Michigan Supreme Court: Unrestricted phone searches violate Fourth Amendment

I think you could reasonably restrict a warrant by last time a file was created or accessed, at least. If those files with those names were created months before or after the incident, for example.

Warrants establish such restrictions all the time. The classic example is what's called the sugar bowl doctrine. In a nutshell: if you're looking for stolen televisions you can't look in the sugar bowl. If, to torture the metaphor further, you see car keys peaking out of the top of the sugar bowl you can apply for a further warrant. In the case of forensically investigating a phone, you would just keep the forensically-sound copy of the phone's data while you waited for a judge's permission to poke around in that folder.

I guess we should all just run that bash one liner to update the last modified time stamp to 1970 then, so we won't be subject to a search

and then the forensic analyst would note that and hold a forensically-sound copy while a new warrant was issued, because every file's MAC data being set to 0 would provide articulable suspicion that evidence cannot be filtered by date. So now the search has expanded to include your entire device and, given your history of attempting to tamper with evidence, the entirety of any other seized device as well. Congratulations?

Which would mean there are no restrictions on what they can search at that point? Right?

You also seem to be operating from a standpoint that because I am subject to a search, there exists evidence of me committing a crime. That's a pretty slippery slope from where I'm standing.

I'm operating from the assumption that there would be evidence that the phone was tampered with, and it's a reasonable assumption because your premise explicitly states that you'd be altering MAC data. Whether there's evidence of a crime doesn't actually enter into it, once there is evidence that the warrant restrictions are being exploited to hide something there's articulable suspicion that the entire device is a valid place to look for evidence. Whether that search actually finds anything is irrelevant to the discussion entirely.

You used the phrase "given your history of attempting to tamper with evidence". If I have a history of tampering with evidence, then I implicitly committed a crime of some kind. One cannot tamper with evidence without a crime.

oh well then yeah I think we can assume that you committed the crime that you said you committed in the original comment and also that the evidence you explicitly said would be there would be there.