United States v. Mann

Forensic Analysis Uncovers Child Pornography

592 F. 3d 779 (7th Cir 2010)

On an appeal from the Northern District of Indiana, the Seventh Circuit held that a police detective did not exceed the scope of a warrant issued to search for computer images of voyeurism when his use of computer forensics tools uncovered images of child pornography.

In May of 2007, the Lafayette Police Department of Tippecanoe County, Indiana, recovered a video camera installed by the defendant in the women’s locker room at his place of employment. The officers obtained a search warrant to search the defendant’s residence for “video tapes, CD’s or other digital media, computers, and the contents of said computers, tapes, or other electronic media, to search for images of women in locker rooms or other private areas.” Upon executing the warrant, the police department seized a desktop computer, a laptop, and an external hard drive from the defendant’s home.

Nearly two months later, a police detective began a forensic analysis of the seized equipment, utilizing Forensic Tool Kit to create a mirror image of each hard drive. Among the tools the detective used was the KFF Alert System, which indicated that four files on one hard drive contained known child pornography. The detective’s forensic analysis recovered several videos recorded inside women’s locker rooms and many images of child pornography.

When the state’s prosecutor entered one count of possession of child pornography, the defendant moved to suppress the evidence, arguing that the detective had exceeded the scope of the search warrant. The District Court denied the defendant’s motion to suppress, reasoning that the detective believed he had authority to examine any digital file on the defendant’s computers and had, therefore, discovered the images of child pornography in “plain view.”

The Seventh Circuit agreed, holding that the search was lawful except as to the four files flagged by the KFF Alert System. The Court reasoned that the images of voyeurism could have been anywhere on the computer and the files could have been manipulated to hide their contents. The detective had not abandoned his search under the warrant but had instead continued to look for images of women in locker rooms or other private areas.

The Court held that those files found by the KFF Alert System, however, should be suppressed because the Alert System specifically told the detective the files contained child pornography and could not be validly examined for voyeurism. The Court suggested that the detective should have stopped his search and sought a warrant to search for additional images of child pornography. Nonetheless, all of the other images were properly discovered during the search for images of voyeurism, leaving plenty of evidence for the state to charge the defendant with possession of child pornography.