Returns and Inventories for Computer Search Warrants

More and more criminal investigations involve searches of computers and other digital devices. It is sometimes difficult to apply long-established search and seizure law to the practical realities of digital investigations. One example of this phenomenon concerns the preparation of the return and the inventory after the execution of a search warrant,  a topic of persistent confusion among law enforcement officers and others. The return and inventory requirements. Under G.S. 15A-257, an officer who executes a search warrant must return the warrant to the clerk without unnecessary delay. The return normally is indicated on the warrant itself. (The AOC search warrant form is AOC-CR-119.) The officer must also provide the clerk with “a written inventory of the items seized,” G.S. 15A-257, and a list of the items seized must likewise be provided to the person from whom they were taken, G.S. 15A-254. Form AOC-CR-206 may be used for creating an inventory. How do these requirements apply to computer searches? With computer searches, a timing issue frequently arises. Suppose that a warrant authorizes officers to search a defendant’s home and computer for evidence of a crime, and further allows the officers to conduct the computer search off-site. The search of the home and the seizure of the computer typically will take place shortly after the issuance of the warrant, but the search of the computer may not take place until days or weeks later. (The propriety of a forensic analysis outside the 48-hour window is a topic for another time, but the short version is that it’s almost always OK.) Should the warrant be returned after the search of the home, or should it wait until the search of the computer is complete? And should the inventory list the computer itself, or the files and data within the computer? Filing the return. The prevailing practice appears to be to return the warrant after the initial search, even if the computer has not yet been subjected to an off-site examination. One justification for this practice is that it provides evidence of compliance with the requirement that a warrant be executed within 48 hours of issuance. Although no North Carolina case addresses the issue, courts elsewhere have generally approved of this procedure. See Com. v. Kaupp, 899 N.E.2d 809 (Mass. 2009) (sufficient to return warrant shortly after initial search and prior to forensic examination “listing the devices” seized); United States v. Hernandez, 183 F.Supp.2d 468 (D. Puerto Rico 2002) (“[B]ecause off-site computer searches are reasonable, it may be necessary . . . for the return of the warrant to be filed with the court before such off-site searching can be completed.”). Preparing the inventory. An inventory is normally provided at the same time, simply listing the computer as an item seized, and making no reference to specific data or files within the computer. This is probably sufficient, notwithstanding the fact that the ultimate objects of most computer search warrants are files and data rather than hardware. A cautious officer might file a supplemental inventory listing the data or files seized after the off-site search of the computer. In any event, however, imperfect compliance with the return and inventory requirements is unlikely to require the suppression of evidence. State v. Nadeau, 1 A.3d 445 (Me. 2010) (computer search warrant provided that the search was to be conducted, and an inventory returned, within 10 days; no inventory was ever prepared, but this was a “ministerial” failure that did not warrant suppression of evidence); State v. Fruitt, 35 N.C. App. 177 (1978) (officer’s failure to comply strictly with inventory requirement did not require suppression of evidence). What am I missing? Let me know if there are wrinkles to this scenario that I haven’t addressed. I’m working on a longer manuscript about digital search and seizure and so am keenly interested in what’s happening in the field.