High Tech Crime Seizure
The Journal of Computer Crime Investigation & Forensics
October-December 1999, Issue 7.4
Individuals are considered to possess certain inalienable rights; rights that governments may not take away or compromise. These rights are considered part of a higher law of universal principles of right and justice that is superior to laws created by governments. We, as representatives of the criminal justice community, are strictly bound by constraints established through the United States Constitution and the Bill of Rights. This article provides the reader with a micro-focus on a single aspect of the Fourth Amendment: particularly describing the things to be seized. Quoted directly from the Bill of Rights for clarity, one cannot mistake the need to particularly describe the things to be seized.
Fourth Amendment
The right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
This is not to suggest our forefathers reasonably expected an Affiant to list make, model, or serial numbers of property sought in search warrants; yet the document does require an expected attention to detail in describing the property sought. Overly broad and vague descriptions often lead to unnecessary legal challenges. With this firmly established, you will find below a thorough (yet not all encompassing) listing of property sought that will likely be found in computer crime investigations. Items 1 and 2 particularly describe property that would be subject to seizure in the majority of computer crime investigations. Items 3 through 9 list evidence specific to child exploitation investigations.
The example provided below is the culmination of several years of federal and state prosecutorial input and support in computer crime investigations of child exploitation. Feel free to incorporate any applicable sections in your search warrants. It is encouraged that investigators include prosecutors from the onset of each investigation. This investigator-prosecuting agent relationship strengthens the prosecutorial effort through a mutual understanding of procedural and investigative expectations.
PROPERTY SOUGHT:
1) Computers, including any electronic magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions; data storage facilities such as magnetic tape, hard disk, floppy disk or drum, or cd-rom; communications facilities directly relating to or operating in conjunction with such device; devices for printing records of data; and such records or data produced in various forms; manuals, documents, or instructional material relating to such devices.
2) Computers, personal computers, computer peripherals, modems, computer printers, floppy disk drives, hard disk drives, diskettes, tapes, computer printouts, computer software, computer programs and applications, computer manuals, system documentation.
3) Correspondence, diaries, and any other writing, tape recordings, or letters relating to any juvenile which would tend to show the identity of the juvenile, and sexual contact between juveniles with juveniles, and juveniles with adults.
4) Magazines, drawings, books, movies, video tapes, and photographs depicting nudity and or sexual activities of juveniles, as well as collections of newspapers, magazines, publications, and clippings of juveniles.
5) Telephone books, telephone registers, correspondence or papers, with the names, addresses, or phone numbers which would tend to identify any child victims.
6) Any cameras and video equipment intended for the taking, producing and reproducing of photographic still and moving images, including but not limited to, digital, instant and otherwise, video cassette recorders or cameras, and video recording tapes depicting juveniles engaged in sexual conduct or lewd exhibition of the genitals and sexually explicit materials including VHS tapes, 8mm tapes, 8mm compact tapes, beta tapes, view finder, films, negatives, and photographs, developed or undeveloped.
7) Sexual paraphernalia or other erotica used by the suspect or victim in the course of seducing the child victim or others of which the Affiant gains knowledge.
8) Telephones, telephone equipment, telephone test equipment, telephone proprietary information, or any other telephone type equipment for scanning telephone circuits, telephone bills and statements.
9) Safe deposit keys, bank statements, billings and checks, to identify safe deposit boxes and storage facilities for any person involved in the sexual exploitation of children through child molestation or pornography, for the purpose of documenting travel expenses and purchases relating to sexual performance by a child.
Robert DeYoung is a detective assigned to investigate child exploitation with the LEACH (Law Enforcement Against Child Harm) Task Force, Broward County Sheriff’s Office in Fort Lauderdale, Florida. Detective DeYoung provides presentations nationally on the topic of Internet sexual child exploitation. He instructs a two-day investigator’s course offered through Law Enforcement Training Services, Inc. (Sunrise, FL) specific to online investigations. This course has been recognized nationally as an excellent foundation development course for investigators wishing to pursue online investigations.
Detective DeYoung is an adjunct professor at Lynn University in Boca Raton, Florida, facilitating the instruction of undergraduate management courses for the College of Professional and Continuing Studies. He is a post-graduate student at Lynn University, seeking his Ph.D. in Educational Leadership.
Recent Investigations
Corporate Property TheftA Miami-based multinational corporation contacted Forensic Recovery, LLC to determine if a recently terminated executive had transmitted proprietary information to a competitor, who was suspected of currently using protected content within a uniquely formatted database.
Destruction of Electronic Data
A corporation had determined through electronic discovery that an IT employee who had been recently terminated had allegedly created a catastrophic loss of an insurance database. A previous examination of the evidence revealed compelling evidence that the suspected IT Administrator had remotely accessed the network, deleting all use names and passwords, as well as medical records and other medical-related data.
Child Exploitation Investigation
(Peer-to Peer Networks)
The government continues to adapt to the changing environment related to Internet crimes against children. Chat rooms interactions, traveler investigations, and possession and distribution have long been the focus of such investigations.
Child Exploitation Investigation
(Knowledge and Control))
A key element of possession of child pornography involves knowledge and control by the alleged offender. There are numerous areas of electronic evidence that provides explicit evidence as to knowledge and control.
Counter Terrorism Investigation
In 2007, Forensic Recovery, LLC was hired by the Federal Public Defenders Office to conduct a review of evidence in a highly publicized terrorism case. Over a period of almost one year, the government continued to examine evidence and provide such findings as discovery.
Date and Time Stamps of Computer Files
(timestamp)
In 2009, an individual was arrested for violating his terms of supervised release for possessing child pornography. It should be noted the original charge and subsequent incarceration was also for possession of child pornography.
Divorce Inquiries
In 2009, a West Palm Beach client requested a complete examination of his computer’s hard drive. This request came after a filing for divorce and an allegation by the client’s wife that child pornography had been seen on the client’s hard drive.

Download PDF