Harvard Law Review
Gannett House
1511 Massachusetts Ave
Cambridge, MA 02138
Editorial Office:
617-495-7889
617-496-5053 (fax)
Business Office:
617-495-4650
617-495-2748 (fax)
|
|
|
| Hashing is a powerful and pervasive technique used in nearly
every examination of seized digital media. The concept behind hashing is quite elegant: take a large amount of data, such as a file or all
the bits on a hard drive, and use a complex mathematical algorithm to generate a relatively compact numerical identifier (the hash value)
unique to that data. Examiners use hash values throughout the forensics process, from acquiring the data, through analysis, and even into
legal proceedings. Hash algorithms are used to confirm that when a copy of data is made, the original is unaltered and the copy is identical,
bit-for-bit. That is, hashing is employed to confirm that data analysis does not alter the evidence itself. Examiners also use hash
values to weed out files that are of no interest in the investigation, such as operating system files, and to identify files of particular
interest.
|
| It is clear that hashing has become an important fixture in forensic
examinations. What is not clear is whether the use of hashing implicates the Fourth Amendment, and if so, how. Is there a search when
an examiner simply calculates the hash value of a hard drive in the data duplication process? Is there any Fourth Amendment moment if
an examiner uses hashing to identify files on the media that are of interest but that are not within the scope of the search warrant or authority?
What if those files constitute digital contraband? Does hashbased examination for child pornography fall outside the Fourth
Amendment, allowing investigators throughout the country to look for child pornography on any seized electronic storage device, regardless
of the nature of the investigation, without a warrant?
|
| This Reply examines those questions within the framework of Professor
Kerr’s “exposure” theory of search. I conclude that when used as part of the imaging process, hashing reveals no meaningful hints as
to the contents of the imaged media and thus is not a “search” for the purposes of the Fourth Amendment. I also conclude that in the analysis
process, the use of hashing to find only files that constitute contraband does not constitute a Fourth Amendment search under the rulings
of United States v. Place, United States v. Jacobsen, and Illinois v. Caballes. There are important differences between the type of contraband
in those cases — narcotics — and digital contraband that may make the discussion somewhat academic, at least at this juncture.
[ More ] |
Suggested citation: Richard P. Salgado, Fourth Amendment Search and the Power of the Hash, 119 Harv. L. Rev. F. 38 (2006), http://www.harvardlawreview.org/forum/issues/119/dec05/salgado.pdf
|
© 2005 The Harvard Law Review Association
webmaster@harvardlawreview.org
|
|
