About | HeinOnline Law Journal Library | HeinOnline Law Journal Library | HeinOnline

119 Harv. L. Rev. F. 38 (2005-2006)
Fourth Amendment Search and the Power of the Hash

handle is hein.journals/forharoc119 and id is 45 raw text is: FOURTH AMENDMENT SEARCH AND
Richard P. Salgado*
Replying to Orin S. Kerr, Searches and Seizures in a Digital World, ing
HARV. L. REV. 53I (2005).
Hashing is a powerful and pervasive technique used in nearly
every examination of seized digital media. The concept behind hash-
ing is quite elegant: take a large amount of data, such as a file or all
the bits on a hard drive, and use a complex mathematical algorithm to
generate a relatively compact numerical identifier (the hash value)
unique to that data. Examiners use hash values throughout the foren-
sics process, from acquiring the data, through analysis, and even into
legal proceedings. Hash algorithms are used to confirm that when a
copy of data is made, the original is unaltered and the copy is identi-
cal, bit-for-bit. That is, hashing is employed to confirm that data
analysis does not alter the evidence itself. Examiners also use hash
values to weed out files that are of no interest in the investigation,
such as operating system files, and to identify files of particular
It is clear that hashing has become an important fixture in forensic
examinations. What is not clear is whether the use of hashing impli-
cates the Fourth Amendment, and if so, how. Is there a search when
an examiner simply calculates the hash value of a hard drive in the
data duplication process? Is there any Fourth Amendment moment if
an examiner uses hashing to identify files on the media that are of in-
terest but that are not within the scope of the search warrant or au-
thority? What if those files constitute digital contraband? Does hash-
based examination for child pornography fall outside the Fourth
Amendment, allowing investigators throughout the country to look for
child pornography on any seized electronic storage device, regardless
of the nature of the investigation, without a warrant?
This Reply examines those questions within the framework of Pro-
fessor Kerr's exposure theory of search. I conclude that when used
as part of the imaging process, hashing reveals no meaningful hints as
* Lecturer in Law, Stanford Law School; Certified Instructor, SANS Institute; Member,
Board of Directors, Honeynet Project; Senior Legal Director, Yahoo!, Inc. (The statements ex-
pressed herein should not be taken as a position or endorsement of Yahoo!, Inc. or its subsidiaries
and may not reflect the opinion of their affiliates, joint ventures, or partners). Thanks to Kyle
French for his thoughtful insights.


What Is HeinOnline?

HeinOnline is a subscription-based resource containing thousands of academic and legal journals from inception; complete coverage of government documents such as U.S. Statutes at Large, U.S. Code, Federal Register, Code of Federal Regulations, U.S. Reports, and much more. Documents are image-based, fully searchable PDFs with the authority of print combined with the accessibility of a user-friendly and powerful database. For more information, request a quote or trial for your organization below.

Short-term subscription options include 24 hours, 48 hours, or 1 week to HeinOnline.

Contact us for annual subscription options:

Already a HeinOnline Subscriber?

profiles profiles most