## Facts

- Federal agents obtained a warrant to search a residence for evidence of passport and identity-theft-related fraud and to seize computers and electronic storage media.
- Agents seized a laptop and an external storage device belonging to Christopher Schlingloff.
- A forensic examiner analyzed the devices using Forensic Toolkit (FTK) and enabled the Known File Filter (KFF) in a manner that flagged hash matches to known child-pornography files.
- During preprocessing, KFF flagged two video files; the examiner opened them briefly to confirm they were child pornography, then stopped further viewing.
- Agents then obtained a second warrant specifically authorizing a search for child pornography and, under that warrant, located 33 child-pornography videos.
- Schlingloff was indicted for possession of child pornography based on the videos.
- Schlingloff moved to suppress, arguing the KFF configuration and file-opening exceeded the original warrant; the court reconsidered after learning KFF could be selectively configured and ultimately granted suppression.

## Issues

1. Whether the examiner exceeded the scope of a fraud-focused warrant by configuring hash filtering to flag known child-pornography files and opening the flagged videos.
2. Whether the child-pornography files were admissible under the plain-view doctrine.
3. Whether the government proved the files would have been discovered inevitably through a lawful search for fraud evidence.

## Decision

- The court granted the motion to suppress.
- The court held the examiner exceeded the original warrant’s scope by intentionally configuring KFF to search for child pornography and by opening the flagged files to confirm their contents.
- The court held the plain-view doctrine did not apply because the discovery resulted from an intentional, unauthorized search objective rather than an incidental observation during a warrant-limited search.
- The court held the government did not establish inevitable discovery because it failed to show that a proper fraud-focused search would have led to opening the same video files.
- The suppression ruling excluded both the initially opened videos and the additional child-pornography files found under the second warrant as fruits of the unlawful search.

## Legal Principles

- A computer search warrant limited to evidence of a specified offense constrains both the objectives and methods of digital forensic examination.
- Using a configurable forensic feature to target evidence of an unrelated offense constitutes an extra-warrant search when that targeting is a discretionary investigative choice.
- Plain view does not excuse evidence obtained through a deliberate search for items outside the warrant’s authorized scope, even if the examiner is lawfully in possession of the device.
- Inevitable discovery requires proof, by a preponderance of the evidence, that lawful investigative steps would have led to the same evidence; speculation about what might have been opened is insufficient.
- Evidence obtained under a later warrant may be suppressed when the later warrant and resulting discovery flow from an earlier Fourth Amendment violation.

## Conclusion

The court suppressed child-pornography evidence because the examiner intentionally used hash-based filtering and confirmation viewing to search beyond a fraud warrant, and the government could not salvage the evidence through plain view or inevitable discovery.


United States v. Schlingloff, 901 F. Supp. 2d 1101 (C.D. Ill. 2012)