Understanding the Criminal Justice Process

Among the basic concepts to understand this week are that there are many types of evidence one could find in digital data. Understanding what data you may find, even if it is not evidence of a crime, is important to preparing a digital examination/analysis plan. Let’s look at anon-technical example…
When a law enforcement officer applies for a warrant to search a residence, the officer must specify for what it is he or she is searching; if the case involves a stolen car, then the officer’s search will be limited to only those locations a stolen car, or pieces of a stolen car (in case it was chopped), could be located. It would be unwise to just list the stolen car on the warrant, as (in the interpretation of the court) might only limit the officer to the whole car, intact. So, the officer has to determine at the outset of their search what could have happened to the car (attempting to account for all the possibilities) so his or her search is complete (and most likely to yield results). The officer will also have to justify (in the affidavit) why he or she believes that the car could be found in smaller pieces. To that end, an officer with auto theft experience may also be able to state that, in his or her experience, stolen cars are often broken down into smaller components, which can be identified with certainty as belonging to the original stolen car, as well as where such components could be hidden. It would most likely not be enough for the officer to simply assert that cars are broken down and sold for parts, if he or she wants to justify seizing an ashtray; the ashtray would need some specific characteristics to do that.
Search warrants and searches are, therefore, most often limited in scope to items for which the searcher is looking (i.e., nearly always evidence of a crime or wrongdoing). You cannot look for an elephant in a kitchen drawer! I know that sounds absurd, but it is an excellent metaphor… However, if you were looking for narcotics, they could be hidden almost anywhere, and you could justify a much broader search. In this example, digital evidence is much more akin to narcotics than you may think, with evidential data often occurring in hidden, strange, or unlikely places. As such, warrants to search for digital evidence often cast a “wide net,” but cannot be so overly broad as to not be supported by probable cause or violate someone’s 4th amendment protections and implied rights to privacy.
Do not despair, however, if you are not a law enforcement officer… The requirement to obtain a search warrant does not apply to searches by private individuals or non-government organizations, as long as the individual(s) have the authority to conduct the search (e.g., IT security personnel are searching a computer owned by their company for company data, or an employee gives the company consent to search for their personal data). However, even those searches may be limited to certain parts of the computer system(s) or network(s). As noted in the text, if a person is allowed to use a personally-owned flash drive at work, and that drive is connected to the computer, you still may not be able to search it without the employee's consent. All of these examples depend heavily on established company policies and what warnings were given to the employee.