Rookhuyzen prepared a seven-page affidavit in support of his warrant application. The Court of Appeals summarized the affidavit's contents, which recounted Rookhuyzen's interactions with defendant and observations of the home:
"At the beginning of the interview, Rookhuyzen noted that defendant was 'non-emotive'-which, in Rookhuyzen's training and experience, was 'highly unusual' in such circumstances because '[p]arents are usually crying, sobbing, and exhibiting signs of sadness or anxiety.' Defendant told Rookhuyzen that he had been home alone with B and his twin brother, while his wife was working. According to defendant, as he had been feeding B a mixture of formula and liquid vitamins, the mixture had started to come out of the baby's nose and the baby had started coughing, so defendant had turned him over, shaken him, and 'smacked' him on the back. The baby's eyes became 'fixed' and 'droopy,' and his breathing became 'very much labored.' Defendant told Rookhuyzen that he then shook B more, and the baby began going 'a minute or two between breaths.'
"Defendant did not call 9-1-1 at that point. Instead, he told Rookhuyzen, he 'went online' on a computer in the baby's room to conduct research about what he should do. When, after 15 minutes, the baby's condition did not improve, defendant called 9-1-1.
"Defendant did not call his wife during that period-and, indeed, had not attempted to contact her by the time Rookhuyzen began to interview him. In Rookhuyzen's experience, that was 'extremely unusual': '[W]ith these kind of incidents, spouses want to call each other instantly, even before speaking with law enforcement.'
"Rookhuyzen's affidavit further recounted that, at the hospital, B was examined by a pediatrician, Dr. Lindsay, who determined that the baby had no brain activity and **190would die soon. Lindsay further determined, inter alia , that the baby had experienced head trauma resulting in a skull fracture, bi-lateral retinal hemorrhages, and an 'old rib fracture.' In Lindsay's opinion, defendant's account was not consistent with the baby's condition, and he ultimately rendered a diagnosis of 'shaken baby syndrome ' as a result of intentionally inflicted abuse.
"*** Further, as specifically pertinent to the lawfulness of the seizure and search of defendant's computers, the affidavit included the following averment:
" 'I know based upon my training and experience that computers can be connected to the internet to find information using computer software that browse internet sites for information. Internet search engine sites such as Google and Yahoo! are often used to search the internet for information related to a user's requests. I know that the computer will retain a history of internet sites visited and the search terms used on the internet. I know that to retain the integrity of a computer's memory and how the system was used, the computer needs to be searched in a laboratory and carefully examined by a trained computer forensic examiner in order to ensure that the data is not corrupted, damaged, or otherwise changed from the time when the machine was seized. [Defendant] told me that he searched the internet between the time he noticed [B] was *328having difficulty breathing and the time he called emergency dispatch. He told me that he was using a computer to search the internet for advice on what he should do. When I was in the residence, I saw two laptop computers and two desktop computers. [Defendant] did not specify which computer he was using just before he called 9-1-1.'
"The affidavit also included a detailed description of defendant's residence. Finally, in a section titled 'Conclusion,' the affidavit stated Rookhuyzen's belief that there was probable cause to seize and search 11 types of evidence, including '[t]wo laptop computers in the residence' and '[t]wo desktop computer towers located in the office/baby room.' "
Mansor ,
A circuit court judge signed the search warrant that evening. The search warrant instructed executing **191officers to "seize and search and forensically examine the following objects: See attachment A." (Emphasis omitted.) Attachment A was captioned "items to be searched for, to be seized, and to be analyzed." It repeated verbatim the list of eleven items included in Rookhuyzen's affidavit, including "[t]wo laptop computers" and "[t]wo desktop computer towers." The warrant itself contained no instructions or limitations regarding how the computers were to be analyzed.
The warrant was executed that night. Two laptop computers, two desktop computers, and other items from B's room were seized. The computers were taken to the Northwest Regional Computer Forensics Laboratory, operated by the FBI, which performed the forensic analysis. The lab's report summarized the request:
"[Rookhuyzen] requested that the [seized computer drives] be examined for internet history and internet search terms input by the user on [June 12] especially from 2pm onward. Per a discussion with Det. Rookhuyzen, the suspect searched the internet 15 minutes prior to calling 9-1-1 in regards to his 11-week old child suffering injuries. Suspect claimed that the internet searches were regarding how to aid an injured infant. Pertinent examination results should be regarding child abuse and a possible history thereof."
When Rookhuyzen made the initial request to the lab, he provided a list of 19 search terms. A week later, another detective, Hays, added eight more search terms.
The scope of the analysis of the computers expanded further. The report noted that about a month after the initial request, a detective directed that the search of the computer be expanded to include email, although no relevant emails were ultimately located. The forensic examiners also included in the report search terms that were not provided by the detectives, but that, in their opinion, "yielded possibly pertinent results."
The report also summarized the lab's methods and findings. For each computer and laptop, the storage media were removed and imaged.
The internet history dataset was compiled into a large spreadsheet containing over 360,000 records dating back to 2005-six years before B was born. Net Analysis allowed the forensic examiner to search for text in any of the **193websites visited and to organize the internet history records by date and time. In addition to a printed summary of its findings, the lab provided detectives with a DVD containing that dataset and several lengthy reports on specific searches requested by detectives. For example, one report listed all web URLs visited on the date of the 9-1-1 call, beginning with a visit to Netflix nine seconds after midnight and continuing until that afternoon. That report is 630 pages long. Another report that listed results for the search term "abuse" was 101 pages long, and contained URLs dating from a 16 month period as well as many other URLs not associated with a date and time. The lab also provided reports for the search terms that "originated during the examination" as yielding "possibly pertinent results," listed above. Similarly, the DVD contained files that were not internet history, but that the forensic examiner believed might be relevant, such as a Microsoft Word document containing a narrative description of the child's birth, photos of B, and a downloaded computer game that allowed the user to simulate child abuse.
Before trial, defendant moved to suppress the evidence discovered on the computers, arguing that the warrant was "worded so broadly as to constitute a general warrant." Defendant suggested that "search protocols" should have been included in the warrant to restrict the potentially unlimited search of the computer hard drives. A search protocol, for example, could limit the search to specific files or types of data on the computer-such as emails, internet searches, or photographs-or to search terms used in an internet browser. See United States v. Comprehensive Drug Testing, Inc. ,
The trial court denied the motion in a written opinion. The trial court first noted that defendant had conceded that the search warrant properly permitted law enforcement officials to search the computers for the June 12 internet search history. The court then rejected defendant's argument that the lack of search protocols in the warrant rendered the warrant unconstitutional, noting that the majority view is that such protocols are not constitutionally required. The court found that the affidavit did not provide **194probable cause to search the computer for evidence of any crimes other than those related to B's injuries on June 12. Nevertheless, and apparently relying on the "traditional rules for the plain view exception," the court concluded that "all evidence obtained through the execution of the warrant [was] admissible."
The evidence gathered from defendant's computer was undoubtedly helpful to the state's case. In the state's closing argument, the prosecutor called internet search history "a looking glass" into a person's character and "a record **195of what's going on in [defendant's] head." The prosecutor recited strings of sequential search terms to the jury, such as those quoted above, and used those to speculate about defendant's thought process. Defendant's ex-wife and B's mother also relied on the internet history to understand what had happened. She said that in the first two weeks after B's death, she supported defendant because she couldn't believe that he would hurt B. But "[w]hen the evidence came to light about [defendant's] computer searches, I stopped supporting him."
The state charged defendant with six counts relating to three discrete incidents of abuse against B and B's twin in the weeks before B's death, and four counts relating to the incident that caused B's death. After an eleven day trial, the jury convicted defendant of all charged counts: murder, assault in the first degree, three counts of assault in the third degree, and three counts of criminal mistreatment in the first degree.
On appeal, defendant challenged the warrant as facially invalid because it failed to satisfy the particularity requirement of Article I, section 9, of the Oregon Constitution. Defendant also asserted that, to determine whether the warrant was valid, the court should look at the warrant alone and not consider information contained in the affidavit that supported the warrant application.
The Court of Appeals first addressed whether its review of the warrant was limited to the face of the warrant or whether it also could look at the affidavit. Mansor ,
**196But on the broader issue of the warrant's validity, the court held that, even considering the information in the affidavit as well as the warrant, the warrant was unconstitutionally overbroad in authorizing the forensic *331examination of defendant's computers. It recognized that the case presented a question of first impression and reviewed decisions from other courts, some of which invalidated computer search warrants for failing to meet particularity requirements. It quoted with approval Wheeler v. State ,
"for purposes of the constitutional particularity requirement, personal electronic devices are more akin to the 'place' to be searched than to the 'thing' to be seized and examined. Concomitantly, that requires that the search of that 'place' be limited to the 'thing(s)'-the digital data-for which there is probable cause to search."
Id . at 801,
The court then applied that rule. It read the warrant and affidavit as establishing probable cause
"with respect to internet searches during the 15-minute period preceding the 9-1-1 call-and, arguably, with respect to all electronic communications and photos during the entire time that B was in defendant's care on June 12, 2011. However, nothing in Rookhuyzen's affidavit established probable cause that a temporally unlimited examination of the contents of defendant's computers, including of files and functions unrelated to internet searches and emails, would yield other evidence of the events of June 12, 2011."
**197II. THE DIGITAL CONTEXT
Before addressing the parties' legal arguments, it is helpful to identify some of the ways that digital data, whether stored on a computer or other digital device, differs from physical evidence. First, raw digital data-the 1s and 0s that make up binary signals-must be processed and displayed by intermediating programs and hardware to be meaningful. A user may conceive of the information on her computer as being "files," organized into "folders" that are stored in various locations on the computer and accessed through particular software programs. But a computer forensic examiner views the same data differently. As demonstrated by the facts of this case, a category of information that is a likely source of evidence-say, the internet search history on a given computer-may be composed of many types of data and files, and the physical locations of data on a computer hard drive and even the software's organization of those data and files may be unrelated to the user's perception of how their data is organized. See Josh Goldfoot, The Physical Computer and the Fourth Amendment , 16 Berkeley J. Crim. L. 112, 128 (2011) (explaining that "files do not correspond to organizational choices made by computer users").
Similarly, some data on a computer may not be in the form of "files." For example, when a user deletes a file, fragments of the file's raw data often continue to exist on the hard drive. A forensic examiner may be able to reconstitute a new file from that residual data that can then be read by a program. That concept-that digital information is perceived in fundamentally different ways by users than by forensic examiners-means that a user's honest statements about a file, such as "it's in the 'My Documents' folder," "that document is gone, I didn't save it," or "no one can use my computer without my password," may not be "true" to a forensic *332examiner.
For those reasons, commentators and courts sometimes refer to searches of computers in a criminal investigation as involving "two basic steps: the data acquisition phase and the data reduction phase." Kerr,
*333In the data reduction phase, there is an examination ("search") of the digital data, this time by a forensic examiner, to identify the particular data that may be useful as evidence. Using the familiar analogy of searching for a needle in a haystack, "data acquisition refers to collecting the hay, and data reduction involves looking through the haystack for the needle." Kerr,
Finally, the novel nature of digital devices has led courts to apply search and seizure principles to those devices in a manner somewhat different from other physical evidence. The Supreme Court addressed some of those issues in Riley v. California , --- U.S. ----,
In Riley, the Court considered a petitioner's post-conviction challenge to the warrantless search of his "smart phone" that police officers found in his pocket at the time of his arrest following a traffic stop and that they later examined at the police station.
The Court rejected that argument:
"That is like saying a ride on horseback is materially indistinguishable from a flight to the moon. * * * Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse. A conclusion that inspecting the contents of an arrestee's pockets works no substantial additional intrusion on privacy beyond the arrest itself may make sense as applied to physical items, but any extension of that reasoning to digital data has to rest on its own bottom."
The Court noted that the "immense storage capacity" of cell phones means that the physical limitation on the amount of information a person could carry no longer applied.
"[A] cell phone search would typically expose to the government far more than the most exhaustive search of a house: A phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form-unless the phone is."
The Court explained that the development of the cell phone had undermined assumptions supporting the incident to arrest exception to the warrant requirement; with a cell phone, an arrestee could be carrying the equivalent of all the information in his house, or more. Therefore, the Court held that the exception could not be used to justify the search of cell phones, and it instead directed officers seeking to examine the contents of a cell phone to "get a warrant."
In this case, of course, the officers had a warrant, and we return to the facts here and the question of the validity of the warrant and the search of defendant's computer.
III. MAY THE AFFIDAVIT BE CONSIDERED WITH THE WARRANT?
We first address the issue of whether the information contained in Rookhuyzen's affidavit is properly considered part of the warrant itself. In the Court of Appeals, the state asserted that the affidavit was "attached to and referenced by" the warrant and, as a result, the court should consider the contents of the affidavit as part of the warrant in deciding defendant's challenge to the warrant's facial validity. In his response, defendant agreed that an affidavit may be considered part of the warrant if it physically accompanies the warrant and the warrant *335explicitly incorporates it by reference; however, defendant disputed that the state had established that the warrant here met those requirements, and, therefore, he claimed that the contents of the affidavit should not be considered.
The Court of Appeals observed that, when a search is conducted pursuant to a warrant, the defendant bears "the burden of establishing facts pertaining to his 'challenge [to] the validity of the warrant itself.' " Mansor ,
We agree with the Court of Appeals that defendant failed in the trial court to establish the factual basis for his argument on appeal; for purposes of this case, we consider the text of the affidavit to be part of the warrant. That said, we note that parties may spend substantial time litigating whether the contents of an affidavit should be considered in a challenge to a warrant. See LaFave, 2 Search and Seizure § 4.6(1) at 778 (noting a "great variety of viewpoints" on the issue). In our view, rather than relying on indirect inferences to establish a connection between the warrant and an affidavit, the better practice is for the warrant to include specific text from the affidavit or to incorporate the affidavit by express reference in the warrant. Merely attaching the affidavit or an exhibit with an attached affidavit to the warrant, without some textual reference, creates the ambiguous situation apparently present here. Moreover, as we discuss in greater detail below, in order to guide the persons conducting the forensic examination of a properly seized computer, the warrant itself should describe, with as much specificity as reasonably possible, the category or categories of information to be searched for on the computer, including, if available and relevant, the time period when the information was created, accessed, or otherwise used. That description, of course, must be based on affidavits or other record evidence that establishes probable cause to search the computer for such information.
Because we have concluded that the affidavit should be considered as part of the warrant in this case, it follows that the contents of the affidavit assist us in determining the scope of the search that the warrant permitted. The warrant itself authorized police to "seize and search and forensically examine" certain items listed in an attachment, and the listed items included defendant's computers. The affidavit also referred to, and sought authority to search for and seize, those items, and an exhibit to the affidavit refers to "items to be searched for, to be seized, and to be analyzed." The only reference in the affidavit to relevant information that Rookhuyzen believed was on the computer was the paragraph set out above,
*336IV. IS THE WARRANT VALID?
A. Search and Seizure Principles and History
This case raises questions under Article I, section 9, of the specificity with which a warrant must describe the digital information that the state seeks, the search that the state may conduct, and the evidence that the state may use when police have probable cause to believe that a computer contains information related to a crime. Those questions implicate fundamental issues of personal privacy and the state's responsibility to prosecute crime in the novel and rapidly evolving context of digital evidence. Although this court previously has addressed the application of Article I, section 9, to some types of electronic evidence, we have not yet considered the application of the constitutional principles to the unique characteristics of a personal computer.
To do so, "we consider the 'specific wording of Article I, section 9, the case law surrounding it, and the historical circumstances that led to its creation.' " State v. Carter ,
Article I, section 9, of the Oregon Constitution provides:
"No law shall violate the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable search, or seizure; and no warrant shall issue but upon probable cause, supported by oath, or affirmation, and particularly describing the place to be searched, and the person or thing to be seized."
Using that text as a starting point, we review this court's Article I, section 9, case law and our earlier discussions of historical circumstances. We consider whether the unique characteristics of computers make them unlike other "things" that may be seized. Then we determine what it means to "particularly describ[e] *** [the] thing to be seized" in the warrant, when that "thing" is information on a computer. Finally, we apply the results of our discussion to the facts of this case.
The text and principles of Article I, section 9, can be traced directly to the Fourth Amendment to the United States Constitution, and from there to state constitutional documents dating to the American Revolution. See State v. Bridewell ,
As we have previously explained, "[t]he privacy interests protected from unreasonable searches under Article I, section 9, are defined by an objective test of whether the government's conduct 'would significantly impair an individual's interest in freedom from scrutiny, i.e. , his privacy.' " State v. Wacker ,
B. Search for and Seizure of Computers
1. Seizure of the computers
We begin by considering briefly the search for and seizure of defendant's computers themselves. Although defendant's motion to suppress challenged the seizure of the computers as well as the forensic examination of the computers for evidence and the use of that evidence at trial, defendant no longer argues that the seizure of the physical computers violated Article I, section 9. That argument would fail in any event. The warrant recounted defendant's statements to Rookhuyzen about his internet searches, identified two laptop computers and two desktop computer towers in the apartment, and included statements by Rookhuyzen about how internet search engines are used to seek information (as defendant stated that he had done when B was not breathing) and about the need to have an examination conducted by a trained computer forensic examiner. The warrant was sufficiently particular in its description of the computers to be seized and the grounds for believing that evidence related to the criminal investigation was likely to be found on one or more of them to meet the particularity requirement of Article I, section 9, with respect to the seizure of the computers.
2. Search of a lawfully seized computer
The more difficult issue is whether the warrant's authorization of lawful seizure of the computers similarly authorized the state to conduct a search of the computers to locate and seize information or data on the computers for evidence of a crime. The principles underlying Article I, section 9, establish that an individual generally has a privacy interest in the information on his or her personal computer. A computer often is either located in a private space, such as a home, or secured by a password or biometric identification, or both. Those "barriers to public entry" are the sort contemplated in Smith ,
We agree with defendant and the Court of Appeals that the state's argument is not well taken. For reasons that we will explain, the fact that police have a warrant, based on probable cause, to search for and seize "things," including computers, does not necessarily mean that they may conduct a comprehensive forensic examination of a computer that they seize, and then use at trial anything they find on the computer, without limit.
As noted, the state accepts that individuals have a protected privacy interest in their computers and the information on them. The state's legal argument, however, fails to account for the fact that, unlike most other "things" that may be seized in a search, a computer or other digital device is a repository with a historically unprecedented capacity to collect and store a diverse and vast array of personal information. Moreover, that information is stored in a manner that ordinarily makes it inaccessible to others. We discussed in detail above the reasons that *338computers and digital devices are different from most other "things" that can be seized in the course of criminal investigations and the Supreme Court's recognition in Riley that different search and seizure rules apply to those devices than to other "things." Indeed, the state's argument here is similar to the argument that the government made in Riley and that the Supreme Court rejected: If the item (the phone or computer) is lawfully seized, then any information that can be discovered within the item also is legitimately seized and can be used at trial. Although Riley involved a warrantless search incident to arrest and this case involves a computer seized pursuant to a warrant, defendant urges us to follow the Court's approach in Riley and hold that computers deserve more protection than other "things" under Article I, section 9.
The state argues that this court has previously held that an individual retains no privacy interest in storage media that is lawfully in the possession of the police. In State v. Munro ,
The state erroneously assumes, however, that the videotape in Munro is analogous to a computer or a cell phone. Of the unique characteristics of the cell phone described in Riley -such as containing many types of information, having immense storage capacity, and playing a role in many aspects of life-a videotape has none. In contrast with a cell phone, which continually creates and stores data as it is used, the only possible "search" of a videotape is for the police to view the tape as it was recorded. Munro held only that a single analog videotape is a "thing" for purposes of search and seizure analysis, and once it was seized pursuant to a valid warrant, the owner lost all privacy interest in it. That holding does not assist the state here.
Further, the state's semantic observation that a computer is literally a "thing" is a truism that does not compel a legal conclusion. And the state provides no persuasive rejoinder to the Court's description in Riley of the technological changes that led the Court to exempt cell phones from the "search incident to arrest" doctrine. The data contained on a personal computer is qualitatively and quantitatively different from the sort of information that could be found in other single objects, or even an entire house not containing digital data. See Riley ,
We observe at this point that the state does not rely on the plain view doctrine-or any other exception to the warrant requirement-to justify the seizure and use at trial of information from defendant's computer; instead, its remaining arguments, *339which we discuss in detail below, turn on the scope of the warrant. The plain view doctrine permits police to seize evidence without a warrant if they are in a place where they have a right to be and have probable cause to believe that the evidence that they see in "plain view" is contraband or evidence of a crime. Carter,
We recognize that some of the legal conclusions that we reach in this case likely would have implications for a plain view argument, if raised in a computer search case. However, as noted, the state does not rely on that doctrine here and neither party has briefed the issue; in these circumstances, further discussion regarding the application vel non of that doctrine to computer searches should await a future case.
3. The particularity requirement as applied to computer searches
Our conclusion that the lawful seizure of defendant's computer does not, by itself, permit the state to analyze and use all of the information found on the computer leaves us with the task of considering the scope of the warrant and defendant's argument that the warrant was impermissibly overbroad. That task requires us to apply the particularity requirement of Article I, section 9, to the search of the computer's contents. We sketch the particularity requirement as set out in our prior cases, and then discuss that standard as it applies here.
A search warrant must "particularly describ[e] the place to be searched, and the person or thing to be seized." Or. Const., Art. I, § 9. Regarding places, the particularity requirement exists to "narrow the scope of the search to those premises for which a magistrate has found probable cause to authorize the search." State v. Trax ,
Our cases have identified two related, but distinct, concepts that inform the particularity analysis-specificity and overbreadth. See Mansor ,
*340Blackburn/Barber ,
The state argues that a warrant is sufficiently specific and not overbroad-and therefore satisfies the particularity requirement-if the warrant identifies the crime being investigated. It asserts that the warrant here met that requirement because it referred to the crimes under investigation at the time the warrant was issued-criminal mistreatment and assault. Defendant responds that, for purposes of the search of a computer, the particularity requirement means that the warrant must identify (1) "a specific file or type of evidence supported by probable cause," (2) "a specific location on [the] computer," and (3) a specific time period, consistent with the probable cause justifying the warrant-essentially, the "what," the "where," and the "when" of the data or information that police have probable cause to search for on the computer.
Turning first to the state's argument that the warrant here was sufficiently particular because it authorized the search of the computer for "evidence of a particular crime," we disagree. The state suggests that we previously held in State v. Farrar ,
Farrar thus did not turn on the fact that the warrants at issue there identified a particular crime. Rather, that decision was based on the court's determinations, first, that seizing the numerous specific physical items identified in the warrants (as to which there was probable cause) was permissible, and, second, that seizing other physical items related to the charged crime that officers might find in plain view as they conducted the warranted searches was permissible under the catch-all provision codified in former ORS 133.585 (1990). Farrar was a case-specific application of a statute (later repealed) and essentially upheld a search based on probable cause as described in a detailed affidavit and warrants. This court's statements in Farrar, quoted above, are not a blanket endorsement of nonspecific terms in search warrants and provide no support for the state's proposed rule that merely identifying the crime under investigation provides sufficient particularity to search the entire contents of a lawfully seized computer.
Defendant's proposed rules for determining when a search warrant for a computer is sufficiently particular are closer to the mark, although not without their own difficulties, which arise primarily because the particularity requirement developed in a world of physical evidence rather than in the digital context described above. We discuss that context and the Delaware Supreme Court's decision *341in Wheeler, and then evaluate defendant's argument that to meet the particularity requirement of Article I, section 9, a warrant to search a computer must identify the "what," the "where," and the "when" of the evidence that police seek.
The unique characteristics of computers, outlined above, have implications for the application of the particularity requirement as it applies to computer searches. In the physical world, "different spatial regions are used for different purposes," which allows police and courts to make probable cause determinations "as to where evidence may or may not be found." Orin S. Kerr, Digital Evidence and the New Criminal Procedure ,
In Wheeler , the Delaware Supreme Court reversed convictions for possession of digital child pornography because the material was found pursuant to an unconstitutionally overbroad warrant. The warrant authorized an unrestricted search of a defendant's computer and other digital equipment as part of an investigation into the defendant's alleged witness tampering.
In holding that the first warrant was not sufficiently particular, the court stated that the warrant, by purporting to authorize an unlimited examination of the defendant's digital media, paved the way for "unconstitutional exploratory rummaging."
We return to the components of defendant's proposed rule. Following Wheeler -and, indeed, general principles of search and seizure law-we agree that to satisfy the particularity requirement, a warrant must describe, with as much specificity as reasonably possible under the circumstances, what investigating officers believe will be found on the electronic devices. See
Defendant also argues that, to be sufficiently particular, a warrant authorizing a computer search must identify "where" the search may be conducted on the computer. Defendant contends that any search must be limited to "the place or specific location in the computer where the evidence is likely to be found without much effort or rummaging-in this case, defendant's 'internet browsing history.' " Defendant suggests that locations on a computer hard drive are like rooms in a house, and that the warrant must limit the search to specified rooms, such as "internet browsing history, document files, hard drive, emails, call logs, and varying application folders." We disagree.
It is certainly true that many warrants authorizing computer searches will identify commonly used software programs-email clients, internet browsers, document management tools-where relevant evidence is likely to be found. For the practical reasons explained above, however, a search warrant may be sufficiently particular without being limited to searching in those "places." Imposing such limits on a computer search would require police and the reviewing magistrate to know the technological specifications, including the configuration of the operating system and applications software on a computer, before a warrant could be obtained. Limiting a search to certain "places" on a computer, defined in terms of the computer's internal organization, such as the "My Documents" folder, is an ex ante limitation on the search. Such ex ante limitations would require a valid warrant to be based on more detailed knowledge of a specific computer and its software than would be required to meet the usual probable cause standard for the information being sought. And defining "places" on a computer in terms of a person's particular use of them, such as "places where a user may store documents," is essentially redundant of the "what" element discussed above. Moreover, information on a computer easily can be moved from one virtual location to another, either intentionally or by mistake. We do not think that it is useful to conceive of a computer as consisting of multiple "rooms" or containers, and a valid warrant to search a computer need not identify "places" to search at that level of abstraction.
Defendant also argues that a warrant for a computer search should include a "temporal limitation" or "when" requirement, if one is available and relevant. In Wheeler , the court held that the warrant was unconstitutionally broad because, among other things, it failed to "limit the search to the relevant time frame."
We thus agree in substantial part with defendant. The warrant to search a computer must be based on affidavits that establish probable cause to believe that the computer contains information relevant to the criminal investigation. To meet the particularity *343requirement of Article I, section 9, the warrant must identify, as specifically as reasonably possible in the circumstances, the information to be searched for, including, if relevant and available, the time period during which that information was created, accessed, or otherwise used. We emphasize, however, based on our discussion of digital devices and computer searches above, see
4. Was the warrant here sufficiently particular?
Returning to the facts of this case, the affidavit established probable cause to believe that child abuse was the cause of B's injuries and probable cause to believe that evidence related to the crime would be found on the computer. When Rookhuyzen interviewed defendant in his apartment, defendant was "completely non-emotive" and had not called his wife, behavior that Rookhuyzen called "highly" and "extremely" unusual. Based on defendant's statements regarding his searches shortly before the 9-1-1 call, there also was probable cause to believe that one or more of the computers at the apartment contained information that would confirm or refute defendant's statements about what happened in the minutes before that call:
"[Defendant] told [Rookhuyzen] that he searched the internet between the time he noticed [B] was having difficulty breathing and the time he called emergency dispatch. He told [Rookhuyzen] that he was using a computer to search the internet for advice on what he should do."
Additionally, the affidavit recited statements of the pediatrician who examined B that B's injuries were "clearly the result of intentionally inflicted abuse" and that "[defendant's] version of events was not consistent with [B]'s condition"; that B had a brain injury"unrelated to choking"; and that B had a recent skull fracture and bilateral retinal hemorrhages. Finally, the affidavit stated Rookhuyzen's view, based on his training and experience, that computers retain a history of internet use and that examination of a computer needs to be done in a forensic laboratory.
The affidavit thus established probable cause to believe that a crime had occurred on June 12 and explained, based on case-specific facts and the officer's training and experience, that there was probable cause to believe that evidence relevant to the investigation would be found on the computer. The affidavit described with particularity certain evidence likely to be found on the computer. Indeed, as the Court of Appeals noted, defendant twice conceded at the suppression hearing "the lawfulness of a search of the computers with respect to the 15 minutes preceding the 9-1-1 call." Mansor ,
The warrant, read in conjunction with and limited by the affidavit, met the particularity requirement of Article I, section 9, as we have articulated it above. It sufficiently described the "what" to be searched for and the relevant time frame: The June 12 internet search history. It informed those executing the warrant as to what they were to look for "with a reasonable degree of certainty." Blackburn/ Barber ,
V. USE OF RESULTS OF COMPUTER SEARCHES
It does not follow, however, that the trial court was correct in denying defendant's *344motion to suppress the results of the forensic examination in their entirety. As we have discussed, the warrant authorized a search only for the June 12 internet search history. That search was supported by probable cause, was sufficiently specific, and was not overbroad. The nature of a computer search, however, means that, in searching for that history, that the forensic examiners were likely to come across or discover additional information. And, in this case, the forensic examination searched for and uncovered information, later used at trial, that went far beyond the scope of the warrant.
To ensure the protection of Article I, section 9, rights, we must consider what restrictions, if any, should be imposed on the use of information police obtain through reasonably executed warranted computer searches when those searches uncover evidence beyond that authorized in the warrant, and when no exception to the warrant requirement supports the collection or use of that evidence.
In our view, the privacy interests underlying Article I, section 9, are best protected by recognizing a necessary trade-off when the state searches a computer that has been lawfully seized. Even a reasonable search authorized by a valid warrant necessarily may require examination of at least some information that is beyond the scope of the warrant. Such state searches raise the possibility of computer search warrants becoming the digital equivalent of general warrants and of sanctioning the "undue rummaging that the particularity requirement was enacted to preclude." Mansor,
That approach is consistent with our explanation that the purpose of rules requiring the suppression of evidence gathered in violation of the constitution is to restore the parties to the position they would have been in had the violation not occurred:
"[R]ules of law designed to protect citizens against unauthorized or illegal searches or seizures of their persons, property, or private effects are to be given effect by denying the state the use of evidence secured in violation of those rules against the persons whose rights were violated, or, in effect, by restoring the parties to their position as if the state's officers had remained within the limits of their authority."
State v. Davis ,
*345VI. CONCLUSION
In summary: Article I, section 9, prohibits general warrants that give "the bearer an unlimited authority to search and seize." Carter ,
As explained above, we reject the state's initial argument that a computer is like any other "thing" and that, if it is lawfully seized pursuant to a warrant or is otherwise lawfully in the state's possession, any information that is discovered on the computer is also lawfully seized and can be used at trial. We also reject the state's alternative argument that a warrant to seize and search a computer is sufficiently particular if it simply identifies the crime or crimes being investigated. We instead conclude that, to meet the particularity requirement of Article I, section 9, a warrant to search for and seize a computer-and to search the computer itself for information related to a crime-must be based on probable cause to believe that such evidence will be found on the computer and must describe the information the state seeks (the "what") with as much specificity as reasonably possible under the circumstances, including, if available and relevant, a temporal description of when the information was created, accessed, or otherwise used. As a practical matter, a forensic examination of the computer that reasonably seeks to discover the evidence described in the warrant may reveal evidence that is beyond the scope of the warrant. We also hold that, because of the possibility that a computer search will uncover information that is not authorized by the warrant, a defendant's Article I, section 9, privacy rights prevent the state from using such information unless it comes within an exception to the warrant requirement.
In this case, the trial court denied defendant's motion to suppress the "material discovered as the result of a warranted search of his home computers." Mansor ,
The decision of the Court of Appeals is affirmed. The judgment of the circuit court is reversed, and the case is remanded to the circuit court for further proceedings.
Notes
Initially, Rookhuyzen provided the following search terms: bruise, police, child abuse, investigation, rib, fracture, broken rib, colic [spelled as "cholic"], baby, babies, twin, breath, breathing, rescue, rescue breathing, CPR, care, abuse, and physical abuse. Later, Hays added: father, anger / angry, crying, hurt / hurting, infant, evidence, explaining, and injuries.
Those search terms included "swelling," "Kaliq Mansor," "911," and "Go the Fuck to Sleep."
At trial, the forensic examiner testified that imaging digital storage media means making "an exact bit-by-bit duplication of all of the data on the hard drive. *** [A]ll examination from that point on is done on [that] image, so that if anything should happen to corrupt the data, I'm not corrupting the original hard drive. *** So it maintains the integrity of the original evidence." See also ORS 133.539(1)(a)(A) (" 'Forensic imaging' means using an electronic device to download or transfer raw data from a portable electronic device onto another medium of digital storage.").
The forensic examiner also explained many of those terms. A cookie is "a little piece of data that [a] website is going to leave on your local computer that will help you the next time you access the same website." Cached data is information on a web page that a computer stores locally, enabling faster loading the next time the user accesses the same web page. A leak is "an artifact of browsing history. It basically means the browser was trying to delete a piece of the Internet history just for normal cleanup or if the history was trying to be deleted by a user, *** and for some reason it couldn't *** so it sort of generates an error and that error is called a leak."
The plain view doctrine "permit[s] the officers to seize evidence without a warrant if, in the course of executing [the] search warrant and while they were in a place where they had a right to be, they had probable cause to believe that evidence that they saw was either contraband or evidence of a crime." State v. Carter,
Detective Hays testified about other incriminating phrases that appeared in the search history without disclosing the date of those searches. Those included "how do I stop abusing my baby," "infant abuse," "signs of newborn abuse," "holding baby upside down cause brain damage," "infant attachment father," "how to quiet a crying infant," "abuser therapy," "battered newborn," and "father hates infant."
The Court of Appeals and the parties used the terms "location" and "place" as a convenient way to discuss searches of electronic devices, but they acknowledge that those analogies are imperfect. We agree and, for reasons discussed in the text, find the analytical value of those analogies to be limited.
Forensic examiners have many potential sources of evidence not apparent to a casual computer user:
"When a computer user accesses a web site, opens a file, launches a program, starts the computer, shuts it down, logs on, logs off, installs software, removes software, or attaches a flash drive, hard drives reflect those actions. Forensic analysts term such evidence 'artifacts.' Like archaeological artifacts showing how people once lived, forensic artifacts show how computers were used. Log files show what software programs did. Virtual memory paging files can reveal what was once in memory. Temporary files and link files can reveal that someone created, opened, or saved particular files. When a user saves a file in Microsoft Word, for example, eight different files or folders are created, modified, or accessed in sixteen different steps, all occurring in less than a second. In Windows, a vast configuration database, called the 'registry,' is an evidence treasure chest, showing recent user commands, recent files opened, recent network drives accessed, recent web sites visited, whether USB flash drives were attached, what Wi-Fi wireless access points have been used, and more."
Goldfoot, 16 Berkeley J. Crim. L. at 127-28 (2011) (footnotes omitted).
Our discussion here is limited to circumstances where police seek data or information stored in the computer or evidence of the use of the computer as a computer. The analysis would be different, of course, if a laptop computer had been used to assault a person physically or was alleged to have been stolen. In those cases, police might seize the computer to test for DNA or fingerprint evidence, rather than to search the hard drive, and the possible seizure of the computer would be for evidentiary purposes more akin to those involved in searches for and seizures of other "things."
Riley consisted of two consolidated cases, one involving a "smart phone" and the other a "flip phone." Riley ,
The warrant did not contain the word "affidavit." It did, however, reference "Attachment A," which was a separate document listing items to be seized. The state presented evidence, which defendant did not controvert, that the affidavit was stapled to "Attachment A."
Unless the context indicates otherwise, when we refer to the "warrant" in the remainder of this opinion, we mean the warrant, as supplemented by the affidavit.
We do not intend our discussion here of forensic examinations of computer hard drives to call into question our "container" decisions, although the underlying Article I, section 9, principles are at least similar, if not the same. See State v. Heckathorne,
See State v. Reger,
To be clear, although a computer search may need to be broad, it must be reasonably executed. Or. Const., Art. I, § 9 (protecting right to be free from "unreasonable search, or seizure").