Issue of 'Overseizure' relating to imaging of computer media
Forum members The issue of 'Overseizure' relating to the imaging of computer hard drives/media has been percolating here in Canada for some time now. Although the issue has been raised in courts and sort of side-swiped in legal discussions, it has never really been fully addressed (to my knowledge). That is to say, why do we have to image an entire hard drive/media to access only the limited information required for a court case ? This also depends on the type of investigation being pursued and the type of evidence being sought from the computers/mobile devices/media. For many years we have been routinely imaging hard drives and computer/digital media with respect to our investigations, and the question that is arising is 'why is this necessary, this seems to be an overseizure of data ?'. Although in some cases, complete imaging is an overseizure (depending on the investigation and evidence sought), there are also sound reasons why we have been imaging media for all these years – why this practice/technique has developed.
My question to the group is this is anyone aware of any case law, papers, articles or books where this question of 'why we image media and the reasons for it' is discussed in depth or at length ? We have a prosecuting attorney (Crown Attorney in Canada) who wants to know what is in print relating to this issue since it has come up in an case here in Ontario, Canada.
All suggestions, recommendations and discussion is appreciated.
Ontario Provincial Police, Ontario, Canada
There is no simple answer to the issue of seizure of electronic data and each case must be treated on its own set of circumstances. So if you "routinely" image everything then that is unlikely to be appropriate in all circumstances and a decision has to be made to carfeully consider what should be seized/imaged. Generally the police err on the side of caution and this approach is based upon past experience of failing to capture enough data and then not being able to retrieve it later.
In UK law there is case law regarding the failure by the prosecution to gather enough information at an early stage of an investigation and by doing so failing to give the defence an opportunity at reviewing potentially exculpatory evidence. This arose in a homicide case where the police failed to secure CCTV evidence in the environs of a crime scene which might have assisted the defence. This could equally apply in computer related evidence where if a logical image or partial logical image is taken this may fail to give the defence an opportunity to consider the evidence in context.
There is some UK case law surrounding seizure of evidence which relates to documentary evidence but can be extrapolated into digital evidence.
One which is quite old now but led to changes in the law was R v Chesterfield Justices and another, ex parte Bramley  All ER (D) 1237
Another one which did relate to computer evidence was H v IRC. This was concerning Inland Revenue law but is about the seizure of too much electronic data, I include a rather long but interesting part of this here -
 Mr Knowles’ .. next complaint is that the search was rendered unlawful by the seizure of a large quantity of material which fell outside the terms of the warrant. . it is said, ‘thousands of clients’ files were seized’. ..For the purposes of this judgment I accept that the images incorporated a vast number of documents relating to the firm’s clients, and held by it subject to a duty of confidence, ..
 Mr Coppel, ..Thus a hard disk may be seized and removed pursuant to the power to seize and remove documents to be found in paragraph 10(3)(b) of Sch 11 provided that it contains material which the searching officer at the time of the search has reasonable cause to believe might be required as evidence in relation to the suspected offence or offences, .. The officer is not required to extract from the hard disk just the information he believes may be required, nor is it practicable for him to do so. … ..
30. Mr Newman criticised Kennedy LJ’s comparison of the computers with a leather bound ledger. He said that unlike such a ledger, a computer contains distinct files, each of which may be separately accessed, copied or printed. He submitted that the more accurate comparison is with a filing cabinet. Provisions such as section 20C of the TMA do not justify the seizure and removal of an entire filing cabinet that includes irrelevant and non-incriminating material the officers conducting the search are restricted to seizing incriminating material only. …..
32. Consideration of these submissions involves consideration of the nature of a computer and of the data and documents stored on it. ..
33. The data on the hard disk is stored in magnetic form. Although the data may be regarded for some purposes as contained in separate files, they are all stored on the same physical object, namely the hard disk. Files may be copied to a floppy disk or other storage medium. They may be removed from the hard disk by a “cut and paste” onto another storage device, but this process alters accessibility to the data on the hard disk; which, if not obliterated becomes non-referenced data as described in the next paragraph. Files cannot be removed from the hard disk physically.
34. Furthermore, the data on the hard disk includes data, referred to as non-referenced data, that is not accessible or indeed visible with ordinary software. For present purposes, non-referenced data may be regarded as data originally in a file, or part of a file, that has been deleted. Deletion of a file normally does not remove from the hard disk all of the data of the file the effect of deletion is that the file ceases to exist for the purposes of (i.e. is not visible to or accessible by) the operating system of the computer. The data on the deleted file may remain on the hard disk, and may be recovered with the use of suitable software.
35. There may also be embedded data on the hard disk. Embedded data is described ..as follows
“(3) Embedded Data
36. There may also be distributed data ..
Lastly, there may be encrypted data on the disk. ..
37. These facts show that the comparison of a hard disk with a filing cabinet is inexact and may be misleading. For some purposes no doubt the files on a hard disk may be regarded as separate documents. But a hard disk cannot be regarded as simply a container of the files visible to the computer’s operating system. It is a single object a single thing. I see no basis, therefore, for a computer not being considered a “thing” within the meaning of section 20C(3)(b) of the TMA. If there is incriminating (in the normal sense of the word) material on the hard disk, and if it is assumed that the hard disk is not copied, the computer itself may be used, and may be required, as evidence in order to prove the existence of the incriminating material on the defendant’s computer. The fact that there is also on the hard disk material that is irrelevant, and not evidence of anything, does not make the computer any less of a thing that may be required as evidence for the purposes of criminal proceedings.
39. For these reasons, even if I were free to do so, I would not differ from the conclusion reached by the Divisional Court in Da Costa. In any event, I do not think that Da Costa is distinguishable. While it is true that for the purposes of VATA a hard disk is a “document”, it is equally a “thing”, and in my judgment would be subject to the power of seizure in paragraph 10(3) of Schedule 11 to that Act even without the extended definition of “document”. Bramley is distinguishable to the extent that it concerned computers, it concerned the problem that arises when the information on a computer includes material that is subject to legal professional privilege. That circumstance raises different issues that I do not have to address. I think it unlikely that when he gave judgment in Da Costa Kennedy LJ had forgotten his own judgment in Bramley. It is far more likely that he did not refer to it because he considered it to be irrelevant to the different issues in the later case.
40. It follows that I disagree with the view taken, following Bramley, that that part of the judgment relating to paper documents was applicable to material stored on a computer. In my judgment, if an Inland Revenue officer who enters into premises under the authority of a warrant under section 20C finds a computer, and he has reasonable cause to believe that the data on the computer’s hard disk may be required as evidence for the purpose of relevant proceedings, he may seize and remove that computer even though it also contains irrelevant material. The officer should then make a copy of the hard disk (i.e. cause the hard disk to be imaged); when that has been done, the computer must be returned pursuant to section 20CC(3). In coming to this conclusion, I take into account the need to interpret powers of search and seizure restrictively, for the reasons set out by Kennedy LJ in his judgment in Bramley. In my judgment, the provisions of section 20C are clear and in cases in which no question of legal professional privilege arises are capable of being operated in a practical manner in relation to computers.
Following the Bramley case mentioned earlier S 50 & 51 of the Criminal Justice and Police Act 2001 introduced the concept of search and sift which some police forces have applied to differing degrees in respect of digital evidence.
Super ! thanks for the detailed reply. Sorry for my delay in getting back to you but I was away on personal business for several days.
What you have summarized above, is what I thought was the case with respect to the current state of case law and the literature out there. Aside from the case which you have quoted for us, I am not aware of many cases which address this issue specifically (at least in the criminal law realm).
thanks for your time and expertise.