The Smudged Hash and the Spouse's SSD
During a search of an off-base apartment rented by a junior enlisted member, AFOSI agents seize a government laptop, a personal external SSD, and a smartphone. The laptop is powered on and displaying a login screen. The evidence technician photographs the scene, hashes the laptop's internal drive through a write-blocker, records the hash on the evidence bag, and seals it. At the lab two days later, the examiner notes that the bag's tamper-evident seal is intact but the handwritten hash label is smudged and partially illegible. The examiner images the drive and obtains a hash that the case agent cannot compare because the scene hash is unreadable. Defense counsel learns of the discrepancy and argues the laptop evidence was altered and must be suppressed. The agent also learns the apartment lease is in the suspect's spouse's name and the SSD contains apparent stolen personal data unrelated to the originally reported theft.
1. What should the case agent do about the unreadable scene hash and intact seal before submitting the case to the prosecutor?
Read the worked answer
The agent should treat the hash problem as an integrity-documentation issue, not paper over it. First, preserve the original bag and smudged label; photograph them before any handling and note the seal condition. Obtain the technician's contemporaneous notes, the hash value if stored in a device or worksheet, and a written statement describing how the hash was generated and recorded. Ask the lab to document the condition on receipt, rehash the drive and the forensic image, and maintain a new sealed chain if the drive must be opened. Do not recopy the smudged label or create a replacement hash record; a reconstructed value must be labeled as reconstructed. Notify the prosecutor early and consider an independent examiner. The report should state the discrepancy plainly and explain that the intact seal and custody records still support authentication. The agent should also check whether the scene hash was of the physical drive or a logical volume, because comparing unlike hashes creates a false discrepancy. Finally, the agent should separate the hash issue from the SSD issue: the spouse's lease interest and the unrelated stolen data require a legal review before further review or use.
2. Defense counsel argues that the laptop evidence must be suppressed because the scene hash cannot be compared. Evaluate that argument and the agent's response.
Read the worked answer
A chain-of-custody or hash discrepancy does not automatically require suppression. The foundation for physical or digital evidence can be established by testimony about seizure, sealing, storage, and lab handling; the hash is a check on integrity, not a constitutional prerequisite. Here the seal was intact, the technician documented the seizure, and the lab can verify the image against the drive as received. The defense can argue weight and ask for a hearing, but the agent should not concede alteration. The agent should distinguish three questions: Was the search lawful? Was the item authenticated? Was it materially altered? A smudged label goes to the second and third, and the prosecutor may need the technician and examiner to explain the gap. If records show the drive was booted, left unsealed, or accessed without documentation, then the analysis changes and the prosecutor should be told immediately. The agent should avoid claiming the hash 'matches' when it does not; accurate language protects the case. Any suppression motion should be answered with records and witnesses, not argument alone.
3. What should the agent do about the spouse's SSD and the unrelated stolen personal data?
Read the worked answer
The SSD raises a separate authority problem. If the warrant or consent covered only the government laptop or the suspect's property, the spouse's SSD may be outside scope. The agent should stop examining it, document exactly what was seen and when, and consult the prosecutor and SJA before any further review. If the spouse shares the apartment and consents, obtain a written consent that is voluntary and specific; if not, seek a new authorization. Plain view can apply only if the agent was lawfully present and the incriminating character was immediately apparent, and that is a legal call, not an agent's unilateral one. Because the data appears to be stolen personal information unrelated to the original theft, the agent should consider whether it supports a separate identity theft or computer crime case and whether victims must be notified. Keep the SSD sealed and chain documented; do not let the spouse's ownership be decided by informal assumptions about marital property. Finally, document the lease issue and any consent in the report so the prosecutor can assess scope and standing.