Here is an interesting legal question for readers interested in the Fourth Amendment. It involves a fact pattern that has started to come up quite often in the last year or two, but that no court has yet addressed. It's pretty puzzling, too, and it has lots of police officers and prosecutors unsure of what to do. I'd be interested in readers' thoughts on it. (Warning: Long and rather technical post ahead.)

  Here's the problem. Imagine that the police believe that there is evidence of crime on a suspect's computer, but they lack probable cause to obtain a warrant to search it. The police ask the suspect if he will consent to allow the police to search the computer for evidence. The suspect agrees, and gives the police his computer to be searched. A few days later, the suspect talks to an attorney and the attorney advises the suspect to revoke his consent and demand the return of the property. The lawyer (or the suspect) calls the police and withdraws consent to search the computer.

  In cases of traditional physical evidence, the law here is very clear. The basic Fourth Amendment rule is that the police can conduct a search if someone with common authority over the computer consented, but that they have to stop their search if and when the consent is revoked. Given that rule, it's clear that any search of the defendant's actual computer would have to stop when the suspect withdraws his consent.

  But here's the twist. It turns out that the first step a computer forensic analyst takes when seeking to retrieve evidence from a hard drive is to create a "bitstream copy" or "image" of the computer hard drive. The "image" is an exact copy of the hard drive that copies every one and zero on the drive. It is created for reasons of evidentiary integrity; searching a computer drive can alter the data it contains, so analysts copy the originial and do all of the analysis on the image copy. After the drive has been imaged, there are two copies of the data, not one: one copy of data on the defendant's property and another copy on the government's machine.

  Now, back to our hypothetical. It turns out that a suspect often withdraws his consent after the computer has been imaged, but before government has begun to search the image. (This is common because imaging can be done in a few hours, but most government forensic labs have long waiting lists for the actual analysis.) So here's the big question: When the suspect withdraws his consent, does the withdrawal of consent also apply to the image? Can the police search the imaged copy, or will searching the imaged copy without a warrant violate the Fourth Amendment? In doctrinal terms, does a defendant retain a legitimate expectation of privacy in the image, and if so, does his common authority to regulate consent to search the original apply equally or differently to the copy?

  I think there are two ways of looking at the problem. On one hand, you could say that the image is like a photograph taken during a search. The image is the government's own copy of what the government software "saw" when it looked through the suspect's computer. In that case, you might say that the image belongs to the government, and the suspect can no longer withdraw his consent to the search. Having obtained the initial consent to search the computer, they can search the image after consent has been revoked.

  On the other hand, you could say that the image is actually just as private as the original version of the data. What matters is the data, and it makes no sense to say that the government has "seen" the data when no search has actually occurred. The imaging software copied the private file but never exposed the data, and the copy is no different from the original. In that case, all of the data continues to belong to the suspect, and the defendant's withdrawal of consent applies equally to the original hardware and the image.

  So which is right? For reasons I explain in this forthcoming article (see section II), I think the latter view is probably right. The right to search the image should track the right to search the original, and a withdrawal of consent to search the latter should also apply to the former. Still, it's a pretty difficult question, as the answer hinges on how you address all sorts of tricky questions concerning what it means to search and seize digital evidence. One interesting variable: does the answer depend on the exact language of the consent agreement? I can imagine a court saying that a defendant's withdrawal of consent is binding on a search of the image if the defendant agreed generally to allow the government to search his computer, but that the withdrawal is not binding on the search of the image if the defendant agreed specifically to allow the government to create an image. On the flip side, if I were a defense attorney in a case raising such issues I would argue that the imaging itself is beyond the scope of the consent, and thus any data from the image must be suppressed.

  I have enabled comments. As I noted above, this issue has begun to come up a lot recently, and it's only a matter of time before the courts start confronting it.