AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

Mobile Devices/Computers

Legal Disclaimer: 

The information listed below is purely informational in nature and not meant to be a substitute for legal advice. One should consult with their respective jurisdiction’s district attorney, prosecutor, judge, etc prior to using this language for any legal process in an actual investigation. AboutDFIR and its authors are not liable for any content, accuracy, or context.

Search Warrant Language Template (Mobile Device)

The person, place, or thing to be searched is described as and is located at:

The following device(s):
Apple iPhone 6S Plus
Color: Silver
Model: A1687
FCC ID: BCG-E2944A
IC: 579C-E2944A
Serial: 1234567890
IMEI: 1234QWER5678TYUI90OP
Owner: SuspectFirst SuspectMiddle SuspectLast

Currently located at:
*insert location here*

Examples:

Located on the suspect at the time of arrest

123 Anywhere St
Anytown, USA, 12345

Somewhere Township Police Department’s Evidence Room
123 Somewhere Dr
Somewhere, USA, 23456

The PROPERTY to be searched for, seized, and searched if found, is specifically described as:

Evidence of the crime of *insert applicable crime(s)/statute(s) here* including but not limited to:

The Apple iPhone 6S Plus listed above and its entire data contents (active/deleted/drafts) including the SIM card and any attached data storage media including but not limited to:

Passcode and/or pattern lock code, contacts, call history lists (including received, dialed, and missed calls), pictures including all EXIF and geotagging information located therein, videos, SMS/MMS Messages, iMessages (for iPhones), application data, user account information, subscriber/owner information, incoming and outgoing email messages, notes, GPS directions, installed applications and corresponding databases, audio files including voicemails and voice memos, internet usage history, Wi-Fi network information, and call logs

Search Warrant Language Template (Computer)

The person, place, or thing to be searched is described as and is located at:

The following device(s):
Dell Desktop Computer
Color: Black
Model: Inspiron 3671
Service Tag: 1234ABC
Owner: SuspectFirst SuspectMiddle SuspectLast

Currently located at:
*insert location here*

Examples:
123 Anywhere St
Anytown, USA, 12345

Somewhere Township Police Department’s Evidence Room
123 Somewhere Dr
Somewhere, USA, 23456

The PROPERTY to be searched for, seized, and searched if found, is specifically described as:

Evidence of the crime of *insert applicable crime(s)/statute(s) here* including but not limited to:

The Dell Desktop Computer listed above and its entire data contents and any attached data storage media including but not limited to:

Electronically stored communications or messages, web page HTML’s, web searches, cookies, history, favorite sites, images, videos, applications, application data, any passwords, password files, test keys, encryption codes, or other codes necessary to access the computer to be searched or to convert any data file or information on the computers into a readable form, any attached data storage media inserted into the device at the time of seizure, and any other information stored volatile memory (RAM) or non-volatile memory (hard drives)

Notes:

For the Mobile Device template, the example listed is an ideal scenario where all the information provided above is known. Newer Apple devices don’t have the serial numbers listed on the back. If I didn’t have access to the device via a passcode and had no other way of finding out the passcode, I simply would omit that information above. However, I would suggest doing your best to properly identify that device to distinguish it from any other similar Apple iPhone (A1687) devices. Does the device have a sticker? Engraving? A case? Was it located in the suspect’s pocket at the time of the arrest? Was it located in their desk at work? Identify and describe the device as much as you can if no unique serial number can be located for the device. Note, FCC IDs aren’t unique to the device but it doesn’t hurt to include it. Another suggestion provided by someone in the community (Thanks, Scott Z), is to tag the item into evidence and include the property item number with the description. That way, the property number can be tied back to that specific device. This would make sense especially if the device is already located in your evidence room. Anything you can do to distinguish the device from the millions of other devices out there is a welcome addition to your affidavit.