390 July 8, 2026 No. 648
This is a nonprecedential memorandum opinion pursuant to ORAP 10.30 and may not be cited except as provided in ORAP 10.30(1).
IN THE COURT OF APPEALS OF THE STATE OF OREGON
STATE OF OREGON, Plaintiff-Respondent, v. ABEL SANCHEZ-ANAYA, Defendant-Appellant. Linn County Circuit Court 21CR51151; A182651
Rachel Kittson-MaQatish, Judge. Submitted June 9, 2025. Bear Wilner-Nugent filed the brief for appellant. Dan Rayfield, Attorney General, Benjamin Gutman, Solicitor General, and Peenesh Shah, Assistant Attorney General, filed the brief for respondent. Before Aoyagi, Presiding Judge, Egan, Judge, and Pagán, Judge. PAGÁN, J. Affirmed. Nonprecedential Memo Op: 351 Or App 390 (2026) 391
PAGÁN, J. Defendant appeals from a judgment of conviction, after a jury trial, of second-degree murder, assigning error to the trial court’s denial of his motion to suppress evidence resulting from a warrantless extraction of data from his mobile phone, asserting that the extraction resulted in a vio- lation of his federal constitutional right, under the Fourth Amendment to the United States Constitution, to be free from unreasonable search and seizure.1 We conclude that the trial court did not err and therefore affirm. Officers seized defendant’s iPhone during his arrest 10 days after the victim’s murder. Shortly thereafter, a detec- tive trained in digital forensics, with certification for cell phone extraction and specific knowledge of iPhones, used a device called a GrayKey to extract the data from defen- dant’s iPhone to preserve it. The data could only be stored in the GrayKey and not read at that point. At the suppression hearing, the detective testified that he understood iPhones to run processes during idle time that could make it difficult to determine the iPhone’s passcode and to extract data.2 The detective testified that, based on information from GrayKey 1 The Fourth Amendment provides: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” 2 The detective explained that a GrayKey is used to “crack” a passcode and extract data from an iPhone. He explained the need to access the iPhone as soon as possible after the owner last entered the passcode: “GrayKey put out information * * * I’m estimating about a year after we received the machine that you stand a much greater chance of being able to crack the code or get into the passcode or figure out what the passcode is if you connect it as quickly as possible to the last time that the user input the code. And the longer that that goes, the more kind of security levels that the machine, the Apple device itself goes into, right? So you stand a much greater chance of being able to crack the code within an hour of them inputting it as opposed to 24 hours of them inputting it. “Q: Okay. So based on time from when the user last introduced or inputted the code, it becomes progressively, per your training, harder to potentially crack the code. “A: Correct.” The detective further described the processes within the iPhone that cause data to dissipate quickly when the iPhone is idle: 392 State v. Sanchez-Anaya
and his own knowledge and experience, he was aware that data dissipates when an iPhone has been idle, and that there was concern that data from the date of the murder 10 days before could have dissipated. For those reasons, the detec- tive testified, he extracted the iPhone’s digital contents to preserve them and quickly sought a search warrant, which a magistrate issued the next day. The detective testified that the data extracted to the GrayKey was unreadable and could not be read until it was further analyzed by a differ- ent tool. It was not until after the warrant was obtained that police used that different tool to analyze the data from defendant’s iPhone. Defendant did not dispute that the detective had probable cause to believe that his iPhone contained digital evidence of the victim’s murder. However, he moved to sup- press the data extracted from the iPhone in the initial war- rantless extraction. The state responded that the warrant- less extraction was lawful under the exigency exception to the warrant requirement. The trial court denied defendant’s motion, agreeing with the state that exigent circumstances, as an exception to the warrant requirement, justified the seizure. On appeal, defendant contends that the detective’s testimony was not sufficient to establish exigency, so as to support the warrantless extraction of data from defen- dant’s iPhone. Defendant argues that the state did not prove that the detective had adequate knowledge of the iPhone’s
“Q: Okay. And then tell us about the iPhone software itself. You said you’re familiar with certain * * * functions of the iPhone itself, but the soft- ware has dynamics, which mean you have to act fast. What do you mean by that? “A: So the way Apple designs its operating system is that all the vari- ous data categories are stored in databases inside the phone. And so what we’ve discovered over time. Because Apple obviously doesn’t provide us with this information. We have to try to figure it out on our own—is that some of this data dissipates or is purged from the file system or from the database, maybe to make room or whatever for the next set of data. I don’t know. But it’s purged from that. And * * * it happens at various intervals, sometimes as quick as within a day. “So * * * we don’t know exactly what operating systems are on people’s devices when we get them in * * * and our testing isn’t always up to date, so we have to move as quickly as we can in order to preserve * * * that information before it dissipates, before it’s purged.” Nonprecedential Memo Op: 351 Or App 390 (2026) 393
software processes to support a finding that those pro- cesses would function to destroy evidence, and that expert testimony or technical evidence was required to establish that idle time can make it more difficult to extract data. Specifically, defendant notes that, on cross-examination, the detective testified that he did not have the necessary information from which to determine the specific number of hours after which the data on defendant’s iPhone would have become unavailable to the police and did not know by what exact mechanism data dissipated on the iPhone. Defendant argues that the detective’s inability to describe how the iPhone actually works to dissipate data made him “unsuitable to rebut the presumption of irregularity flowing from the warrantless seizure.” The state responds that it was not necessary for the officer to be aware of and testify as to the inner workings of the iPhone and that the detective’s testimony concerning his knowledge of the iPhone and access to its data was sufficient to establish exigency. Thus, the state contends that the trial court correctly denied defendant’s motion to suppress. The state further argues that any error in denying the motion was harmless, because minimal evidence from the iPhone was used at trial. We conclude that the trial court correctly ruled that the warrantless extraction of data from defendant’s iPhone was permissible under the exigent circumstances exception to the warrant requirement. The exigent circumstances exception to the Fourth Amendment’s warrant requirement applies when an officer “might reasonably have believed that he was confronted with an emergency, in which the delay necessary to obtain a warrant, under the circumstances, threatened the destruction of evidence.” Missouri v. McNeely, 569 US 141, 145, 133 S Ct 1552, 185 L Ed 2d 696 (2013) (cit- ing Schmerber v. California, 384 US 757, 770, 86 S Ct 1826, 16 L Ed 2d 908 (1966)).
Free access — add to your briefcase to read the full text and ask questions with AI
390 July 8, 2026 No. 648
This is a nonprecedential memorandum opinion pursuant to ORAP 10.30 and may not be cited except as provided in ORAP 10.30(1).
IN THE COURT OF APPEALS OF THE STATE OF OREGON
STATE OF OREGON, Plaintiff-Respondent, v. ABEL SANCHEZ-ANAYA, Defendant-Appellant. Linn County Circuit Court 21CR51151; A182651
Rachel Kittson-MaQatish, Judge. Submitted June 9, 2025. Bear Wilner-Nugent filed the brief for appellant. Dan Rayfield, Attorney General, Benjamin Gutman, Solicitor General, and Peenesh Shah, Assistant Attorney General, filed the brief for respondent. Before Aoyagi, Presiding Judge, Egan, Judge, and Pagán, Judge. PAGÁN, J. Affirmed. Nonprecedential Memo Op: 351 Or App 390 (2026) 391
PAGÁN, J. Defendant appeals from a judgment of conviction, after a jury trial, of second-degree murder, assigning error to the trial court’s denial of his motion to suppress evidence resulting from a warrantless extraction of data from his mobile phone, asserting that the extraction resulted in a vio- lation of his federal constitutional right, under the Fourth Amendment to the United States Constitution, to be free from unreasonable search and seizure.1 We conclude that the trial court did not err and therefore affirm. Officers seized defendant’s iPhone during his arrest 10 days after the victim’s murder. Shortly thereafter, a detec- tive trained in digital forensics, with certification for cell phone extraction and specific knowledge of iPhones, used a device called a GrayKey to extract the data from defen- dant’s iPhone to preserve it. The data could only be stored in the GrayKey and not read at that point. At the suppression hearing, the detective testified that he understood iPhones to run processes during idle time that could make it difficult to determine the iPhone’s passcode and to extract data.2 The detective testified that, based on information from GrayKey 1 The Fourth Amendment provides: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” 2 The detective explained that a GrayKey is used to “crack” a passcode and extract data from an iPhone. He explained the need to access the iPhone as soon as possible after the owner last entered the passcode: “GrayKey put out information * * * I’m estimating about a year after we received the machine that you stand a much greater chance of being able to crack the code or get into the passcode or figure out what the passcode is if you connect it as quickly as possible to the last time that the user input the code. And the longer that that goes, the more kind of security levels that the machine, the Apple device itself goes into, right? So you stand a much greater chance of being able to crack the code within an hour of them inputting it as opposed to 24 hours of them inputting it. “Q: Okay. So based on time from when the user last introduced or inputted the code, it becomes progressively, per your training, harder to potentially crack the code. “A: Correct.” The detective further described the processes within the iPhone that cause data to dissipate quickly when the iPhone is idle: 392 State v. Sanchez-Anaya
and his own knowledge and experience, he was aware that data dissipates when an iPhone has been idle, and that there was concern that data from the date of the murder 10 days before could have dissipated. For those reasons, the detec- tive testified, he extracted the iPhone’s digital contents to preserve them and quickly sought a search warrant, which a magistrate issued the next day. The detective testified that the data extracted to the GrayKey was unreadable and could not be read until it was further analyzed by a differ- ent tool. It was not until after the warrant was obtained that police used that different tool to analyze the data from defendant’s iPhone. Defendant did not dispute that the detective had probable cause to believe that his iPhone contained digital evidence of the victim’s murder. However, he moved to sup- press the data extracted from the iPhone in the initial war- rantless extraction. The state responded that the warrant- less extraction was lawful under the exigency exception to the warrant requirement. The trial court denied defendant’s motion, agreeing with the state that exigent circumstances, as an exception to the warrant requirement, justified the seizure. On appeal, defendant contends that the detective’s testimony was not sufficient to establish exigency, so as to support the warrantless extraction of data from defen- dant’s iPhone. Defendant argues that the state did not prove that the detective had adequate knowledge of the iPhone’s
“Q: Okay. And then tell us about the iPhone software itself. You said you’re familiar with certain * * * functions of the iPhone itself, but the soft- ware has dynamics, which mean you have to act fast. What do you mean by that? “A: So the way Apple designs its operating system is that all the vari- ous data categories are stored in databases inside the phone. And so what we’ve discovered over time. Because Apple obviously doesn’t provide us with this information. We have to try to figure it out on our own—is that some of this data dissipates or is purged from the file system or from the database, maybe to make room or whatever for the next set of data. I don’t know. But it’s purged from that. And * * * it happens at various intervals, sometimes as quick as within a day. “So * * * we don’t know exactly what operating systems are on people’s devices when we get them in * * * and our testing isn’t always up to date, so we have to move as quickly as we can in order to preserve * * * that information before it dissipates, before it’s purged.” Nonprecedential Memo Op: 351 Or App 390 (2026) 393
software processes to support a finding that those pro- cesses would function to destroy evidence, and that expert testimony or technical evidence was required to establish that idle time can make it more difficult to extract data. Specifically, defendant notes that, on cross-examination, the detective testified that he did not have the necessary information from which to determine the specific number of hours after which the data on defendant’s iPhone would have become unavailable to the police and did not know by what exact mechanism data dissipated on the iPhone. Defendant argues that the detective’s inability to describe how the iPhone actually works to dissipate data made him “unsuitable to rebut the presumption of irregularity flowing from the warrantless seizure.” The state responds that it was not necessary for the officer to be aware of and testify as to the inner workings of the iPhone and that the detective’s testimony concerning his knowledge of the iPhone and access to its data was sufficient to establish exigency. Thus, the state contends that the trial court correctly denied defendant’s motion to suppress. The state further argues that any error in denying the motion was harmless, because minimal evidence from the iPhone was used at trial. We conclude that the trial court correctly ruled that the warrantless extraction of data from defendant’s iPhone was permissible under the exigent circumstances exception to the warrant requirement. The exigent circumstances exception to the Fourth Amendment’s warrant requirement applies when an officer “might reasonably have believed that he was confronted with an emergency, in which the delay necessary to obtain a warrant, under the circumstances, threatened the destruction of evidence.” Missouri v. McNeely, 569 US 141, 145, 133 S Ct 1552, 185 L Ed 2d 696 (2013) (cit- ing Schmerber v. California, 384 US 757, 770, 86 S Ct 1826, 16 L Ed 2d 908 (1966)). The exception’s application is subject to a reasonable-belief standard that is to be judged based on facts and circumstances known to the police at the time of the warrantless search. See, e.g., Arkansas v. Sanders, 442 US 753, 763, 99 S Ct 2586, 61 L Ed 2d 235 (1979) (exi- gency “must be assessed at the point immediately before the 394 State v. Sanchez-Anaya
search”); United States v. Black, 482 F3d 1035, 1040 (9th Cir), cert den, 552 US 1023 (2007) (“[W]hether the actions of the police are objectively reasonable is to be judged by the circumstances known to them.”). Here, we conclude that the record shows that, at the time of the extraction of data from defendant’s iPhone, the detective who conducted the extraction had an objectively reasonable belief that if access to the data was delayed, access to defendant’s passcode would become more difficult. And the detective also had an objectively reasonable belief that the evidence sought from defendant’s iPhone could already have dissipated and could further dissipate if not extracted. We conclude for those reasons that the trial court did not err in denying defendant’s motion to suppress based on exigency. Affirmed.