Goldfoot examined how the Fourth Amendment applies to investigations involving com- puters [65]. He addresses the two most common ways to view digital media:the internal view as a container of sub-containers, or the external view as a physical object. His work examines both perspectives in detail including arguments for and against and then proposes that the physical object perspective is the proper view.
4.4.1
The Container of Sub-containers
The container of sub-containers perspective views digital media as a collection of individual groups of data that all are their own container. Each container requires justification for its examination. A container does not just exist at the file level. It can be above it, at the folder level for example, or below it as an individual line in a spreadsheet or a block of data of a file. The storage medium is treated like a collection of information only some of which may be used as part of the investigation. This is the most popular view among the courts and the legal profession at large [65, p. 118].
To accommodate this view of digital media, it is necessary to translate search and seizure law into something more logical and virtual. This is because almost all the laws, ranging from the Constitution to the U.S.C. primarily address the search and seizure of a physical
thing or location by government agents. Goldfoot contends that attempting to make this translation presents several issues [65, p. 123]:
• Drawing sub-containers: The goal of this perspective is to place barriers in place that regulate access to information so that the investigator does not look at too much information. In the digital world, these barriers are absent due to the way in which a computer is implemented. The normal division tends to be at the file level but Goldfoot points out that modern techniques do not just focus on whole files found on digital media. It also include the examination of Random Access Memory (RAM) and sub-file fragments. Implementing the container could be done internal to a file or at the sub-file level as well, but presents issues concerning what to redact and what not to in the course of an analysis. The container of sub-containers perspective is difficult to implement because digital media does not lend itself to being divided [65, p. 125].
• Reasonable searches: The laws governing the procedures for search and seizure are designed to protect the population from unreasonable searches and seizures. The requirements that government agents must meet prior to executing a search provide such protection. These rules do not translate well with the internal view of digital media. It is easy to determine when a place has been searched and items seized from it in order to serve as evidence. What a seizure is and when the search occurs has not been clearly defined with digital media [65, p. 131].
• Regulating the forensic examination: The container of sub-containers view strug- gled to properly regulate a forensic investigation. When the investigator leaves the location of a physical search with a sector-for-sector copy of a hard drive, the agent has all the data with him. The simple fact is that modern forensics requires sift- ing through large amounts of data to find the needle in a haystack. What ends up occurring is one of two extremes where either all the data ends up being examined anyway, making the point of having sub-containers mute, or the pertinent data ends up being suppressed because the search for it violated the protected status of the containers [65, p. 136].
4.4.2
The Physical Object
The physical object perspective treats digital media like any other object subject to search and seizure. With this view, once an investigator comes to have legal possession of the me- dia in question, that person would be authorized to conduct whatever forensic procedures were necessary to find the relevant information on it. Digital media would be treated the same a blood found at a crime scene or an article of clothing with DNA evidence on it. Testing can be done on these items without specific requirements set by the judiciary. A physical view of digital media means that there is no need to translate search and seizure laws. A physical premise is searched and digital media seized as part of the execution of a search warrant. Information found on the media are now facts learned during the investi- gation [65, p. 149].
The primary argument against this approach is that the focus of the search is on the in- formation the media contains, not the physical object itself. Goldfoot points out that this is true with any piece of physical evidence. It is the object combined with the analysis that give meaning to physical evidence during a trial. The results are then explained by an expert witness as required to the court or the jury in a case [65, p. 153].
4.4.3
The Debate on Which View to Adopt
Goldfoot argues that both methods lead to the same result: in the course of a forensic anal- ysis, an examiner may end up viewing all the pieces of data. With the physical view, this can be done directly. With the container view, it is done through the haystack problem and the plain view doctrine. The container of sub-containers perspective would require spe- cial rules be implemented much as was done when the Supreme Court determined wiretaps were a Fourth Amendment search. Data is commingled and vast amounts of it can be stored on digital media. More and more of it is private as society continues to expand its use of computers. Its exposure with no controls grants law enforcement a lot of authority. The fundamental question is whether searching a computer is more like the search of someone’s home, a large warehouse facility, or some other physical entity [65, p. 160].