Scope Expansion During an Off-Site Fraud Examination
On 3 March at 09:10, investigators serve a warrant at a 40-person logistics company. The warrant authorizes seizure of computers and storage used in a wire-fraud scheme involving three customer invoices sent between 6 January and 21 February; the affidavit focuses on email, accounting files, and payment instructions. Agents seize a shared reception desktop, the finance manager’s laptop, and a 2 TB USB drive found in the finance manager’s unlocked desk drawer. At the lab, an examiner images the USB drive and, during validation, observes a folder named “Personal” containing 40 image files with filenames suggesting child sexual abuse material. The USB drive is not listed on the warrant inventory because it was found during the scene sweep. The chain-of-custody form records sealing at 11:42, but the transfer from the scene to the evidence locker lacks a receiving signature. The defense has not been notified. The examiner has not opened the images.
1. May the examiner continue reviewing the “Personal” folder under the existing warrant? Explain the legal and operational reasoning, and state what the examiner should do next.
Read the worked answer
No - not on the present authority. The warrant is limited to evidence of wire fraud involving invoices and payment instructions. The examiner was lawfully present at the USB drive, but that does not convert the warrant into a general search authority for unrelated content. The plain-view doctrine may allow seizure of immediately apparent contraband found while lawfully searching within scope, but it does not authorize browsing an unrelated folder to determine what it contains. Filenames alone are not a sufficient basis for expanding the examination.
Next steps: stop reviewing the folder; preserve the USB state and record exactly what was visible without opening files; notify the case agent and prosecutor immediately; seek a separate warrant or valid consent before any further examination. If plain view is asserted, document why the contraband was immediately apparent and why the examiner was lawfully in that location. Do not preview, copy, or informally discuss the images beyond what is necessary for the notification. This approach protects the fraud case from suppression risk and avoids contaminating the separate investigation.
2. How should the missing receiving signature be handled in the report and testimony? Does it make the USB drive inadmissible?
Read the worked answer
A missing receiving signature is a chain-of-custody defect, not an automatic admissibility bar. The examiner should document the gap factually: who sealed the drive at 11:42, who transported it, when it arrived at the locker, who received it, and why the signature is absent. Then corroborate custody with the seal number, storage location, access logs, hash values, and any photographs or locker records. The examiner should not invent a signature or backfill the form.
In testimony, the examiner should concede the gap and explain how the evidence was protected despite it. Courts generally weigh chain gaps rather than exclude evidence solely for a clerical omission, but the strength of the foundation matters. The report should include a deviation memo and corrective action. If the gap creates an unresolved period of unaccounted access, the prosecutor should be told before trial so that a witness can address it directly. The hash and seal record are the strongest rebuttal to tampering allegations.
3. What documentation and notification steps should occur before any further examination of the USB?
Read the worked answer
Before further examination, the examiner should create a written record of the current state: date and time, examiner identity, tool and version, the exact folder path observed, the visible filenames, and the fact that no files were opened. The USB should be re-sealed or logically preserved, and all access should be logged. The case agent and prosecutor should be notified in writing, with a recommendation to seek separate legal authority. The lab quality manager should open a deviation record for the chain-of-custody gap.
The examiner should not notify the defense directly unless instructed by counsel; notification strategy is a legal decision. However, the examiner should preserve everything needed for later disclosure, including notes, screenshots of the directory listing, and the imaging log. If the images are eventually examined under separate authority, a new examination plan, new hash verification, and a separate report should be created. Keeping the fraud examination and the separate inquiry documented as distinct workstreams reduces the risk of scope confusion and supports defensible testimony.