Case Study 1 — The Second Warrant

An examiner searching a laptop under a narrow fraud warrant encountered, in the file listing, an item whose characteristics indicated a far more serious and entirely different crime. The case was not won by what she found — it was won by what she did in the next sixty seconds: she stopped, touched nothing further, documented exactly how the item came into view, and refused to keep looking until a new warrant said she could. The discipline that protected the prosecution is the same discipline that protects the accused.

Background

This is the book's fourth anchor case — the forensic image analyzed in court — seen in its legal dimension, and handled here strictly as procedure, law, and ethics. No content is described, and none needs to be.

A county financial-crimes unit was investigating a contractor for wire fraud. A magistrate issued a warrant for a seized laptop, case 2026-0142, Item 01. The Attachment B was tightly drawn: it authorized a search, for the period 01 JAN 2025 – 14 JUN 2026, for financial spreadsheets, invoices, banking communications, and records of money movement connected to a specific scheme, plus evidence of user attribution. It even carried a search protocol directing keyword, file-type, and date-range filtering and routing any privileged material to a filter team. The examiner — a state-lab analyst who had testified more than fifty times — read Attachment B before she imaged, and read it again before she opened a single file. To her, the warrant was not paperwork. It was the fence around everything she was allowed to do.

She acquired the image through a hardware write-blocker, verified source-equals-image with SHA-256, and began exactly the search the protocol described: financial file types, the scheme's keywords, the authorized date window. Her workflow logged every file she opened and every file she declined to open as out of scope — the in_scope == false lines that, months later, would prove she had not gone fishing.

The discovery, and the next sixty seconds

While reviewing the filtered results, the examiner's tooling surfaced a file whose name, location, and thumbnail characteristics indicated apparent child sexual abuse material (CSAM) — a crime wholly outside the fraud warrant. What she did next is the entire case study.

She did not open it to "confirm." She did not open the other files near it. She did not copy it to her working notes. She stopped the search, left the item in place, and immediately began documenting — not the content, which she never examined, but the provenance: which filter surfaced it, what term or file-type matched, what she was doing at the moment it appeared, and the exact time.

   SCOPE EVENT LOG — case 2026-0142, Item 01
   ──────────────────────────────────────────────────────────────────
   14:22:07Z  Search running per Attachment B protocol
              (file-type:xlsx,doc,pdf + kw:{scheme terms} + date 2025-01..2026-06)
   14:31:55Z  Item flagged by file-type/thumbnail filter at path
              \Users\****\AppData\...\[redacted]  — characteristics indicate
              apparent CSAM. OUTSIDE WARRANT SCOPE (warrant = financial fraud).
   14:31:58Z  SEARCH HALTED. File NOT opened. No further files reviewed.
              No copy made. State preserved as-is.
   14:34:00Z  Escalated to supervisor and case ADA. Second-warrant requested.
   ──────────────────────────────────────────────────────────────────

Then she escalated — to her supervisor and to the case prosecutor — and stated plainly that she had a possible out-of-scope discovery of a different and serious crime, that she had stopped, and that she would not proceed without expanded authority. The prosecutor agreed instantly. Two legal tracks opened at once. First, the prosecutor sought a second warrant authorizing a search for the new offense, supported by an affidavit describing precisely how the item had come into plain view during a lawful, in-scope fraud search. Second — independent of any warrant question — the lab's standing policy and the analyst's mandatory-handling duties governed: apparent CSAM triggers obligations under federal law (the reporting regime of 18 U.S.C. § 2258A for covered providers, and the possession/distribution prohibitions of §§ 2252 / 2252A that forbid making any copies beyond what is lawfully necessary). She minimized her own exposure, preserved the evidence exactly, and waited.

When the second warrant issued, a separate examination — now lawfully authorized for the new offense — proceeded under its own scope. The fraud examination resumed only within the original Attachment B.

The motion to suppress

The defense moved to suppress everything, arguing that the analyst had exceeded the fraud warrant and conducted a general, exploratory rummage through a private laptop. This is exactly the attack the second-warrant discipline is built to defeat, and it failed on the record the examiner had created.

DEFENSE:  "You went looking through my client's personal files until you
           found something to charge him with."
EXAMINER: "No. My search was driven by the warrant's file-type, keyword, and
           date-range protocol. My access log records every file I opened and
           every file I declined as out of scope."

DEFENSE:  "But you found the out-of-scope item, and you seized it anyway."
EXAMINER: "I did not seize or open it on my own authority. The log shows I
           halted the search at 14:31:58, did not open the file, made no copy,
           and escalated. The new material was searched only under a second
           warrant obtained for that purpose."

DEFENSE:  "Why didn't you just rely on plain view?"
EXAMINER: "Opening a file is itself a search, and digital plain view is
           unsettled. The disciplined practice — and our policy — is to stop
           and obtain expanded authorization, which is what we did."

The court denied the motion. The fraud evidence stood because it came entirely from within Attachment B; the new-offense evidence stood because it was obtained under a second warrant whose affidavit honestly described an in-scope discovery. The exclusionary rule — and the fruit of the poisonous tree doctrine that would have spread the taint to everything downstream — never got a foothold, because there was no unlawful search to poison anything. The same disciplined chain that let the prosecution proceed is the chain that would have protected the defendant had the file turned out to be innocent: a record proving the examiner looked only where she was authorized to look.

The analysis

  1. The warrant is the fence, and the fence is read twice. The examiner's first act on Item 01 was to read Attachment B — before imaging and again before analysis — and to drive her search from its file-type, keyword, and date parameters. Scope discipline is not restraint she summoned in the moment; it was built into the workflow before the first file opened, which is why it held under pressure.

  2. The second-warrant discipline beats the plain-view gamble. Opening a file is a search, and digital plain view is genuinely unsettled (the BALCO en-banc case looms over it). Betting a case on plain view risks suppressing the very evidence you found. Stopping, documenting provenance, and getting a fresh warrant produced evidence that survived — the safe path was also the winning one.

  3. Document the provenance, never the content. She recorded how the item surfaced — the filter, the term, the timestamp, the fact that she did not open it — and nothing about what it depicted. That record answered the suppression motion completely, while the discipline of not opening or copying it honored both the law (§§ 2252/2252A) and the duty to minimize her own exposure.

  4. Apparent CSAM is the one absolute "stop," in any matter. This arrived inside an ordinary fraud case, not a case anyone expected to involve it. The response was non-negotiable and policy-driven: stop, preserve, minimize exposure, escalate, report through the proper channel. There is no "keep looking to be sure." The deeper ethics — the victim, the accused, mandatory reporting, and the secondary trauma to the examiner — are owned by Chapter 28; the legal point here is narrow: doing it right protected the case and the rights of everyone involved.

  5. The method that convicts the guilty is the method that clears the innocent. A scope log that proves the examiner looked only where authorized is exculpatory armor as readily as it is inculpatory proof. Had the flagged item been an innocent file, the same record would have shown she never rummaged through it. Authority and scope discipline serve the truth, not a side.

Discussion questions

  1. The examiner halted the search at 14:31:58 and did not open the flagged file. Explain why "opening a file is itself a search" makes that restraint legally essential, and how the outcome might have differed if she had opened three more files "to confirm" before escalating.

  2. The defense asked, "Why didn't you just rely on plain view?" Draft the two-sentence answer an examiner should give, naming why digital plain view is a gamble and why the second-warrant route is both safer and more likely to keep the evidence admissible.

  3. The chapter stresses that apparent CSAM triggers duties even on a routine matter. Without describing any content, list the four actions the examiner took the moment the item was flagged, and explain why making no additional copy is both an ethical and a statutory requirement (§§ 2252/2252A).

  4. ⭐ Suppose the magistrate had denied the second warrant for lack of probable cause on the new offense. Walk through what the examiner may and may not do next with the original image, why the fraud evidence within Attachment B is unaffected, and how the independent source and inevitable discovery doctrines might (or might not) come into play if the new-offense evidence ever resurfaced lawfully.

  5. The examiner's access log recorded every file she declined to open as out of scope. Explain how those "negative" entries defeated the defense's "exploratory rummage" theory, and connect this to the chapter's tool demonstration — why making scope provable in a log is stronger than merely asserting you stayed in bounds.