In US v Schlingloff, the 6th District reversed the trial court's denial of a motion to suppress. The digital
forensic examiner was executing a search warrant to look for evidence of
passport fraud. He used a feature of the digital forensics software FTK (which
is the same sort of software tool as EnCase) to look for a broad range of files
indicative of criminal activity, including child exploitation images. The
search yielded files containing suspected child pornography and the defendant
sought to suppress that evidence, arguing that the search exceeded the scope of
the warrant. The trial court denied the motion to suppress, but the Circuit
Court reversed, citing the agent’s purposeful choice to search for the child
exploitation material despite it not being specifically enumerated in the
warrant. The feature the agent used required that he select search criteria
that included seeking files likely to contain child pornography in addition to
files that would likely contain evidence of passport fraud.
