Commonwealth v. Ellis

10 Mass. L. Rptr. 464

Opinion

Bohn, J.

This matter is before the Court for a resolution of the defendants’ motion to suppress electronically stored evidence seized from two separate searches of their computer system, the first of which occurred initially on May 2, 1996, and continued off-site beginning May 6, 1996; and the second of which began on February 12, 1998. The computer, work stations, and other computer system components had been removed from the Ellis & Ellis law offices in Worcester, Massachusetts during a search of those offices on May 2, 1996.

In their motion to suppress, the defendants argue that all of the computerized data which the Commonwealth obtained as the result of the search of their 16 Norwich Street offices on May 2, 1996 should be suppressed because the search of the electronic storage devices was the fruit of the May 2, 1996 search which, they argued, was illegal; because the computer search which began on May 2, 1996 and continued off-site beginning May 7, 1996 was improperly executed; and, because the Commonwealth did not promptly return seized items.

The defendants argue that the evidence seized as a result of the February 12, 1998 warrant should be suppressed because the affidavit filed in support of the application for that search warrant failed to set forth probable cause; because it contained false statements or material omissions; and, because it was not sufficiently particular.

Lastly, the defendants argue that all evidence obtained as a result of both searches must be suppressed because the Commonwealth destroyed evidence, and because neither warrant provided for the protection of privileged documents.

The Commonwealth opposes the defendants’ motion to suppress electronically stored evidence and argues that the issuance of the warrants, the warrants themselves, and the execution of the warrants were proper in all respects.

In March of 1999, this Court heard testimony, received exhibits regarding the warrants at issue, and heard argument from the parties regarding their respective positions.² Based on the evidence heard and an analysis of the law, the defendants’ motion will be ALLOWED in part and DENIED in part.

FINDINGS OF FACT

I. FINDINGS OF FACT REGARDING THE ISSUANCE AND EXECUTION OF THE SEARCH WARRANTS ON MAY 2, 1996

On May 1, 1996, the Superior Court (Kottmyer, J.) issued two search warrants to seize, inter alia, certain computer hardware, software, and peripherals from two Ellis & Ellis law offices in Worcester. The warrants also authorized a search of the seized computer system for data concerning target individuals, medical appointment logs, accounting records, and other evidence, as catalogued in Schedule B attached to the warrant application. To facilitate this facet of the search, the issuing judge appointed an expert, Mr. William L. Farwell, a computer expert and fraud investigator employed by the Board of Bar Overseers, who had assisted in the preparation of the warrants, and “such other computer experts and specialists as are reasonably necessary.” Schedule D, para. 1. The warrants were to be executed on May 2, 1996.

To minimize the disruptive effect of the search, Schedule D of the warrant required that, prior to the commencement of the off-site search of the seized computer components, and “as soon as reasonably practicable” a back-up copy of the entire system’s information was to be prepared. This back-up copy was to be sufficient to return all the information contained in computerized form to the la’ r firm in a useable format, including a copy of the information for each stand-alone computer or workstation seized. In addition, Schedule D required the Commonwealth to make a mirror image of all the data and the files on the Ellis & Ellis computer systems, using the system’s own peripherals. Again, that mirror image was to be sufficient to capture all the actual data on the file server’s hard drive, and data purged or deleted from the system, to the extent possible, and was to identify all users who had access to particular data on the system.

The final step in the seizure and search of the Ellis & Ellis computer system, contained in paragraph seven of Schedule D, directed the Commonwealth’s expert and his assistants to convert the seized electronic data and computerized records which were within the scope of the warrant to a printed (hard copy) format. All such materials which contained potentially privileged information were to be sorted by client name, sealed, and submitted to the court or special magistrate for review. Materials not potentially privileged were to be turned over to the state police and the Attorney General’s Office. The expert was specifically ordered not to communicate to any member of the state police or the Attorney General’s Office the substance or contents of any potentially privileged material.

On May 2, 1996, prior to executing the warrants, Lt. Robert A. Friend Jr., the Massachusetts State Police Officer in charge of the search team, conducted a meeting at the State Police Barracks in Grafton, Massachusetts. Friend was accompanied to that meeting by Farwell, who by then had agreed to monitor the seizure of the computers and computer-related equipment from the Ellis & Ellis law offices and to review the contents of the computers off-site. At the early morning meeting, Farwell briefed the members of his computer search team, which also included Frederick Howell, a computer investigator specialist with the New Hampshire Office of the Attorney General, and Sergeant John McLean of the Medford Police Department. Farwell instructed the members of the computer search team not to have any contact with the Insurance Fraud Bureau, the Insurance Fraud Division of the Attorney General’s Office,³ or the state troopers performing the general search and not to discuss the contents of any information they might observe.⁴

The computer search team drove to the Ellis & Ellis law office located at 16 Norwich Street, Worcester with the main body of the search team. After waiting for approximately fifteen minutes while entry to the building was made by Massachusetts State Police, Farwell entered the building accompanied by Trooper Martin T. Foley, the floor monitor for the fourth floor. Farwell had been told by Bruce Spencer, an investigator with the IFB who had conducted a lengthy investigation beginning in 1995 of suspected fraudulent activity implicating persons associated with Ellis & Ellis, that the file server, identified as the nucleus of a Novell operating system licensed to serve 100 work stations, was located on the fourth floor of the Norwich Street building.

On the fourth floor, Farwell encountered an employee of Ellis & Ellis. When he asked where the file server was located, she indicated a room with a closed door. Farwell asked if she had a key to the door, and she replied she did not. Farwell and Foley then removed the pins from the door and lifted the door off its hinges. Farwell disconnected all external telephone lines and network lines, which effectively isolated the file server from any external influence.⁵

Farwell then “processed” all of the computers on the fourth floor. Processing consisted of determining whether the particular computer had independent storage capability. If the computer did not have independent storage capability, Farwell left that computer and moved to the next. If the computer did have such capability, Farwell ran a “keyword” search using a computer program called DiskSearch II (hereinafter “DS-II”). If the computer produced any “hits” after the keyword search was run, the computer was seized.⁶

No stand-alone computers were seized from the fourth floor; however, from that floor, the computer search team seized the tape archive unit and the supervisor’s work station. Additionally, two computers were seized from the second floor, and a third from the basement.⁷ Farwell also seized thirteen back-up tapes and one printer to facilitate his off-site searching. Farwell disassembled the computers into components and the state troopers packaged them. Every computer seized had an access control disk taped into the disk drive to prevent anyone other than Farwell from accessing them. All seized items were transported and stored at the Office of the Attorney General.

On Monday, May 6, 1996, Farwell and Anthony Fogetta, a Novell certified engineer employed to assist Farwell in reconstructing the computer system, reassembled the file server, the tape archive station, and the supervisor’s work station. Farwell then produced two back-up copies of the file server, retaining one, and forwarding the other to IFD Attorney Michael Cullen for return to the defendants.⁸ As he worked, Farwell kept notes of the entire search procedure on a notepad, recording the general events as they occurred. He then transferred his rough notes to a finished, computer-generated chronological log, compared his rough notes with the log to determine whether the two were identical, and discarded the written notes.

Farwell began his initial off-site search of the file server on May 7, 1996.⁹ In this initial search, Farwell utilized a program entitled Netware Salvage Utility which allowed him to resurrect any previously deleted files for which the system was still tracking account information. In doing so, he found several deleted files that met the search warrant criteria based on the naming protocol.¹⁰ Farwell then ran a program called SysCon which allowed him to examine the users on the system and the manner in which rights and permissions of access were set up in the various directories. Through this program, Farwell discovered that certain Ellis & Ellis files were restricted to certain users.

Farwell then began a “filename, file-by-file” search of the directories. Using DS-II, Farwell began to search for terms found in the warrant, referred to as keywords. Before the DS-II program was half completed, however, Farwell stopped the program because it had already produced more than 2,300 hits. After reviewing these hits, Farwell observed that they only gave the physical location of the hit (i.e. the sector address), but not the logical location (i.e. the file name and directory location). Because the retrieval of information from the physical location was impracticable, Farwell looked for alternative search programs which would do the same thing that DS-II did on a physical level and produce the same results on a Novell partition, but was unable to find such a program.

Farwell then reviewed the directory structure of the hard drive and observed that it was logically organized with subdirectories and filenames which generally followed a naming protocol that included the first few letters of a client’s last name and the first three letters of the client’s first name. He determined that the best available alternative was to do a visual review of the file names within each directory and subdirectory for potentially relevant files, then use the “view” function of WordPerfect (which would not alter the hard drive)¹¹ to review enough of the file contents to enable him to determine whether tb ese potentially relevant files were within the scope of the warrant. Farwell testified that he viewed approximately 500-1,000 files in this manner, selecting for viewing those which fit the naming protocol for the clients listed in the search warrant. He also viewed files which did not follow the organizational or naming protocol, as well as those which were password-protected or otherwise encrypted. Files which were password-protected were viewed after a software program called WRPass was used to identify the applicable password.

When he identified a file or document he believed was within the scope of the warrant, Farwell printed it without reading it further, placed it in a manila envelope, sealed the envelope with evidence tape, and stored it for eventual delivery to the court or special master.

While viewing potentially relevant files, Farwell came across material he believed was of evidentiary value but which was not seizable under the explicit terms of the warrant. After contacting one of the assistant attorneys general to discuss the possibility of “plain view” seizures, Farwell decided to print this material, seal it in an envelope denoting that it was seized in plain view, and submit it to the special master along with an inventory which listed the material as having been seized in plain view.

On May 22, 1996, the defendants filed a motion for emergency temporary relief with the court (Kottmyer, J.) seeking to prevent any further review by the Commonwealth of the seized materials until they had had an opportunity to challenge the constitutionality of the search and the procedures put in place in the warrant to protect privileged materials. Judge Kottmyer allowed this motion at a hearing on May 29, 1996, thereby prohibiting further review of any of the seized materials without leave of the court.

On May 28, 1996, the defendants filed a motion for the return of properly and for other appropriate relief. After a hearing held on June 11, 1996, Judge Kottmyer denied the defendants’ request for the return of property and, in an opinion dated June 28, 1996, affirmed the procedures that had been established for the review of computer files.

On July 5, 1996, petitioners filed another motion to continue the court’s order staying the Commonwealth’s review of the seized materials until the June 28, 1996 ruling could be appealed pursuant to G.L.c. 211, §3. This motion was allowed.

On July 8, 1996, petitioners filed an application under G.L.c. 211, §3, seeking review before a Single Justice of the Supreme Judicial Court of Judge Kottmyer’s June 28, 1996 Memorandum and Order on Petitioners’ Motion for Return of Seized Property and for Appropriate Relief. A hearing on this application was held on August 14, 1996 before Supreme Judicial Court Justice Ruth Abrams. After the hearing, Justice Abrams denied the petitioners’ application as premature and lifted all stays imposed by Judge Kottmyer as of 5:00 p.m. on August 15, 1996. The stay of the Commonwealth’s review of seized materials had been in effect since May 22, 1996.

Farwell resumed his search of the file server on August 21, 1996, and concluded his search on August 22, 1996. He then notified the Attorney General’s Office that he had completed the first level, preliminary search of the file server and had submitted all printed documents to the court for review. Rather than beginning the search of the back-up tapes, however, Farwell awaited further instructions from the IFD.¹² Farwell did not return the original file server disk or the copies of the disk to Ellis & Ellis because he thought it might be necessary to perform a more intensive search in the future once the IFD had received the screened documents.

On October 31, 1996, the computer equipment was moved to the Office of the Board of Bar Overseers so Farwell could devote partial days to the search.

On February 19, 1997, the IFD notified Farwell that it had received its first set of documents from the special master and the court; however, the IFD attorneys informed Farwell that there was nc Milan file contained within the output they received, even though Milan’s name was one of the seventeen clients identified in Schedule B of the May 1, 1996 warrants. The IFD attorneys requested that Farwell search the computer again for the Milan file. Farwell performed as requested, but could not locate such a file.

On February 24, 1997, Farwell began searching back-up tapes for files not found in the first search. On March 26, 1997, Judge Kottmyer ordered the Commonwealth to give copies of the thirteen back-up tapes to the defendants. When the Commonwealth did not comply by June 2, 1997, Judge Kottmyer again ordered that copies of the back-up tapes be made and provided to the defendants, and also that no further search should be done “until further order of the Court.” On June 28, 1997, the Commonwealth produced the copies of the back-up tapes and Farwell resumed review of those tapes.

On July 9, 1997, IFD Attorney John Ciardi telephoned Farwell and told him that the Commonwealth interpreted Judge Kottmyer’s June 2, 1997 Order to mean that Farwell should cease reviewing the back-up tapes until further order of the court. Consequently, Farwell again ceased review of the tapes. Subsequently, upon request of the Commonwealth, Judge Kottmyer issued an order on February 12, 1998 allowing resumption of Farwell’s efforts pursuant to the first search warrant.¹³

II. FINDINGS OF FACT REGARDING THE ISSUANCE AND EXECUTION OF THE FEBRUARY 12, 1998 SEARCH WARRANT

On February 12, 1998, Spencer applied for a new warrant to seize client files, claim files, case files, and other related documents of thirty-two Ellis & Ellis clients, none of whom were named in the May 1, 1996 warrants or discussed in the May 1, 1996 Spencer affidavit. In support of the February 12, 1998 warrant, Spencer attached the earlier affidavits as well as new affidavits from him and Lt. Friend. Spencer also attached to the warrant application a waiver form signed by each of the thirty-two clients. The warrant was issued by Judge Kottmyer on February 12, 1998, the day of the application. On the warrant, she had added the words “absent further order of the court” to the provision which requires the search to occur within a reasonable time and in no event later than seven days from the issuance of the warrant.¹⁴

Farwell received the second warrant on the day it was issued. He also received a message from Sgt. McLean that he would assist Farwell in executing the second warrant. While McLean and Farwell were preparing the return to the warrant, they noticed Judge Kottmyer’s insertion. Farwell and McLean both believed that this particular provision required them to execute the warrant on the computer equipment in their possession, and to file a return within seven days, but that the actual search of the computer files did not have to be completed within seven days. The return on the warrant was filed on February 18, 1998.

Between February and May of 1998, Farwell again searched the back-up tapes using JAZ disk technology which allowed him effectively to use the DS-II keyword search program. During this second search of the back-up tapes, Farwell used the search items from both the May 1, 1996 and February 12, 1998 warrants.

In April of 1998, Farwell was advised by the prosecutors that the defense sought a sector-level mirror image of all hard drives that he had been using. Farwell understood from his conversations with Randall Davis, the defendants’ computer expert, that the defense sought only a mirror image of the original file server because, when Farwell ran the salvage utility, he had recovered information that would not be available from a back-up copy of the file server.¹⁵

By May 26, 1998, Farwell had completed his search of the back-up tapes using the naming protocol and began a keyword search of the same media using the DS-II program. The same day, Farwell attended a meeting with IFD Attorneys Ciardi, Marks, and Stuart Rossman at the Office of the Board of Bar Overseers to devise a plan for completing the search in an expeditious manner. Thereafter, the Attorney General’s Office agreed to pay for two assistants to Farwell.

On June 3, 1998, Farwellbegan the task of creating a new duplicate of the original Ellis & Ellis hard drive so he could begin his search of the file server called for by the February 12, 1998 warrant. In order to make room on his working hard drive for the new information, Farwell found it necessary to clean the disk. To accomplish this, Farwell used a disk sterilization software program called Wipelnfo. He then made a second duplicate of the original file server’s hard drive on his working drive.¹⁶

On June 4, 1998, Farwell loaded his back-up of the file server to begin the search for those names in the second search warrant. That same day, this Court (Bohn, J.) issued an Order requiring the Commonwealth to create a sector-level mirror image of Farwell’s working drive. Once informed of this Order, Farwell told the prosecutors of his use of Wipelnfo. In late June 1998, Farwell received a blank hard drive from defendants and provided them with a duplicate copy of his working drive.

On July 23, 1998,¹⁷ Farwell finished his keyword search of the file server and began printing. August 10, 1998 was the last day Farwell searched any of the computers. Farwell finished printing the search output on August 17, 1998. No further search of the file server or back-up tapes was conducted, as ordered by Judge Kottmyer.

Attached to this decision as Appendix A is a detailed chronological timeline of Farwell’s computer searches. Additionally, the parties have filed extensive proposed findings of fact, many of which are not disputed, some of which have been incorporated into this decision, and some of which have been omitted as non-essential. Additional facts will be described in the discussion which follows.

DISCUSSION AND RULINGS OF LAW

In their motion to suppress, the defendants have set forth several distinct grounds in support of their position that all the evidence seized must be suppressed based on the content of the warrants and the manner in which they were executed. As this Court stated in its Findings of Fact, Rulings of Law, and Order on Defendants’ Motion to Suppress Evidence, dated August 18, 1999 [10 Mass. L. Rptr. 429 (October 18, 1999)], the reasonableness of the search and seizure will be considered in light of the totality of the circumstances. See Illinois v. Gates, 462. U. S. 213, 233 (1983); Commonwealth v. Krisco Corp., 421 Mass. 37, 41-42 (1995).

The rulings of law of this decision will begin by analyzing the May 1, 1996 warrants, i.e., to determine whether there was probable cause to issue them, whether they were properly executed with regard to the electronically stored evidence, and whether, as argued by the defendants, the Commonwealth was obligated to return the computer equipment once it completed the search. The discussion will continue by addressing the February 12, 1998 search warrant to determine whether the warrant was supported by probable cause and was sufficiently particular, and whether it was properly executed. Lastly, the Court will discuss the defendants’ arguments which implicate both warrants, i.e., whether the Commonwealth improperly destroyed evidence and whether the search warrants provided adequate procedures for the protection of privileged documents.

I. DISCUSSION AND RULINGS OF LAW REGARDING THE MAY 1, 1996 SEARCH WARRANTS

In their motion to suppress electronically stored evidence, the defendants argue that the searches of the computer system were unreasonable, in violation of the Fourth Amendment to the United States Constitution and Articles Twelve and Fourteen of the Massachusetts Declaration of Rights in that A) the affidavit in support of the warrant application failed to set forth probable cause; and B) was executed unreasonably because 1. the search was not completed with seven days of the issuance of the warrant; 2. the Commonwealth did not use adequate minimization techniques; and 3. the defendants or their representatives were not permitted to be present during the search. The defendants also ague that the Commonwealth was obligated to return the computer equipment once it completed the search and that the Commonwealth’s failure to do so is another factor this Court should consider in suppressing the evidence seized.

A. The Sufficiency of the May 1, 1996 Search Warrants

This argument received extensive consideration by this Court, and was rejected in its Findings of Fact, Rulings of Law, and Order on Defendants’ Motion to Suppress Evidence, dated August 18, 1999, specifically Sections H.A. and II.B. [10 Mass. L. Rptr. 429 (October 18, 1999).] In that decision, this Court found that the affidavit in support of the warrant applications set forth probable cause to support issuance of the warrants, and that the warrants were sufficiently particular. Accordingly, the defendants’ motion to suppress will not be allowed on these grounds.¹⁸ No further discussion is necessary.

B. The Execution of the May 1, 1996 Search Warrants

In their motion to suppress electronically stored evidence, the defendants argue that the search of the Ellis & Ellis computer system was conducted in an unreasonable manner in that the Commonwealth did not execute the search warrants within seven days or, in the alternative, within a reasonable time; that the Commonwealth did not use adequate minimization techniques to avoid a general exploratory search; and that the Commonwealth did not allow the defendants or their representatives to be present during the search. Those arguments will be evaluated in turn.

1. Time for Completion of the Search

The Commonwealth seized the Ellis & Ellis computer equipment from the law firm’s Worcester offices on May 2, 1996. Farwell began his on-site search pursuant to the first warrant on that day, and continued his search off-site beginning May 7, 1996. He concluded that search on June 2, 1998. The defendants contend that, under Massachusetts law, all warrants must be executed within seven days from issuance or, in any event, within a reasonable time after issuance of the warrant; and that, because the warrants were not executed within that time frame, the evidence should be suppressed.

(a) Completion of Search Within Seven Days

General Laws Chapter 276, §3A states that “[e]very officer to whom a warrant to search is issued shall return the same to the court by which it was issued as soon as it has been served and in any event no later than seven days from the issuance thereof. . .” G.L.c. 276, §3A (emphasis added). The purpose of the statutory time limit for the execution of a warrant was discussed extensively in Commonwealth v. Cromer, 365 Mass. 519 (1974). “A search warrant may issue only when facts are presented to a magistrate which show probable cause that relevant evider.ee will be found at a designated location. The longer police wait before executing the warrant, however, the more likely it is that the situation will change so that the facts which supported the magistrate’s determination of probable cause will no longer exist.” Cromer, 365 Mass. at 524.

The Cromer Court further stated that “because a warrant cannot be executed after it has been returned to court, and because §3A requires return of a search warrant within seven days, we think that it is logical to infer from §3A a legislative judgment that warrants must be executed, as well as returned, within seven days.” Id. (emphasis added). This statement, however, was made before the advent of the computer age, and before the Supreme Judicial Court could envision a scenario where execution of a search could continue after the return of the warrant had been filed. And where computers are seized, that is precisely what occurs. In cases where the warrant directs agents to seize broad categories of records, or even all records, courts have upheld the “carting off’ of whole file cabinets containing pounds of unsorted paper, to be searched off-site. U.S. Postal Service v. C.E.C. Services, 869 F.2d 184, 187 (2d Cir. 1989); United States v. Sawyer, 799 F.2d 1494, 1508 (11th Cir. 1986), cert. denied sub nom., Leavitt v. United States, 479 U.S. 1069 (1987). The rationale that searches can be executed off-site because of the volume of information has been extended to include computers. United States v. Snow, 919 F.2d 1458, 1461 (10th Cir. 1990); United States v. Henson, 848 F.2d 1374 (6th Cir. 1988), cert. denied, 488 U.S. 1005 (1989). These and other cases express the proposition that, because off-site computer searches are reasonable, it may be necessary, by implication, for the return of the warrant to be filed with the court before such off-site searching can be completed.¹⁹ Courts have recognized that the search of computer data involves more preparation than an ordinary search and a greater degree of care in the execution of the warrant; and that the search may involve much more information. As such, computer searches are not, and cannot be, subject to the statutory requirement that the search be completed within seven days.²⁰

Here, the Ellis & Ellis file server contained approximately 20,000 documents to be reviewed. Despite the defendants’ expert’s assertions to the contrary,²¹ it does not appear possible that a thorough search through such a volume of files could have been completed within seven days. Further, because the computer equipment had already been seized, the “situation” could not change such that “probable cause [would] no longer exist.” See Cromer, 365 Mass. at 524. This Court concludes that the warrant return requirement of G.L.c. 276, §3A was satisfied when the state police filed a return of the warrant within seven days of issuance, indicating which computer equipment and peripherals had been seized from the Ellis & Ellis law offices. The ongoing search of the computer’s memory need not have been accomplished within the seven-day period required for return of the warrant.

(b) Completion Within a Reasonable Time

A survey of the authorities in existence at the time the searches were completed in this case evidences a directive to complete the searches within a reasonable period of time. See Berger v. New York, 388 U.S. 41, 58-60 (1967); Cromer, 365 Mass. at 524. Although courts have not addressed the specific time that is constitutionally reasonable, it likely depends upon several factors, including the size of the computer memory; the complexity of the computers’ organizational structure, encryption, and password issues; the type of search engine available; the type of documents being searched for; and the resources available to the searching party. See generally “Federal Guidelines for Searching and Seizing Computers,” 56 Crim.L.Rptr. 2023, 2038-40 (Dec. 21, 1994); Commonwealth v. Sbordone, 424 Mass. 802, 809 (1997) (search of computerized files is “extraordinary circumstance[]” where specialized knowledge is required to conduct the search).

In the present case, as noted above, there were over 20,000 documents contained in the computer’s memory. Several entries were protected by passwords, by protected access or by encryption. The search mechanism initially used by the Commonwealth’s expert proved inadequate for the task. Farwell was concerning about maintaining the integrity of the search and of documenting his progress. For most of the search, he worked alone; and, on several occasions, was delayed by stays entered by the court at the request of the defendants and, at other times by misinformation concerning the effect of a stay. As Judge Kottmyer noted in her Memorandum and Order of June 28,1996; “The [search warrant] affidavit demonstrated that the search through these records will be painstaking and time consuming ...”

Furthermore, as argued by the Commonwealth, the test of whether the time within which a search warrant was executed was reasonable revolves around the question of whether there continued to be probable cause for the search, or whether probable cause had dissipated. United States v. Bedford, 519 F.2d 650, 655-56 (3d Cir. 1975), cert. denied, 424 U.S. 917 (1976). A delay in executing a warrant will not be deemed unreasonable unless, at the time of execution, probable cause no longer existed and the defendant can demonstrate that he suffered some legal prejudice attributable to the delay, such as when evidence is found on the premises which would not have been present had a prompt search taken place. Cromer, 365 Mass. at 525-26. In the present case, the evidence was frozen in time when the computers and related materials were removed from the Ellis & Ellis office. For that reason, probable cause continued to exist and allowed continual review of the stored information.²² Further, the length of time taken for the execution of the search merely affected the timing, and not the scope of the search. Given the totality of the circumstances, this Court finds that Farwell’s completion of the initial search of the file server, conducted between May 7, 1996 and August 22, 1996, was reasonable.

Finally, if the search of the back-up tapes from February 1997 through June 1998 represents an extraordinary period of time; the defendants have not shown any prejudice from Farwell’s delay in the completion of the execution of the search; and, even if the defendants could show prejudice, suppression of evidence would not be the appropriate remedy in this case. See Commonwealth v. Gomes, 408 Mass. 43, 46 (1990) (no exclusion of evidence obtained in violation of warrant because it would not provide future deterrence to police); Cromer, 365 Mass. at 525 (even if delay in executing search warrant found to be unreasonable, evidence suppressed only if defendant can demonstrate legal prejudice as a result of the delay). As such, the documents Farwell recovered after August of 1996 will not be suppressed.

2. Minimization Techniques

The defendants argue that Farwell’s method of searching the computer system was not the least intrusive means possible of searching the flies, and that his methods rendered the search unreasonable. Specifically, the defendants argue that Farwell should have used a keyword search, rather than a file-by-file search.

In this case, when Farwell attempted to run the DS-II program to begin his keyword search, the program did not identify file names, but was instead giving him sector-level locations or addresses where the data could be located.²³ Such addresses are not translatable to file names and Farwell would have had great difficulty determining if the files were within the scope of the warrant. Farwell discovered that DS-II was not able to interpret Novell file allocations, and would be unable to produce output by file name. Farwell could not find any program that would search the entire physical drive using keywords.²⁴

After DS-II failed to work as anticipated, Farwell decided to undertake a file name, file-by-file search of the directories, viewing files based on the naming protocols that were in place. Farwell would conduct a cursory review and if the document was within the scope of the warrant, Farwell would print the file. In addition, Farwell viewed all files that did not fit the naming protocol to determine whether it was within the scope of the warrant, and if so, printed the file. He also viewed all documents that were password-protected or seemed out of place on the directory hierarchy.

It has been said that:

Records searches are vexing in their scope, because invariably some irrelevant records will be scanned in locating the desired documents. Such searches spark protests over the amount of discretion given to the searching officers, and these concerns are heightened when the documents include potentially privileged legal materials. A warrant calling for a thorough records search does not necessarily give officers too much discretion, however. Although care must be taken to “minimize! ] unwarranted intrusions upon privacy,” records searches “permit!) officers to examine many papers,” in recognition of “the reality that few people keep documents of their criminal transactions in a folder marked ‘crime records.’ ”

United States v. Hunter, 13 F. Supp.2d 574, 582 (D.Vt. 1998) (citations omitted). In paper searches, “some perusal, generally fairly brief, [is] necessary in order for the police to perceive the relevance of the documents to the crime . . . ,” United States v. Ochs, 595 F.2d 1247, 1258 (2d Cir.), cert. denied, 444 U.S. 955 (1979), reh’g denied, 444 U.S. 1027 (1980), but “the perusal must cease at the point of which the warrant’s inapplicability to each document is clear.” United States v. Heldt, 668 F.2d 1238, 1267 (D.C.Cir. 1981), cert. denied sub nom., Hubbard v. U.S., 456 U.S. 926 (1982). “In searches for papers, it is certain that some innocuous documents will be examined, at least cursorily, in order to determine whether they are, in fact, among those papers authorized to be seized . . . [Responsible officials, including judicial officials, must take care to assure that [the searches] are conducted in a manner that minimizes unwarranted intrusions upon privacy.” Andresen v. Maryland, 427 U.S. 463, 483 (1976). “Computer records searches are no less constitutional than searches of physical records, where innocuous documents may be scanned to ascertain their relevancy.” Hunter, 13. F.Supp.2d at 584, citing United States v. Abell, 963 F.Supp. 1178, 1200 (S.D. Fla. 1997). Further, in computer searches, keyword searches are likely the most efficient types of searches, but unless the computer analyst knows how the data was organized and stored, there will necessarily be trial and error to determine key phrases, words, and places. See generally 56 Crim.L.Rptr., supra at p. 2037.

In the present case, it is illogical to posit that Farwell could not review any documents outside the scope of the warrant in conducting his search. As this Court stated in its Findings of Fact, Rulings of Law, and Order on Defendants’ Motion to Suppress Evidence, dated August 18, 1999 [10 Mass. L. Rptr. 429 (October 18, 1999)], a cursory review is proper, and indeed requires some observation. It is evident that Farwell did not rummage among the files contained in the computer’s memory, but rather, followed a strict protocol which determined which files he would view and which files would be passed over without viewing. In reviewing the 20,000 documents con tamed on the computer’s memory, Farwell looked at only three types of documents: (1) documents where the naming protocol indicated that it concerned one of the targets listed in the warrant; (2) documents that were password protected or encrypted; and (3) documents that were “out of place” on the highly organized directory structure. In all likelihood, Farwell’s search yielded fewer documents than a keyword search. For example, Farwell did not view documents that did not fall within the naming protocol, despite the fact that the files could have been deliberately misnamed to disguise the file’s content. Furthermore, as argued by the Commonwealth, a strict keyword search would have been both under and over inclusive. For example, the keyword search would have identified files in which a client’s name appeared but which did not relate to the client, i.e., if a client referred another client to Ellis & Ellis, his/her name could be listed in the referred client’s file, which would not be a file within the warrant, thereby constituting an over-inclusive search. The keyword search also may not have adequately identified documents concerning certain schemes because the Commonwealth could not determine what keywords would identify those files, thereby constituting an under-inclusive search.

This Court finds that, based on the evidence presented at hearing, Farwell’s methods of searching the computer by means of a file-by-file review was reasonable under the circumstances presented, and did not unnecessarily intrude on the defendants’ expectations of privacy for documents not within the scope of the warrant. Further, because Farwell was lawfully searching the computer, he could properly seize evidence whose incriminating character was immediately apparent; see Commonwealth v. D'Amour, 428 Mass. 725, 730-31 (1999); and this Court finds that the two documents actually released to the Commonwealth should not be suppressed because they fall within the scope of the warrants.

3. Whether the Defendants or their Representatives Must Have Been Present During the Search

This argument received extensive consideration by this Court, and was rejected in this Court’s Findings of Fact, Rulings of Law, and Order on Defendants’ Motion to Suppress Evidence, dated August 18, 1999. [10 Mass. L. Rptr. 429 (October 18, 1999).] In that decision, this Court found that the conduct of the troopers in executing the warrants without the presence of the occupants was proper. Similarly, there is no statutory or constitutional right of the defendants in this case to have a representative present during the computer search. As such, the defendants’ motion to suppress electronically stored evidence will not be allowed on these grounds.

C. Return of Property

The defendants contend that the Commonwealth should have promptly returned the computer equipment after completing the searches of the computer media and equipment. The Commonwealth contends, however, that it was entitled to retain the computer equipment even after the search had been completed, on the basis that the computer was first, an instrumentality of the crimes committed by the defendants and second, contained evidence of the crime committed by the defendants.

The seizure and removal of a defendant’s entire computer system is not the preferred method of searching a computer’s memory. “[CJopying [the computer data onto a disk at the scene] is less intrusive than seizing because copying does not deprive a defendant of the use of his property.” United States v. Simons, 29 F.Supp.2d 324, 329 (E.D. Va. 1998); however, where a law firm’s computer contains a large number of documents that must be reviewed to determine whether they were amenable to seizure, removal of the computer from the site of the search, and conducting the search of the computer memory off-site, is appropriate and even encouraged. See generally 56 Crim.L.Rptr., supra at pp. 2038-40.

If the computer equipment is removed from the scene of the search it should be promptly returned after the search of its memory is completed. See Hunter, 13 F.Supp.2d at 583 (wholesale seizure of computer equipment permitted but “the government should copy and return the equipment as soon as possible"); Gawrysiak, 972 F.Supp. at 866 (“government agreed to return all of the copied computer files to defendants”). Nevertheless, “[t]he government may retain seized software or hardware ... if the equipment is forfeitable, which generally requires that the equipment contain evidence of criminal activity.” Rafael Winick, “Searches and Seizures of Computers and Computer Data,” 8 Harvard Journal of Law and Technology 75, 112-13 (Fall 1994) (footnotes omitted). See also High-Technology Crime, supra at pp. 325-29, 417-19, 427-30, 438-42 (return of computer equipment prior to conclusion of prosecution not constitutionally required where computer contains evidence of criminal activity or where computer is necessary evidence at trial).

In the instant case, the data contained in the computer’s memory was allegedly used to commit the crimes of which the defendants have been charged; the employees allegedly utilized a network of computers to access client logs which contained vital information about the merits of the client’s cases; and the computers were allegedly used to create and generate the paperwork used to perpetrate the alleged fraud upon the insurance companies. The defendants’ own expert testified that he would not have returned the original computer equipment to the defendants prior to trial. This Court therefore concludes that the Commonwealth’s retention of the computer equipment was reasonable under the circumstances of this case.

D. DISCUSSION AND RULINGS OF LAW REGARDING THE FEBRUARY 12, 1998 SEARCH WARRANT

In the course of executing the May 1, 1996 search warrants, the Commonwealth obtained the names of thirty-two additional clients who appeared to have been involved in the insurance fraud allegedly taking place at Ellis & Ellis. As such, the Commonwealth obtained privileged document waivers from these clients and applied for a search warrant to re-search the computer equipment for any files concerning those persons. That second warrant was issued on February 12, 1998.

In their motion to suppress electronically stored evidence obtained as a result of the February 12, 1998 search warrant, the defendants argue that the search of the computer system was unreasonable, in violation of the Fourth Amendment to the United States Constitution and Articles Twelve and Fourteen of the Massachusetts Declaration of Rights in that A) it was the fruit of the illegal searches conducted pursuant to the May 1, 1996 warrants; B) the affidavit in support of the warrant application failed to set forth probable cause for the named targets and the warrant was not sufficiently particular; and C) the warrant was executed unreasonably because the search was not completed within seven days of the issuance of the warrant.

A. Fruit of the Poisonous Tree

The defendants argue that because Farwell’s continued custody of the computer memory on February 12, 1998 was unlawful, it therefore follows directly that everything seized pursuant to the February 12, 1998 warrant must be suppressed as the fruit of the prior illegality; however, this Court has determined that Farwell’s continued custody of the computer memory was not unlawful. For that reason, nothing seized as a result of the February 12, 1998 warrant is the fruit of any prior illegality.

B. The Sufficiency of the February 12, 1998 Search Warrant

The defendants argue that the search of the computer system was unreasonable in that 1.) the affidavit in support of the warrant failed to set forth probable cause; and 2.) the warrant was not sufficiently particular.

1. The Issue Of Sufficient Probable Cause

The defendants argue that, although Spencer obtained a privilege waiver from each of the thirty-two clients named in the second warrant, the probable cause requirement incorporating the nexus test and crime-fraud determination must nonetheless be satisfied in order to seize each category of documents. The defendants also claim, with regard to the seizure of the files of particular clients, that Spencer’s affidavit contained omissions and/or misstatements that were material to the finding of probable cause, and that they are therefore entitled to a hearing to further explore whether these documents should be suppressed. A review of those issues with reference to each of the thirty-two clients follows.

a. Files of Andrzej Orlowski, Orlando Santiago, Luis Alberto Delduca, Ramon Albino, Carlos Velazquez, and Cesar Peluffo

Spencer’s affidavit recounts that Orlowski, Santiago, Delduca, Albino, Velazquez, and Peluffo were represented by Ellis & Ellis in connection with a workers’ compensation claim. Each of these clients’ cases were referred to the IFB for investigation. The IFB then referred the cases to the IFD for prosecution for insurance fraud. Complaints were filed against five of the six, with the exception of Peluffo. Of these five, all except Albino entered into plea agreements with the Commonwealth. Orlowski, Delduca, Albino, Velazquez, and Peluffo informed Spencer that they met with Ellis & Ellis employees prior to scheduled medical examinations, and that the employees instructed them to exaggerate their symptoms during the examinations. Spencer’s affidavit does not recount specific information concerning his meetings with these individuals, but instead groups their experience into a general statement. The defendants claim that this type of unison statement is insufficient to satisfy probable cause. The defendants also contend that certain misstatements or omissions concerning Orlowski, Santiago, Delduca, and Velazquez were material to the issuing magistrate’s finding of probable cause, and that they are therefore entitled to a Franks hearing. See Franks v. Delaware, 438 U.S. 154 (1978).

1.) Andrzej Orlowski

Spencer’s affidavit states that Orlowski told him that he was instructed by an Ellis & Ellis employee to exaggerate symptoms during a medical examination. Spencer subsequently acknowledged that Orlowski never made such a statement, but instead had obtained a false social security card with the assistance of an Ellis & Ellis employee in order to facilitate his workers’ compensation claim. Because the latter information was not before Judge Kottmyer when she contemplated the issuance of the warrant, the only information that could be considered in determining whether probable cause existed to seize the client file of Orlowski is that he was prosecuted by the IFD for insurance fraud, that he pled guilty to that charge, and that he provided the IFD with a statement, the content of which is unknown.

The criminal activity under investigation prior to February of 1998 was insurance fraud allegedly committed by employees of the Ellis & Ellis law firm. Accordingly, Spencer’s affidavit must have contained sufficient information to determine that Orlowski’s file would reveal evidence of insurance fraud committed by Ellis & Ellis employees. A reasonable inference may be made from Orlowski’s guilty plea that his workers’ compensation file at Ellis & Ellis would co- itain information relative to his own fraud upon the insurance company, satisfying the nexus test. But the affidavit did not establish by a preponderance of the evidence that Ellis & Ellis was complicit in that fraud, as required by Purcell. See Purcell v. District Attorney for the Suffolk District, 424 Mass. 109, 112-13 (1997). As such the computer documents relating to Orlowski must be suppressed.

2.) Orlando Santiago

Spencer’s affidavit asserts that Santiago was represented by Ellis & Ellis, that he was later prosecuted by the IFD for insurance fraud, and that he entered into a plea agreement. Spencer continues that Santiago provided the IFB with a statement concerning his fraud; however, when Spencer states that certain individuals “acknowledged that they met with identified Ellis & Ellis principals and/or employees . . . [who instructed them] to exaggerate their symptoms and their degree of pain . . . ,” Santiago is not included in that list. Therefore, the only information that could be considered in determining whether probable cause existed to seize Santiago’s client file is that he was prosecuted by the IFD for insurance fraud, that he pled guilty to that charge, and that he provided the IFB with a statement, the content of which is unknown.²⁵

As with Orlowski, the information in the warrant concerning Santiago is insufficient to establish by a preponderance of the evidence that Ellis & Ellis was complicit in this fraud. For that reason, the computer documents concerning Santiago must be suppressed.

3.) Luis Alberto Delduca

The defendants contend that the information concerning Delduca did not establish that Ellis & Ellis was on actual notice of Delduca’s use of an alias to pursue concurrent claims. They contend that Spencer failed to state when Ellis & Ellis became aware of Delduca’s use of aliases to pursue concurrent claims, that Spencer failed to show what information Ellis & Ellis possessed about the validity of Delduca’s claims, and that these omissions from the affidavit are fatal to the finding of probable cause.

Although the information Spencer recounted in the affidavit to the warrant was not exhaustive, it provided the issuing magistrate with sufficient information to establish probable cause to believe that Ellis & Ellis employees coached Delduca, that his Ellis & Ellis computer file would contain evidence of that coaching, and, by a preponderance of the evidence, that Ellis & Ellis was complicit in that fraud. That the affidavit omits the details of when and how Ellis & Ellis became involved in Delduca’s alias scheme does not negate probable cause and does not entitle the defendants to a Franks hearing. As such, the documents concerning Delduca will not be suppressed.

4.) Carlos Velazquez

Spencer’s affidavit recounts that Velazquez was one of the five individuals who indicated that Ellis & Ellis employees instructed them to exaggerate their symptoms during medical examinations. The defendants contend that the substance of Velazquez’s statement demonstrates that he was never specifically instructed to lie, and that nothing the employees did was improper and Spencer’s affidavit recounted that Velazquez stated that during his “pre-med” at Ellis & Ellis, when he gave a percentage as to how much better he felt, the nurse wrote a lower percentage in her notes. Although he never specifically stated that he was instructed to lie, an inference can be made that Velazquez was implicitly encouraged to exaggerate his injuries and that the exaggeration of his injuries was done with knowledge of Ellis & Ellis employees. Such information is sufficient to establish probable cause to believe that Ellis & Ellis employees coached Velazquez, that his Ellis & Ellis files would contain evidence of that coaching, and, by a preponderance of the evidence, that Ellis & Ellis was complicit in that fraud. The defendants have not presented evidence that would entitle them to a Franks hearing. As such, the documents will not be suppressed.

b.Files of Richard Egan, Barry Bernstein, Gary Boss, Tina Ford-Lamont, Patricia Hebert, and Albert Vezina

Spencer’s affidavit relates that these former Ellis & Ellis clients gave statements to the IFB in which they claimed that prior to scheduled medical examinations, Ellis & Ellis employees instructed them to exaggerate their symptoms during the examination. These clients also admitted that they performed as they were instructed. The defendants claim that the lack of specificity in Spencer’s affidavit with regard to these clients is fatal to a finding of probable cause.

Because the information Spencer provided con-tamed sufficient information for the issuing magistrate to ascertain that evidence of coaching on the part of Ellis & Ellis employees could reasonably be expected to be found in the client files, and established by a preponderance of the evidence that Ellis & Ellis was complicit in that criminal activity, probable cause existed to seize those client files.

The defendants do not assert that there were any knowing or reckless material omissions or false statements made entitling them to a Franks hearing. As such, the documents will not be suppressed.

c.Files of Thomas C. Slye, Kevin Kelly, Robert Brady, Angelo Ginas, Timothy Hanley, Monica Bissonnette, Lawrence Costa, Peter Napoli, Pamela Lasell, Lisa Garon (Jette), Rickey Garvey, John Jamilowski, David Huberdault, Roland Gaboury, Jr., Richard Galagneau, Anne M. Wilson, June Gallant, Caitlin Grady/Caruso, Juan Alonso, and Gersten Papagni

The Commonwealth concedes that the files for six of these individuals, Robert Brady, June Gallant, Rickey Garvey, Angelo Ginas, David Huberdault, and Kevin Kelly, should not have been recovered pursuant to the warrant because these individuals did not make the statements about nurse coaching that Spencer attributed to them. The Commonwealth returned the client files of these six individuals to the defendants and has agreed not to use any fruit of that information against the defendants at any time during their prosecution. The defendants contend that Spencer’s erroneous inclusion of the six individuals was a reckless misstatement that was material to the issuing magistrate’s finding of probable cause on the other fourteen clients, such that they are entitled to a Franks hearing. The Commonwealth contends that the affidavits set forth probable cause for each of the remaining fourteen clients who stated that they were coached by Ellis & Ellis employees.

Although Spencer’s inclusion of the six individuals was negligent, and may have even risen to the level of recklessness, the inclusion of these six individuals in the affidavit was not material to the finding of probable cause for the remaining fourteen. The fourteen remaining clients did in fact make the statements attributed to them, and probable cause existed to seize their ■files even without the inclusion of the statements attributed to the other six clients. A Franks hearing is not necessary because even if the provisions relating to the six clients were stricken from the affidavit, the affidavit would nonetheless establish probable cause to search for the files of the remaining fourteen clients.

d.Spencer’s Experience with the Drapeau, Frigo, and Cooper Files Gave Him Reason to Believe that the Files of Other Clients Would Not Contain Incriminating Evidence.

The defendants contend that Spencer knew, from a review of the Drapeau, Frigo, and Cooper files seized during the search of the Ellis & Ellis law offices on May 2, 1996, that the computer files of other clients would not contain incriminating information. This Court has previously determined that probable cause existed to seize each client’s files; that probable cause determination as to each client’s file cannot be disturbed by what was or was not found in another client’s file. Moreover, the Commonwealth is entitled to obtain a search warrant for mere evidence,²⁶ including evidence corroborating a witness’ statement that he or she met with a particular nurse and that the nurse instructed that witness to exaggerate injuries, as is the case here. Here the clients’ computer files contained information about which employees met with the client and when, evidence that would surely corroborate the client’s statements about nurse coaching. The seizure of the client files was therefore proper.

e.File of Harry Markarian

During the course of the computer search, Farwell searched for terms contained in a list he prepared in conjunction with IFD Attorney Marks. That list contained the name of an Ellis & Ellis client, Harry Markarian, even though Markarian was not listed in the second search warrant. Farwell downloaded and printed more than sixty documents relating to Markar-ian, but the overwhelmmg majority were not turned over to the Commonwealth. The Commonwealth conceded during the evidentiary hearing that Spencer’s affidavit did not provide any information about Mafkarian, and there was thus no probable cause to search for any documents relating to him. This Court will therefore suppress all computer documents relating to Markarian that were generated in response to his name.

2. The Issue of Sufficient Particularity

The defendants argue that the search for electronically stored evidence did not state with sufficient particularity the items to be seized. The Commonwealth asserts that the search warrants were sufficiently particular in light of the broad range of illegal activities allegedly occurring at Ellis & Ellis.

In the present case, Spencer’s affidavit establishes probable cause to believe that Ellis & Ellis attorneys were engaged in a wide-spread and ongoing pattern of fraud committed against workers’ compensation and motor vehicle insurers. The fact that the Commonwealth chose to focus on only thirty-seven of the firm’s many clients does not dispel the notion that the firm’s business was permeated with fraud, as that concept has been developed. Further, the fact that the warrant specifically identified those thirty-seven client files means only that the warrant did not allow Farwell to search unrelated files. In the instant case, like that of United States v. Schoffner, 826 F.2d 619, 631 (7th Cir.), cert. denied sub nom., Stange v. U.S., 484 U.S. 958 (1987), “a more particular description could [have] precluded] effective investigation of the crimes at issue.”

This Court accordingly finds that the warrant was sufficiently particular such that Farwell would only search for files for which probable cause had been established.

C. The Execution of the February 12, 1998 Search Warrant

The defendants again argue that the February 12, 1998 search warrant must have been executed within seven days of issuance, or in any event, within a constitutionally reasonable time such that the six-month period of searching pursuant to the February 12, 1998, completed in August of 1998, was unreasonable.

As stated supra, in Section I.B., this Court rejects the proposition urged by the defendants that Farwell should have completed searching the computer memory within seven days after seizure of the equipment. The search of computer memory must, however, have been accomplished within a reasonable time after seizure of the equipment. See Berger, 388 U.S. at 58-60; Cromer, 365 Mass. at 524.

In the instant case, the second warrant contained a list of thirty-two additional clients. Farwell completed the search of the file server and the back-up tapes for the information on these thirty-two individuals in approximately six months after the warrant was served while also completing the search pursuant to the May 1, 1996 warrants. Farwell began the second search promptly after receiving the search warrant, retained assistance to complete the search in a reasonable period of time, and spent a concentrated amount of time on the search. Based on the totality of the circumstances, this Court finds that the search conducted by Farwell pursuant to the second warrant was completed within a reasonable period of time.

m. DISCUSSION AND RULINGS IMPLICATING BOTH WARRANTS

In their motion to suppress electronically stored evidence, the defendants argue that all evidence obtained as a result of both searches must be suppressed because material and potentially exculpatory evidence was destroyed by the Commonwealth and because neither warrant provided adequate protection for the privileged documents. The Commonwealth asserts that Farwell’s use of Wipelnfo was appropriate and did not violate the defendants’ rights. The Commonwealth also argues that the warrants provided adequate protection for privileged documents.

A. The Destruction of Evidence

The defendants contend that by examining a copy of Farwell’s working hard drive, they would have been able to follow his footsteps and determine how exactly he conducted his search. The defendants claim that Farwell’s use of the Wipelnfo²⁷ program in June of 1998 destroyed evidence material to their case because it destroyed Farwell’s footsteps, and that such destruction prejudiced their defense. As a result, the defendants ask this Court to suppress all electronically stored evidence seized by the Commonwealth.

The Commonwealth’s obligation to preserve exculpatory evidence “grows out of [its] duty to disclose ‘evidence favorable to an accused upon request . . . where the evidence is material either to guilt or punishment.’ ” Commonwealth v. Sasville, 35 Mass.App.Ct. 15, 19 (1993), quoting Brady v. Maryland, 373 U.S. 83, 87 (1984). When a claim has been made that the Commonwealth has lost, destroyed, or otherwise failed to preserve evidence in its possession, custody, or control, a defendant must establish a “ ‘reasonable possibility, based on concrete evidence rather than a fertile imagination,’ that access to the [evidence] would have produced evidence favorable to [her] cause.” Commonwealth v. Woodward, 427 Mass. 659, 678 (1998), quoting Commonwealth v. Neal, 392 Mass. 1, 12 (1984). If the defendant meets this burden, the court will then “weigh the culpability of the Commonwealth, the materiality of the evidence and the potential prejudice to the defendant.” Commonwealth v. Willie, 400 Mass. 427, 432 (1987). “When the evidence no longer exists and the defendant has made a specific request for it, the defendant need only show a reasonable possibility that the evidence was exculpatory.” Commonwealth v. White, 47 Mass.App.Ct. 430, (1999), citing Sasville, 35 Mass.App.Ct. at 26 n.11.

Here, the defendants specifically requested that Farwell provide them with a copy of his working hard drive prior to his use of Wipelnfo, and thus, need only show the reasonable possibility that the destroyed evidence was exculpatory.

Farwell testified that as he loaded each back-up tape onto his working drive, the data contained on that tape overwrote any data that might have already existed on the machine. The defendants’ expert did not dispute this contention. Since Farwell had searched the back-up tapes separately, when he utilized the Wipelnfo program on June 3, 1998, he was erasing only a minute fraction of data. A copy of Farwell’s working hard drive in June of 1998 would thus not enable the defendants to recreate Farwell’s entire search, but would only permit them to see how the search was being conducted with reference to the information contained on his computer at that time. ²⁸

Additionally, Farwell testified that he did not actually open files during his search but instead utilized the view feature to determine the contents of a file. The hard drive, therefore, would have contained no record of which files he examined.²⁹ The defendants would therefore not have been able to reconstruct the path of Farwell’s search even if provided with a mirror image of Farwell’s working drive before he used the Wipelnfo program.

As such, the defendants have not established a reasonable possibility that a sector-level mirror image of Farwell’s hard drive as it existed on June 3, 1998 prior to Farwell’s use of the Wipelnfo program, would have produced any evidence favorable to their cause. Because the defendants have not met this burden, there is no need to apply the balancing test set out in Willie. See Willie, 400 Mass. at 432.

B. The Sufficiency of the Procedure for the Review of Privileged Documents

The defendants again argue that the procedure for the review of privileged documents set forth in the various warrants was constitutionally deficient. This Court incorporates its legal analysis from its Findings of Fact, Rulings of Law, and Order on Defendants’ Motion to Suppress Evidence, dated August 18, 1999 in determining that the review procedure, during and after the searches pursuant to both warrants, was constitutional and reasonable [10 Mass. L. Rptr. 429 (October 18, 1999)].

CONCLUSION

The execution of the search warrants on May 2, 1996 was carefully planned and executed with caution. The Commonwealth took pains to limit the intrusiveness of the search, taking as little of the computer system as possible and returning what was no longer needed. The Commonwealth was not obligated to return any of the original computer equipment or media it has retained for evidentiary purposes. The on-site execution of the search warrants was thus reasonable in all respects.

The length of time it took to complete the off-site searches of the Ellis & Ellis computer system, pursuant to both warrants, was not unreasonable under the circumstances of this case. A portion of the delay is attributable to defendants’ repeated efforts to stop the computer search while they litigated various issues; a portion of the delay is attributable to the novelty of such a search; a portion of the delay is attributable to court orders; and a portion of the delay is attributable to other work-related obligations of William Farwell. Defendants were not prejudiced by the length of time it took for the completion of the search because they received copies of all hard drives, software programs, and other media and equipment necessary to the operation of their law practice within several days of the search. The testimony at the hearing indicates that the Ellis & Ellis computer system was operational by May 7, 1996, which the defendants concede. Defendants’ claim that they were prejudiced by the Commonwealth’s failure to immediately return copies of the back-up tapes to them because of problems created in a civil case in early 1997 is not supported by the record.

Also without merit is defendants’ argument that Farwell’s use of the Wipelnfo program on June 3, 1998 constituted a prejudicial destruction of evidence. Farwell testified that the use of such a program to prepare computer media for a forensic search is a sound practice.³⁰ The Court accepts that representation. Although Farwell was put on notice that defense counsel had requested a duplicate of his working hard drive on May 22, 1998, the fact that he continued conducting the search mandated by the search warrants until such time as the court ordered that he stop was entirely reasonable considering the time pressure he was under to complete the search. Farwell was not instructed to use the Wipelnfo program by members of the prosecution team, and his testimony that his use of the program was not intended to thwart defendants’ efforts to conduct discovery but was an accepted and appropriate forensic procedure is corroborated by his use of the program in other related forensic computer searches he was conducting at the time.

The Court concludes that, with the exceptions noted in the Order that follows, the warrants in this case were supported by probable cause, were sufficiently particular, and provided adequate protection for privileged documents. Furthermore, this Court concludes that the searches of the computer system were constitutional and reasonable such that no items will be suppressed based on the execution of the warrants. Accordingly, except as catalogued below in the Order, the defendants’ motion will be denied.

ORDER

For the foregoing reasons, it is hereby ORDERED that the defendants’ motion to suppress electronically stored evidence be ALLOWED as to the following documents:

A. Regarding the May 1, 1996 search warrants:

all electronically stored evidence pertaining to, and generated as a result of information found in, the employment records of Dawn Piche and Marie Var-ney Mandeville, the client file of Vivian Delisa Melton, and the loan records. The search warrants lacked probable cause for their seizure and any computer documents would also be fruit of the poisonous tree;

B. Regarding the February 12, 1998 search warrant:

the computer files of Andrzej Orlowski, Orlando Santiago, and Harry Markarian. The affidavit in support of the search warrant application failed to set forth probable cause regarding these individuals.

In all other respects, the defendants’ motion to suppress evidence is DENIED.

2 Evidentiary hearings were held March 1-4 and 8-12, 1999; argument was heard on March 16, 1999.

3 The IFB is a private investigative agency established by statute for the investigation and prevention of suspected fraudulent insurance transactions, including automobile insurance fraud and workers’ compensation fraud. After investigation, if it is believed that a case warrants criminal action, the IFB may refer the case for prosecution to the IFD which is dedicated to the investigation and prosecution of insurance fraud. Prosecutorial decisions are then made by the IFD. For a more complete explanation of the relationship between the IFB and the IFD, see this Court’s Memorandum of Decision and Order on Defendants’ Motion to Dismiss, Disqualify or for Other Appropriate Relief, dated July 31, 1998 [Commonwealth v. Ellis, 8 Mass. L. Rptr. No 30, 678 (September 28, 1998)].

4 It was Farwell’s understanding that once the equipment had been seized from the law firm, it would be permissible for him to receive information form the IFD.

5 Farwell performed this quick disconnection because of his concern that the law office contained a devire that could effect the irreversible erasure of computer information. Oftentimes, these devices can be accessed via the telephone lines. It has been noted by many authorities that those searching computers must immediately secure the scene around the computers and even then, there is the potential for remote or rapid destruction of evidence. See, e.g., Franklin Clark and Ken Diliberto, Investigating Computer Crime, p. 54 (1996); Kenneth S. Rosenblatt, High Technology Crime, pp. 223, 228, 224-49; David Icove, Karl Seger, and William VonStorch, Computer Crime; A Crimefighter’s Handbook, pp. 383-8491995); “Federal Guidelines for Searching and Seizing Computers," 56 Crim.L.Rptr. 2023, 2040 (Dec. 21, 1994).

6 A keyword search, when run on the DS-II program, produces output of all computer files that contain that keyword. That output is commonly called hits. The program also provides one line of text to provide context for the hits. In this particular case, prior to the search, Farwell had prepared a file containing the names of targets set forth in the warrant. When using DS-II, it was not necessary to open or view the file to determine whether the keyword was contained therein; however, it was still necessary to view the file to determine whether the hit was within the categories of documents permitted to be seized.

7 For some reason, on-site searching could not be conducted on the two second floor computers. After Farwell brought those computers to the Attorney General’s Office, he again attempted a keyword search. When the search provided no hits, the computers were returned to the law firm the week following the search.

8 While Farwell was producing the back-up, the operating system indicated that the second drive of the file server, the “duplex drive,” failed. Farwell removed the failed drive and replaced it with the drive purchased by the Attorney General’s Office. With the assistance of Forgetta, Farwell configured the new disk to work with the Novell system, and copied the information on the primary drive to the new secondary drive. It took two hours to make this sector-level mirror image copy. He took the original file server hard drive, placed it in a magnetic safe drive, then in a padded transport bag, sealed it with evidence tape, recorded the case number and name, and delivered it to the state police unit within the Attorney General’s Office.

9 Prior to beginning his search that day, Farwell made an additional back-up copy of the hard drive. Based on the failure of the duplex drive the previous day, and based on his belief that the power supply was undersized for the unit, Farwell believed the computer was unstable and thought it would be advisable to create more than one back-up copy. He has kept both copies in his possession since that time.

10 The other deleted files retrieved were the back-up copies of files still in existence on the file server.

11 The “view" feature of the Novell operating system allows a user to look at the contents of a file without actually opening it. The “view” option is particularly useful in forensic investigations, as it does not alter any of the properties of the existing file, such as the date last accessed.

12 At this time, Farwell was aware that his search had not uncovered a number of files that were within the scope of the search warrant, but he was also aware that the IFD would not know that fact until after the special master and the court had completed their reviews and released the documents to the Commonwealth.

13 Judge Kottmyer stated in her margin order that she did not intend for her June 2, 1997 Order to preclude further downloading.

14 No evidence was presented to this Court to assist in determining why Judge Kottmyer thought this insertion necessary or what her intent was.

15 When a back-up copy of a disk is made, all that is transferred to the copy is the active data still in existence on the original disk. Previously deleted files or partially deleted files, which are stored in the slack space, are not transferred to the copy.

16 WipeInfo is a program which erases a hard drive prior to restoring a duplicate copy onto a piece of media. Farwell used this program prior to June 3, 1998 without incident, but did not intend to delete anything that showed how he conducted his search. His intention was to get the file server duplicated again so he could begin executing the second warrant prior to the August 17, 1998 deadline set by Judge Kottmyer.

Farwell testified that the prosecution team had not instructed him to use Wipelnfo, he had not informed the prosecution of his intent to use the program, and he did not inform the prosecution after he had used the program.

17 By this time, Farwell had three JAZ drives running simultaneously. The Board of Bar Overseers had purchased two drives as part of Farwell's “lab" for future computer investigations and the IFD purchased a third drive to facilitate this search.

18 To the extent that any documents were suppressed based on the sufficiency of the warrant, i.e., the employment records of Dawn Piche and Marie Varney Mandeville, the client file of Vivian Delisa Melton, and the loan records, any electronically stored evidence concerning these items must also be suppressed.

19 See, e.g., United States v. Upham, 168 F.3d 532, 535 (1st. Cir.), cert. denied, 119 S.Ct. 2353 (1999) (“it is no easy task to search a well-laden hard drive by going through all of the information it contains, let alone to search through it and the disks for information that may have been ‘deleted’ ’’); United States v. Hunter, 13 F.Supp.2d 574, 583 (D.Vt. 1998) (”[o]ften it is simply impractical to search a computer at the search site because of the time and expertise required to unlock all sources of information”); United States v. Gawrysiak, 972 F.Supp. 853, 866 (D.N.J. 1997) (“[a] reasonable search of computer files may include copying those files on to a disk on the scene, for later time-consuming review of the index of documents to cull the relevant time periods and subject matters while returning the remainder’’); United States v. Yung, 786 F. Supp. 1561, 1569 (D.Kan. 1992) (computer files “clearly could not be individually reviewed prior to completion of the search.”); United States v. Sissler, 966 F.2d 1455 (6th Cir.1992), cert. denied, 506 U.S. 1079 (1993) (police permitted to remove computers from defendant’s residence to continue search off-site and to allow computer expert “to ‘crack’ [passwords and other security devices], a process that takes some time and effort”). Cf. United States v. Santarelli, 778 F.2d 609, 614 (11th Cir. 1985) (FBI agents seized contents of four drawer filing cabinet to review off-site “because of the prolonged period it would have taken them to perform this task at the residence”).

20 Indeed, this Court notes that Cromer itself recognizes an exception to the seven-day requirement, which may in fact be applicable here. “[I]t is clear that the police must have some leeway in the execution of search warrants, and in some cases there may well be circumstances which justify delays which normally would be unreasonable." Cromer, 365 Mass. at 525.

21 The defendants hired an expert to analyze Farwell’s search techniques, Randall Davis, a professor of computer science at the Massachusetts Institute of Technology. Davis posited that Farwell could have completed his search of the Ellis & Ellis computer system within seven days by adhering to the following schedule: (1) Make two mirror image copies of the Ellis & Ellis file server; (2) Run the Netware Salvage Utility to recover deleted files which the operating system was still tracking. (3) Unencrypt files, by using a program like WRPASS. At this point, the disk would now have the original files from Ellis & Ellis disk and every file ready to be searched because no encryption would be present. (4) Use a search program such as Disk Search II, Textsearch, Expert Witness, or File Find to search the hard drive. While searching, one could use additional computers to download back-up tapes. Four computers could be running simultaneously with DS-II searches. (5) Analyze the output. This output analysis could be done as the other machines were running.

22 Because the warrant execution had not yet ended, it was also permissible for Farwell to “retrace [his] steps and search more carefully areas searched earlier.” Wayne R. LaFave, Search and Seizure, §4.10(d) (3d ed. 1996), citing State v. Sanford, 830 P.2d 14 (1992).

23 Farwell testified that it would be impossible to find and analyze the hits by sector-level location.

24 The defendants' computer expert testified that Farwell could have used a different search program to conduct the search rather than deciding to undertake a file-by-file search of the computer files. One of the programs suggested by the defense expert was File Find, a program which was available on the market in May of 1996. Farwell was aware of File Find and had tested it previously, but had ceased using the program prior to this search because he had several problems with the way it operated. First, Farwell stated that File Find searches only one keyword term at a time, whereas DS-II has the capability to simultaneously search multiple terms. Second, Farwell stated that he was uncomfortable with the program’s propensity to “write” to a hard drive, although after reading the defense expert’s affidavit in February of 1999, he devised a way to avoid that problem. Third, Farwell claimed that File Find would not search deleted or purged files, partial or fragmented files, or passworded or locked files, unlike DS-II. Fourth, Farwell stated that File Find does not provide a line of context for the keyword, as DS-II does, and that he would have been required to view every single document listed in the output to determine if the file was within the scope of the warrant.

25 Exhibit E to the Commonwealth’s opposition to the motion to suppress electronic evidence is a memorandum from Spencer which recounts the basis for seizing the files of the thirty-two named clients. With regard to Santiago, Spencer states that Santiago told him on September 3, 1996 that he was coached by a “heavy set female Ellis & Ellis employee.” If Spencer had recounted that information in his affidavit in support of the search warrant application, the probable cause requirement would have been satisfied. Standing alone, however, the affidavit did not meet that threshold.

26 For a discussion on the mere evidence doctrine, see this Court’s Findings of Fact, Rulings of Law, and Order on Defendants' Motion to Suppress Evidence, dated August 18, 1999, at Section II. B. 5.

27 Farwell testified that when he used the Wipelnfo program on June 3, 1998, the only information present on his working drive was his copy of Novell operating system, a DOS partition, several computer programs, and the last two operations that he performed: the April 26, 1996 and April 29, 1996 back-up tapes which had been restored to the server.

28 The defendants did in fact receive a copy of Farwell’s working hard drive shortly thereafter, and they continued to receive copies of the hard drive as it existed at any point before Farwell again utilized the Wipelnfo program.

29 The defendants’ expert even conceded that Farwell’s use of the view function would leave no trail.

30 This Court also notes that the use of Wipelnfo is, in fact, necessary to “wipe” the disk clean so that previous material does not “infect” current data. See High Technology Crime, supra at p. 296.