Evidence Collected by the FBI in Relation to the San Bernardino Shooting

I. Items to be Seized

1. The items to be seized are evidence, contraband, fruits, or instrumentalities of violations of (1) 18 U.S.C. 844 (d) (Transportation or Receipt of Explosive Devices with the Intent to Injure or Kill); (2) 18 U.S.c. § 844 (i) (Attempted Destruction by Explosives of Any Building, Person, or Property); and (3) 18 U.S.C. S 844 (n) (Conspiracy) :

a. Explosives, smokeless powder, black powder, gunpowder, or any other item that can be pipes, and wires;

b. Pipes and any items that may cause fragmentation:

c. Initiating devices to include burning fuse, hobby fuse, blasting caps, manual or electrical timers, dry cells batteries, electrical wire, alligator clips, electrical tape of assorted colors commonly used to secure electrical wiring;

d. Books related to the construction of explosives;

e. Tools used in the construction of explosives such as include hand held vise grips, table mounted vise grips, pipe cutters, electrical; and non-electrical drills and drill bits.

f. Address and/or telephone books, telephones, pagers, answering machines, customer lists, and any papers reflecting names, addresses, telephone numbers, page numbers, fax numbers and/or identification number of sources of supply of explosives;

g. No more than 5 documents and records, including electronic mail and electronic messages, reflecting the ownership, occupancy, possession, or control of the SUBJECT LOCATION, including lease/rental agreements, rent receipts, registration documents, bank records, utility bills, telephone bills, other addressed envelopes, and correspondence;

h. Any digital device used to facilitate the above-listed violations and forensic copies thereof.

i. With respect to any digital device used to facilitate the above-listed violations or containing evidence falling within the scope of the foregoing categories of items to be seized:

i.) evidence of who used, owned, or controlled the device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, e-mail, e-mail contacts, chat and instant messaging logs, photographs, and correspondence;

ii.) evidence of the presence or absence of software that would allow others to control the device, such as viruses, Trojan horses, and other forms of malicious software, as well as evidence of the presence or absence of security software designed to detect malicious software;

iii.) evidence of the attachment of other devices;

iv.) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the device;

v.) evidence of the times the device was used;

vi.) passwords, encryption keys, and other access devices that may be necessary to access the device;

vii.) applications, utility programs, compilers, interpreters, or other software, as well as documentation and manuals, that may be necessary to access the device or to conduct a forensic examination of it;

viii.) records of or information about Internet Protocol addresses used by the device;

ix. records of or information about the device's Internet activity, including firewall logs, caches, browser history and cookies, "bookmarked" or "favorite" web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses.

2. As used herein, the terms "records," "documents," "programs," "applications," and "materials" include records, documents, programs, applications, and materials created, modified, or stored in any form, including in digital form on any digital device and any forensic copies thereof.

3. As used herein, the term "digital device" includes any electronic system or device capable of storing or processing data in digital form, including central processing units; desktop, laptop, notebook, and tablet computers; personal digital assistants; wireless communication devices, such as telephone paging devices, beepers, mobile telephones, and smart phones; digital cameras; peripheral input/output devices, such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media; related communications devices, such as modems, routers, cables, and connections; storage media, such as hard disk drives, floppy disks, memory cards, optical disks, and magnetic tapes used to store digital data (excluding analog tapes such as VHS); and security devices.