COURT OF APPEALS OF VIRGINIA
Present: Judge McClanahan, Senior Judge Willis and Retired Judge Fitzpatrick∗
Argued at Richmond, Virginia
KEITH ALAN ROSA
OPINION BY
v. Record No. 0288-05-2 JUDGE JOHANNA L. FITZPATRICK
APRIL 11, 2006
COMMONWEALTH OF VIRGINIA
FROM THE CIRCUIT COURT OF CHESTERFIELD COUNTY
Cleo E. Powell, Judge
Muriel-Theresa Pitney (Joseph W. Kaestner; Kaestner &
Associates, P.C., on brief), for appellant.
Eugene Murphy, Senior Assistant Attorney General (Judith
Williams Jagdmann, Attorney General, on brief), for appellee.
Keith Rosa (appellant) was convicted in a bench trial of ten counts of possessing sexually
explicit visual material of a person less than eighteen years of age, in violation of Code
§ 18.2-374.1:1. Appellant contends that the trial court erred in denying his motion to suppress
pictures found on his computer during a search of the computer. Appellant argues that the
officer conducting the search unreasonably exceeded the scope of the search warrant by opening
files that were labeled with picture extensions. Furthermore, appellant claims that the picture
files were not in “plain view” because appellant had previously deleted them and they could only
be viewed by the officer after he reconstructed them with a computer program. We hold that the
officer acted reasonably in opening the picture files and that the deleted files were in plain view.
Thus, we affirm the judgment of the trial court.
∗
Judge Fitzpatrick prepared and the Court adopted the opinion in this case prior to the
effective date of her retirement on March 31, 2006.
I. BACKGROUND
We view the evidence in the light most favorable to the Commonwealth, the party
prevailing below, regarding as true all credible evidence supporting the Commonwealth’s
position. Summerlin v. Commonwealth, 37 Va. App. 288, 294-95, 557 S.E.2d 731, 735 (2002).
On November 1, 2003, Catherine Jackson, a twenty-year-old student, received an e-mail
from appellant. In response to this e-mail, Jackson sent appellant her screen name and the two
began to have conversations over the internet concerning the distribution of drugs, alcohol, and
various sexual acts. Jackson contacted the police about these discussions. The police pretended
to be Jackson and arranged a meeting with appellant. When appellant arrived at the meeting, the
police arrested him.
On November 10, 2003, Sergeant Adrienne Meador (Meador) obtained a search warrant
for appellant’s computer. The warrant authorized a search for “[e]lectronic processing and
storage devices, computer and computer devices . . . bearing information on conversations had
with University of Richmond student Catherine Jackson (aka sweetie3637) or any other
conversations or files listing screenname KAROSA72 karosa@hotmail.com with any
individuals.” The search warrant was issued relative to the crimes of distribution of controlled
substances, distribution of controlled substances in a school zone, and providing alcohol to a
person less than twenty-one. The police executed the search warrant and seized appellant’s
computer and computer storage devices.
Meador delivered the computer to Officer Jeffrey Deem (Deem), who specializes in
technology crimes. Deem examined the computer using a program called EnCase, which is
designed to recover any data located on a hard drive, whether it is an active computer file or a
previously deleted file. After appellant’s hard drive was copied, Deem performed keyword
searches with specific words related to the terms on the warrant, such as Catherine Jackson and
-2-
sweetie3637. The search program allowed a search of the contents of files as well as the names
of files. Although Deem testified that chat sessions would normally be saved as files with text
extensions, he also opened files that did not have text extensions, such as picture, or jpeg files,
after completing the keyword search. He noted that it was common practice to manually open
picture files. The reason for doing this was that any text saved as a jpeg file would not be found
by only conducting a word search, and it was possible to save a chat session as a jpeg file.
Several chat sessions were in fact saved in jpeg files on appellant’s computer. Deem stated that
he could not determine whether a particular jpeg file fell within the scope of the search warrant
until he opened it to see if it contained relevant information.
While Deem was opening jpeg files, he viewed an image that he believed to be child
pornography. He immediately stopped opening picture files and applied for and received a
second warrant that allowed him to specifically search for sexually explicit pictures of children.
Appellant had deleted the files containing child pornography from his computer, and they were
visible only when Deem re-created them using the EnCase program.
Appellant was indicted on ten counts of possessing sexually explicit visual material of a
person less than eighteen years of age, in violation of Code § 18.2-374.1:1. Before trial,
appellant moved to suppress the images recovered from his computer. At the hearing on the
motion to suppress, appellant’s expert, Bruce Thompson, testified that it was not necessary to
view every picture file in order to determine whether it contained text. Thompson suggested that
if all the picture files on appellant’s computer were relabeled with text extensions, those
containing text could be opened, while those containing pictures would be unreadable by the
computer. The trial judge denied appellant’s motion to suppress, finding that “I don’t think it’s
unreasonable, if it can be disguised as a JPEG file when it’s actually a chat room file or a text file
and would not show up with the other searches, to then open the files to make sure that it is not a
-3-
chat room or a text.” Appellant was convicted in a bench trial on all ten counts of possessing
child pornography.
II. ANALYSIS
Appellant first contends that the search of his computer became unreasonable when
Deem opened his picture files. Appellant claims that while Deem acted appropriately by
searching for keywords, any actions beyond that equated to a general search of the computer and
exceeded the scope of the warrant. We disagree.
Appellant has the burden of showing that the trial court’s denial of his suppression
motion was reversible error. Murphy v. Commonwealth, 264 Va. 568, 573, 570 S.E.2d 836, 838
(2002). A claim that evidence was seized in violation of the Fourth Amendment presents “a
mixed question of law and fact that we review de novo on appeal.” Id.; see Ornelas v.
United States, 517 U.S. 690, 696-97 (1996). This Court gives deference to the factual findings
of the trial court, but will “independently determine whether the manner in which the evidence
was obtained meets the requirements of the Fourth Amendment.” Murphy, 264 Va. at 573, 570
S.E.2d at 838.
A search must be conducted in a reasonable manner. Wynne v. Commonwealth, 15
Va. App. 763, 766, 427 S.E.2d 228, 230 (1993). Additionally, the scope of a search is limited by
the terms of the authorizing warrant. Kearney v. Commonwealth, 4 Va. App. 202, 204, 355
S.E.2d 897, 898 (1987). However, the scope of a search extends to every place where the object
of the search may reasonably be found. Id. at 205, 355 S.E.2d at 899 (citing United States v.
Ross, 456 U.S. 798, 820-21 (1982)).
While we have not previously addressed the issue, a number of courts have considered
whether it is reasonable for an officer executing a search of a computer to open various types of
computer files and to determine whether they fall within the purview of the warrant. They have
-4-
concluded that such actions are reasonable. The Tenth Circuit, in United States v. Walser, 275
F.3d 981 (10th Cir. 2001), reviewed a suppression motion where an officer opened a file with an
audio-visual extension while searching for evidence of drug transactions. Id. at 984-85. While
the court stated that officers “cannot simply conduct a sweeping, comprehensive search of a
computer’s hard drive” because of the amount of private material potentially stored there, it
found the search proper because the officer used a clear search methodology and obtained a
second warrant as soon as he viewed images he believed fell outside of the scope of the first
warrant. Id. at 986-87. See United States v. Carey, 172 F.3d 1268, 1275 (10th Cir. 1999) (where
officer did not stop his search to obtain a second warrant after viewing images believed to be
child pornography, the motion to suppress should have been granted).
United States v. Gray, 78 F. Supp. 2d 524 (E.D. Va. 1999), dealt with a factual situation
similar to the instant case. Officers searching for evidence of computer trespass opened jpeg
files that contained pornographic images of children. Id. at 527. After viewing the images, the
officers immediately obtained a second warrant. Id. at 528. That court noted that where it is not
immediately apparent whether a document falls within the scope of the search warrant, an officer
has the ability to examine the item to see if it falls within the warrant’s purview. Id.; see
Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976) (finding that in the course of a valid
search “some innocuous documents will be examined, at least cursorily, in order to determine
whether they are, in fact, among those papers authorized to be seized”). The court then held,
“[i]n searching for the items listed in the warrant, [the officer] was entitled to examine all of
defendant’s files to determine whether they contained items that fell within the scope of the
warrant.” Gray, 78 F. Supp. 2d at 529. Additionally, the court found that even though there may
have been less invasive ways of conducting the search, “[t]he resolution of the motion to
suppress does not turn on whether [the officer] conducted the most technically advanced search
-5-
possible, but on whether the search, as conducted was reasonable.” Id. at 529 n.8 (emphasis
added).
United States v. Triumph Capital Group, Inc., 211 F.R.D. 31 (D. Conn. 2002), also
reached the same conclusion. The court held that computer searches
are technical and complex and cannot be limited to precise,
specific steps or only one permissible method. Directories and
files can be encrypted, hidden or misleadingly titled, stored in
unusual formats, and commingled with unrelated and innocuous
files that have no relation to the crimes under investigation.
Descriptive file names or file extensions such as “.jpg” cannot be
relied on to determine the type of file because a computer user can
save a file with any name or extension he chooses. Thus, a person
who wanted to hide textual data could save it in a manner that
indicated it was a graphics or image file. For these reasons and as
a practical matter, [the officer] acted reasonably and within the
scope of the warrant by opening, screening and manually
reviewing data and files in all areas of the hard drive, including
image files.
Id. at 47 (emphasis added).
The Court of Appeals of Indiana also refused to limit police searches to a particular type
of file extension. Frasier v. State, 794 N.E.2d 449, 465 (Ind. Ct. App. 2003). The court
remarked, “[t]he case before us is a case in which ambiguously labeled files were located on the
hard drive and the officer had to ‘open’ each file before discovering its contents.” Id. The court
approved of the officer’s actions in opening files to determine whether they contained relevant
material and obtaining a warrant as soon as the officer viewed material which he suspected fell
outside of the scope of the original warrant. Id.1
1
See also United States v. Hunter, 13 F. Supp. 2d 574, 584 (D. Vt. 1998) (“Computer
records searches are no less constitutional than searches of physical records, where innocuous
documents may be scanned to ascertain their relevancy.”); State v. Schroeder, 613 N.W.2d 911,
916 (Wis. Ct. App. 2000) (disregarding file extensions when conducting a computer search
“makes sense, as the user is free to name a file anything”).
Commentators addressing the issue have reached the same conclusion. See Thomas K.
Clancy, The Fourth Amendment Aspects of Computer Searches and Seizures: A Perspective and
a Primer, 75 Miss. L.J. 193, 210 (2005) (“the more sound approach” is to allow officers to scan
-6-
We agree with the reasoning of these cases. In a search for tangible documents, “it is
certain that some innocuous documents will be examined, at least cursorily, in order to determine
whether they are, in fact, among those papers authorized to be seized.” Andresen, 427 U.S. at
482 n.11. That principle applies equally to searches for electronic files. Moreover, a lawful
search extends “to the entire area in which the object of the search may be found.” Kearney, 4
Va. App. at 205, 355 S.E.2d at 899 (quoting Ross, 456 U.S. at 820). Therefore, officers may
glance at files with various extensions in order to ascertain whether or not the files fall within the
purview of the warrant. See Gray, 78 F. Supp. 2d at 528; Frasier, 794 N.E.2d at 465. Because
file extensions may be misleading and may not give accurate descriptions of the material
contained in the file, limiting the scope of a search to a particular file extension is an irrational
restraint on the discretion of the searching officer. See Triumph Capital Group, Inc., 211 F.R.D.
at 47; State v. Schroeder, 613 N.W.2d 911, 916 (Wis. Ct. App. 2000).
Thus, the pictures obtained in this case were properly admitted. After performing a
keyword search, the officer glanced at the picture files to determine whether they fell within the
scope of the search warrant. The officer testified that he commonly opened picture files when
conducting a computer search, because any text saved in a picture file would not be found simply
by using a word search. Indeed, a number of chat sessions were located in picture files on
appellant’s computer. Once the officer viewed the image he believed to be child pornography,
he immediately obtained a second warrant.2 As a result the officer acted properly in opening
all documents, regardless of their file extension); David J. S. Ziff, Note, Fourth Amendment
Limitations on the Execution of Computer Searches Conducted Pursuant to a Warrant, 105
Colum. L. Rev. 841, 863 (2005) (an officer’s authority to search a defendant’s computer “should
not be limited to files with names or types that indicate the category of information authorized
for seizure by the warrant”).
2
The fact that a less intrusive means of searching existed does not alter our conclusion.
Vernonia Sch. Dist. 47J v. Acton, 515 U.S. 646, 663 (1995); Hogan v. Commonwealth, 15
Va. App. 355, 364, 423 S.E.2d 841, 847 (1992). The overriding question is one of
-7-
files with various extensions in order to ascertain if they contained relevant material, and the trial
court did not err in denying the motion to suppress.
Appellant also contends that the computer files were not in “plain view” because they
were deleted files and could only be viewed after they had been re-created using computer
software. We disagree.
As noted earlier, the officer was entitled to examine all of appellant’s files to determine
whether they contained items that fell within the scope of the initial warrant. During the proper
execution of that warrant the officer viewed pornographic images and immediately applied for a
second warrant to cover the seizure of those additional items. We find no error in this procedure.
The fact that appellant had attempted to delete these files is of no moment. Deleted files
have consistently been treated no differently than intact files. United States v. Upham, 168 F.3d
532, 537 (1st Cir. 1999) (analogizing deleted files to a coded message or a torn ransom note);
Commonwealth v. Copenhefer, 587 A.2d 1353, 1356 (Pa. 1991) (likening such files to a diary
written in code). The court in Copenhefer explained, “[a]ppellant’s unsuccessful attempt to
delete documents or files from his computer did not create a legally protected expectation of
privacy which would have required a second warrant before the prosecution applied technology
to elicit the content of files buried in the memory of the computer.” Copenhefer, 587 A.2d at
1356. Here, Deem took the even more rigorous route of obtaining a second warrant.
The picture files at issue were saved on unallocated space. Deem testified that
“unallocated space on a computer is that area of the computer where files have been in the past,
reasonableness, El-Amin v. Commonwealth, 269 Va. 15, 20, 607 S.E.2d 115, 117 (2005), and
here the officer acted reasonably in opening the jpeg files to determine whether or not they
contained relevant material. Although appellant’s expert testified that another alternative
existed, “as computer technology changes so rapidly, it would be unreasonable to require the
[police] to know of, and use, only the most advanced computer searching techniques.” Gray, 78
F. Supp. 2d at 529 n.8.
-8-
the area is available to be used again, but the files haven’t been deleted.” After appellant deleted
the files, he probably would not be able to view them again: “once they are deleted, the
computer is not going to through its normal interface recognize that that data is still there. I
mean, I couldn’t pull up Windows Explorer and say I want a file in an unallocated space.”
The warrant authorized a search of all “electronic processing and storage devices,
computer and computer devices, [and] external storage devices” and did not limit the search to
any specific area of the computer. Deem, therefore, was permitted to look in any section of the
computer that might contain the objects of the search, including deleted files that had been
re-created. The deleted files are not entitled to additional protection simply because appellant
attempted to erase them. See Copenhefer, 587 A.2d at 1356.
For the foregoing reasons, we affirm the judgment of the trial court.
Affirmed.
-9-