Warrants, Scopes, and Tears on the Witness Stand
I watched a state police officer cry on a witness stand once. He was big, seasoned, and the kind of person you'd want backing you up in a dark parking lot. The defense attorney was small, calm, and methodical. She asked him, over roughly forty minutes of quiet, specific questions, to explain exactly which files he had examined during a forensic analysis of her client's computer, and exactly where in the search warrant the authority to examine those files was described. He couldn't. The warrant authorized him to look for evidence of one thing. He had looked at everything. When she finally got him to say out loud that he had exceeded the scope of his lawful authority—that he had, in effect, violated her client's Fourth Amendment rights—he broke down. This was a moot court training exercise. The "defense attorney" was a genuine defense attorney, and the examination of what he had done wrong was entirely real.
I've thought about that moment many times while teaching this material, because it captures something that rarely makes it into policy briefings or certification prep courses: scope violations in digital forensics are not exotic. They are not committed by rogue examiners with bad intentions. Scope violations happen to competent, well-meaning people who lost track of the line between thorough and unlawful, and they happen in part because digital evidence is unlike any other kind.
The Fourth Amendment's particularity requirement is one of its oldest features. A warrant must describe "the place to be searched, and the persons or things to be seized." That language dates to 1791, and its purpose is to prevent the general warrant—the British instrument of colonial-era harassment that let an official search wherever he liked for whatever he found. Founding-era courts were not subtle about why this mattered. The particularity requirement is the Constitution's structural answer to the fishing expedition.
Physical searches have natural constraints. A warrant to search a house for a stolen rifle does not authorize the officer to open medicine cabinets or read the letters on the kitchen table. The physical scope of the rifle keeps the search honest in a way that doesn't require the officer to exercise much discipline. The rifle is either in the closet or it isn't. He's done.
Digital evidence has no such structure. A forensic image of a hard drive authorized for one purpose makes the entire contents of a person's life available to the examiner's tools. Years of personal email. Financial records. Medical notes. Photographs. Conversations that took place in what the subject reasonably believed was private space. Chief Justice Roberts put his finger directly on this in Riley v. California (2014), when the Supreme Court unanimously held that officers need a warrant to search cell phones incident to arrest: "Modern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans 'the privacies of life.' The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought."
That passage should be laminated and taped to the top of every computer forensic workstation in the country.
What Roberts articulated is precisely the problem the moot court exercise was designed to surface. In traditional forensics, the physical nature of evidence disciplines the search. In digital forensics, the discipline has to come from within the examiner—from a careful reading of the warrant, a clear understanding of its scope, and the professional integrity to stop when the warrant stops. There is no physical wall to run into. There is only the examiner's judgment and the question of whether that judgment holds up under scrutiny.
The affidavit is the instrument that sets the outer boundary. The agent or officer writes what they know, how they know it, and what they expect to find. The judge reviews it, signs the warrant, and defines the lawful scope of the search. Every examination that follows exists inside that box—not outside it, and not somewhere in the vicinity of it. An examiner who treats scope as a rough approximation rather than a precise legal boundary is not being thorough. They are being unlawful, and they are exposing the entire case to suppression.
The suppression risk is real and the case law is clear. Courts have excluded consequential evidence because an examiner ran a hash set the warrant didn't authorize, or followed a thread the warrant didn't permit. Cases that were otherwise well-built have collapsed because someone decided that finding something important justified going somewhere the warrant didn't allow. "I found something useful" has never been a successful legal argument, and the body of precedent on this point grows with every year that more of human life migrates into digital storage.
The practical instruction I give every student is simple: when doing law enforcement cases, demand a copy of the search warrant before you touch the evidence. Not after. Before. If your supervisor won't give it to you, ask to speak with your government attorney. This is not a bureaucratic nicety. It is the document that defines your lawful authority, and working without it is not just procedurally risky—it is a choice to operate blind on the most important constraint in the examination. If you don't know the scope, you cannot stay within it.
On the witness stand, scope compliance is usually the first place a skilled defense attorney goes looking. The examiner who can walk through their analysis methodically—here is what the warrant authorized, here is what I examined, and here is why each piece falls within that authorization—is largely unassailable. Being able to articulate where you searched and why is key. The examiner who can't do that is vulnerable in ways that rarely manifest as a clean admission, but more often as a slow accumulation of "I don't recall" and "I may have also looked at" that the attorney in that moot court session had turned into a full confession by the end of forty minutes.
The officer who cried that day knew, on some level, what had happened before the attorney asked the first question. The examination had felt justified at the time. He had found something he thought mattered. He had followed it. That sequence—feeling justified, finding something, and following it—is exactly the sequence the Fourth Amendment was designed to interrupt, and it is exactly the sequence that digital forensics makes easiest to slip into.
The warrant says what it says. So does the Constitution.
This post is the fifth in a series based on my course, DFOR 671: Topics of Ethics and Law in Computer Forensics, that I have taught at George Mason University for the past fifteen years. Over the next several articles, I'll be looking at the ethical, legal, and practical issues that sit underneath the work: bias, candor, privacy, professional responsibility, reporting, courtroom credibility, incident response pressure, and the messy human realities that never seem to fit neatly into a checklist.
First published on LinkedIn.