Probable Cause Persistence Permits Multi‑Year, Multi‑Stage Searches of Secured Digital Devices

Introduction

In United States v. Joshua White, No. 25-5158 (6th Cir. Oct. 17, 2025) (not recommended for publication), the Sixth Circuit affirmed the denial of suppression motions and a Franks hearing after federal agents, acting on a foreign law enforcement tip about Tor-based child-exploitation content, searched Joshua White’s residence pursuant to a warrant. Agents seized numerous electronic devices, performed an initial forensic review revealing child pornography, and later—after technological advances defeated encryption—conducted additional searches over a multi-year period that yielded more contraband. White ultimately pleaded guilty to misprision of a felony, preserving for appeal the suppression and Franks denials.

The appeal presented two core Fourth Amendment questions: (1) whether the government exceeded the scope of the warrant by examining devices that appeared not to have been accessed for a decade, and (2) whether the Fourth Amendment permits follow-on, more intensive examinations of secured devices (and forensic images) months or years after an initial review. A third issue concerned whether the district court erred by denying a Franks hearing based on alleged misstatements and omissions in the warrant affidavit.

Summary of the Opinion

The Sixth Circuit, per Judge Clay, affirmed:

Scope of warrant: The search did not devolve into an impermissible general search. The affidavit and warrant were not time-limited, and Sixth Circuit precedent recognizes that child-pornography offenders retain contraband for long periods. Thus, reviewing devices that may not have been accessed for years did not exceed the warrant’s scope or eviscerate probable cause.
Continued searches: Applying United States v. Castro, the court held that multi-stage searches over months or years are permissible so long as the device or its forensic image remains secured, the search stays within original probable cause, and probable cause has not dissipated. The government satisfied those conditions here, including when it later overcame encryption with upgraded forensic tools.
Franks hearing: White failed to make the required substantial preliminary showing of knowing or reckless falsehoods or material omissions. His assertions were conclusory and unsupported by affidavits or reliable evidence. The district court correctly denied a Franks hearing.

Analysis

Precedents Cited and Their Influence

Standards of review:
- United States v. Bateman; United States v. Moorehead; United States v. Powell; United States v. Pasquarille. These cases anchor the mixed standard: clear-error for factual findings; de novo for legal conclusions; affirmance if the result can be justified on any ground.
Warrant, exclusionary rule, and scope:
- United States v. Malveaux; Knox County Educ. Ass’n v. Knox County Bd. of Educ. Reiterate the warrant and probable-cause baseline for reasonableness.
- United States v. Lewis; United States v. Rice. Frame the exclusionary rule’s remedial backdrop.
- United States v. Garcia; Brindley v. Best. Provide the test for when a valid search becomes an impermissible general search—officers’ flagrant disregard for warrant limits.
Child-pornography staleness/retention logic:
- United States v. Frechette; United States v. Paull. The Sixth Circuit has repeatedly recognized child pornography as a long-term, home-based offense; contraband is commonly retained, reducing staleness concerns. This directly supported the court’s rejection of a temporal limitation on the search scope.
Probable cause dissipation:
- United States v. Sheckles; Hernandez v. Boles. These cases delineate when new facts may dissipate probable cause—e.g., a fruitless search—versus when it persists. Here, the initial forensic review produced incriminating material, so any suggestion of dissipation was untenable.
Multi-stage device searches:
- United States v. Keszthelyi. Articulates the general rule that a warrant authorizes only one search, setting up the tension in the digital context.
- United States v. Castro (6th Cir. 2018). The cornerstone precedent allowing later, more detailed searches of lawfully seized and secured electronic devices, provided the search does not exceed original probable cause; approval even when the second search occurs months or years later.
- United States v. Evers (6th Cir. 2012); United States v. Johnston (9th Cir. 2015). Reinforce that subsequent, deeper forensic analysis can be lawful where devices remain secured and the search stays within the warrant’s scope.
Franks challenges:
- Franks v. Delaware; United States v. Bennett; United States v. Archibald; United States v. Mastromatteo; United States v. Young; United States v. Graham; United States v. Bateman; United States v. Davis. These decisions collectively set the heavy burden to obtain a Franks hearing: a substantial preliminary showing that the affiant knowingly or recklessly made false statements or material omissions necessary to probable cause, supported by affidavits or reliable proof, with an even higher bar for omissions.
- United States v. Pirosko; United States v. Vanderweele. Address waiver and preservation in plea agreements; issues not raised in the reserved motions are forfeited on appeal.

Legal Reasoning

The court’s reasoning proceeds in two integrated stages: scope/persistence of probable cause and permissibility of multi-stage searches, followed by the Franks analysis.

1) Scope of the warrant and temporal concerns

The affidavit connected White’s IP address to a Tor-hosted child-exploitation site on April 11, 2019, and included expert assertions common in child-pornography investigations: that offenders “almost always” store such material at home and retain it for years; and that some cyclically download, view, and delete content. The warrant’s Attachment B authorized seizure of materials constituting evidence of 18 U.S.C. § 2252A(a)(5)(B) without any date restriction.

Against that backdrop, White’s claim—that agents exceeded the warrant’s scope by searching devices not accessed for a decade—failed for three reasons:

The affidavit and warrant contained no temporal limitation; imposing one post hoc would contradict the judicially authorized scope.
Frechette and Paull recognize the durable nature of child-pornography evidence and the long-term retention pattern; thus, the mere age of device use does not render the search unreasonable.
To show an impermissible “general search,” a defendant must demonstrate flagrant disregard for warrant limits. Here, agents searched for the very evidence specified—child pornography and instrumentalities—across devices located at the residence authorized by the warrant.

The dissipation argument also failed. New information may sometimes negate previously existing probable cause, particularly when searches are fruitless. But here, the initial 2021 review uncovered contraband and searches tailored to the warrant. That result confirms, rather than undermines, the continued existence of probable cause. Sheckles; Hernandez.

2) Multi-stage searches over time, forensic images, and encryption

The court applied Castro’s digital-search framework: officers may conduct later, more detailed searches of lawfully seized and secured electronic devices (or their forensic images), so long as those searches do not exceed the original probable cause and probable cause has not dissipated. Johnston supports that these follow-on searches may occur months or years later.

Several details were pivotal:

Secured evidence: Although many physical devices were eventually returned at White’s request, agents retained four devices with incriminating evidence and kept forensic images (digital copies) of all seized devices. The opinion treats forensic images as “secured” evidence, consistent with Castro’s logic.
Encryption and technological advances: At first, encryption limited full access. Later advances allowed agents to “defeat the encryption” and recover additional images in 2023. The timing reflected capability, not lack of diligence, and remains permissible under Castro.
No “new information” precondition: White argued Castro requires fresh intelligence casting existing evidence in a new light. The court rejected this gloss. While new information may justify revisiting secured evidence, Castro does not impose that as a requirement.
Diligence: The record did not show lack of diligence. Regardless, Castro allows longer intervals; the dispositive questions are scope, security of evidence, and continuing probable cause.

3) Franks hearing

White asserted four misstatements/omissions regarding the affiant’s description of images available on the site, whether he “accessed” the site, the purported “zero duration” of contact (suggesting accidental access), and lack of login credentials. The court rejected these arguments because:

Franks imposes a heavy threshold: a substantial preliminary showing of knowing or reckless falsehoods or material omissions necessary to probable cause, supported by affidavits or reliable statements. Conclusory allegations are insufficient.
White offered no affidavits, reliable witness statements, or comparable proof. The record, including his concession that images “were available via a link from the [target website] at the time the agent accessed them,” undermined his challenge regarding the content’s availability.
Given the absence of a substantial preliminary showing, the court did not proceed to excise or supplement the affidavit to test whether probable cause would remain.

Finally, additional arguments—for example, disputing the affidavit’s description of U.S. involvement with the foreign law-enforcement tip—were deemed waived because they were not included in the reserved motions under the plea agreement. Related civil-asset-forfeiture critiques were likewise unpreserved.

Impact

Although nonprecedential, the opinion reinforces and clarifies several operational rules in the Sixth Circuit:

Probable cause persistence in digital child-exploitation cases: Courts continue to accept the long-term retention inference to sustain warrants and broad temporal scopes for searches. Defendants face an uphill battle arguing that device age, by itself, curtails search authority.
Iterative forensic examinations are lawful: Castro’s rule is robust. Agents may return to secured devices or forensic images for more intensive analysis months or years later, including after improving their technical capabilities, provided they stay within the original probable cause.
Forensic images count as “secured” evidence: This opinion implicitly recognizes that retaining forensic images can preserve the government’s ability to lawfully continue analysis even if the physical device is returned.
Encryption does not immunize data from later review: The inability to decrypt at time A does not foreclose decryption at time B. Later breakthroughs do not require a new warrant if the original search authority and probable cause persist.
High bar for Franks: Conclusory attacks on affidavits—without affidavits, documentary proof, or reliable statements—will not trigger a Franks hearing. Omissions are even harder to leverage than misstatements.
Issue preservation matters: Arguments not included in suppression or Franks motions reserved by a plea agreement are typically waived on appeal.

Practically, investigators will view this as validation of imaging-and-hold practices and as permission to conduct renewed analysis when tools improve. Defense counsel should anticipate the need for targeted, evidence-backed challenges—both to particularized scope on the front end (warrant drafting) and to later analyses (e.g., showing genuine dissipation of probable cause or that searches strayed beyond the warrant).

Complex Concepts Simplified

Tor and .onion sites: Tor is an anonymity network. Accessing Tor-hosted “hidden services” requires special software and knowledge of a long, algorithmically generated .onion address. Accidental access is unlikely, a fact courts credit in establishing intent to view illicit content.
Forensic images: Bit-for-bit copies of storage media made so analysts can examine data without altering original devices. Retaining these images allows later, lawful analysis under the original warrant if they remain secured and within scope.
“Secured” evidence: Evidence remains under government control and chain-of-custody, preventing tampering or loss. Secured forensic images satisfy this condition even if physical devices are returned.
Probable cause dissipation: New facts can sometimes negate earlier probable cause (e.g., a truly fruitless search). But if a search yields contraband, dissipation is unlikely.
General search concern: Even a valid warrant can be executed unlawfully if officers flagrantly disregard its limits, transforming the search into an impermissible general search. The touchstone is reasonableness within warrant boundaries.
Franks hearing: A mini-trial on whether the warrant affidavit included knowing/reckless falsehoods or material omissions necessary to probable cause. To get the hearing, the defendant must submit concrete evidence (affidavits, reliable statements), not speculation.
Misprision of a felony (18 U.S.C. § 4): Concealment of a known felony and failure to report it promptly. Here, White pled to misprision based on an underlying child-pornography felony; he reserved appellate rights only as to suppression and Franks issues.

Conclusion

United States v. White reinforces established Sixth Circuit doctrine at the intersection of digital forensics and the Fourth Amendment. The court confirms that where a warrant authorizes seizure and search for child-exploitation evidence—an offense type marked by long-term retention—agents may reasonably examine older devices without a temporal cap and may later conduct deeper analyses of secured devices and forensic images, even years after the initial review, especially when encryption initially thwarts access. Probable cause persistence, not calendar time, governs the permissibility of these iterative searches.

On the affidavit front, the decision is a reminder that Franks remains a steep climb: defendants must come forward with specific, reliable proof of knowing or reckless falsehoods or material omissions necessary to probable cause. Conclusory claims will not open the door to an evidentiary hearing.

Though nonprecedential, White’s reasoning will be persuasive within the Sixth Circuit. It offers practical guidance for investigators handling encrypted media and forensic imaging and signals to defense counsel that successful challenges require well-documented, precisely framed arguments about scope, dissipation, and affidavit integrity.