of false identification cards).

Although the FTK software scanned Perez’s computer hard drive and thumbdrives in their entirety to identify and segregate the requested files, the Court finds that this examination was permissible “to ensure that file names ha[d] not been manipulated to conceal their contents.” Stabile, 633 F.3d at 241; see Mann, 592 F.3d at 782 (noting difficulties in locating image files); United States v. Hill, 459 F.3d 966, 978 (9th Cir. 2006) (“[I]mages can be hidden in all manner of files, even word processing documents and spreadsheets. Criminals will do all they can to conceal contraband, including the simple expedient of changing the names and extensions of files to disguise their content from the casual observer.”). Thus, the Government’s use of the FTK software to extract particular files for further review did not violate the Fourth Amendment.