TERRENCE L. O'BRIEN, Circuit Judge.

Douglas Welch appeals from a child pornography conviction — more specifically, the denial of his motions to suppress evidence obtained through the search of his home and computers. Exercising jurisdiction pursuant to 28 U.S.C. § 1291, we affirm.

I. BACKGROUND

This case results from two separate investigations by the Drug Enforcement Administration (DEA) into Douglas Welch's activities: the first encompassed Welch's manufacture of ecstasy and methamphetamine; the second, child pornography. We recount Welch's drug activities because they bear on how the DEA obtained some of the child pornography evidence against Welch.

In June 2000, the DEA received an anonymous tip indicating Welch was manufacturing ecstasy in his basement. Based on this information, it conducted five "trash pulls" from Welch's Leawood, Kansas residence during August and October 2000. The DEA retrieved several empty bottles with labels identifying common adulterants, precursors and cutting agents used to manufacture ecstasy and methamphetamine. It also discovered tubing containing trace evidence of methamphetamine, packing labels and paperwork addressed to Welch. It then subpoenaed Welch's toll and credit card records. The resulting evidence revealed Welch ordered and received several shipments from various chemical and laboratory supply companies between March and May 2000. The contents of the shipments were consistent with the manufacture of ecstasy and methamphetamine.

The investigation of Welch stalled after October 2000. But on February 6, 2001, DEA Special Agent Michael Scalise interviewed two of Welch's former computer business partners. One said Welch had a hydrometer delivered to the office within the previous two years. The other said Welch was running a child pornography website from his home. Agent Scalise did not follow up on the child pornography lead; instead he concentrated on the drug investigation.

Nothing further happened until law enforcement received an anonymous tip on April 9, 2001, indicating Welch was operating a child pornography website. DEA Agent Frank Feden investigated the tip further. Feden verified Welch and his computer company were running a for-profit pornographic website. The first page of the site contained pornographic images of females between the ages of two and seventeen.

The drug investigation again stalled until Sherry Peyton, Welch's former girlfriend, contacted the Leawood Police Department on August 9, 2001. Peyton said Welch had ejected her from his residence two and a half weeks prior and would not permit her to retrieve her possessions. She told the officers Welch manufactured methamphetamine in October 2000 and manufactured ecstasy from approximately January 2000 to January 1, 2001, when he ceased manufacturing drugs. Peyton said Welch was storing lab equipment and chemicals in boxes at a rental home he owned in Overland Park, Kansas. Peyton provided the address and said William Holt, the father of her child, lived there.

The DEA obtained a search warrant from a state court judge authorizing the search of the rental house. There the DEA found approximately thirty boxes, some of which were marked with Welch's name. Inside some of the marked boxes the agents found chemicals and glassware consistent with drug manufacturing. The DEA had Holt deliver approximately seven of the boxes to Welch's home in Leawood in order to "expand the case as far as [possible]." (Appx. at 148.)

At approximately 3:00 a.m. on August 10, 2001, Holt knocked on Welch's door to explain he no longer wanted to store the boxes for Welch. Holt said Peyton was upset and might contact the police. Welch opened his garage door and helped Holt unload the boxes from his vehicle. Welch began placing the boxes in his garage and Holt left the area.

Once the DEA observed Welch take possession of the boxes, the agents detained him in his garage. The agents believed Welch's receipt of the boxes established probable cause for his arrest, negating any need for an arrest warrant. The agents took Welch inside his residence in order to question him privately. While inside, the agents performed a protective sweep observing chemicals and glassware in plain view. After being read his Miranda rights, Welch indicated he purchased glassware from the internet to resell for profit.

Later that day, Agent Scalise, with help from the United States Attorney's office, obtained a federal search warrant to search Welch's residence for evidence of drug manufacturing. The supporting affidavit based probable cause on the June 2000 anonymous tip, trash pull evidence, Peyton's recent tip, the controlled delivery, plain view evidence and Welch's statement. The affidavit did not mention the investigation into Welch's suspected child pornography activities or his computer business. A warrant issued permitting the DEA to search for:

MDMA, methamphetamine, precursor chemicals, glassware, any and all chemicals and apparatus that either have been or could be used to manufacture a controlled substance, drug records, U.S. Currency, firearms that may facilitate the possession, protection or distribution of MDMA or methamphetamine, formulas containing methods to manufacture MDMA or methamphetamine, and computers.

(Appx. at 15.)

During execution of the search warrant, agents observed numerous computers and memory storage devices located throughout the house, some of which were networked together. Vicent Castaldo with the Overland Park Police Department was brought in by Agent Feden to seize computer equipment under the warrant and conduct a forensic examination. Because the network of computers could have been supporting a legitimate business, Castaldo concentrated on the non-networked computer equipment located in Welch's home office. He seized two laptop computers, a loose hard drive, forty-two compact disks, a Jaz drive and some back-up disks and brought these items to the Overland Park Police Department to be searched.

Castaldo utilized a software program to search the seized computer equipment for images of drug labs and glassware without disturbing its contents. He began by identifying the file folder structure on the memory storage devices. From there he opened individual folders, viewing twenty-five images at a time in a gallery view, and looked at the image files with extensions ending in .html (web page documents), .jpg, .bmp and .gif. He searched for downloaded web page images which may show the purchase of glassware over the internet and images of how to design a drug lab. Castaldo also looked for pictures of a person assembling a drug lab or making drugs. During his search of the unallocated portion of a seized hard drive, Castaldo discovered eleven images of child pornography which did not have any particular title or description. At that point, Castaldo felt it was necessary to contact the DEA and seek a search warrant to look for additional evidence of child pornography.

Agent Feden obtained a supplemental federal search warrant on August 14, 2001. The supporting affidavit based probable cause on information from the April 9, 2001 anonymous tip and the eleven images Castaldo found during the search of Welch's computers. Upon obtaining the supplemental search warrant, Castaldo returned to Welch's residence and seized approximately seventy hard drives and several compact disks. A further search revealed the child pornography website Welch had created and a list of its members. The search also revealed diagrams and terminology related to drug manufacturing.

In March 2005, Welch was indicted on one count of knowingly and intentionally possessing more than 600 images of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B). He filed two motions to suppress the evidence seized during the search of his home and computers arguing the warrants were issued in violation of his Fourth Amendment rights.

The government conceded the warrantless arrest of Welch in the garage attached to his residence lacked exigent circumstances and thus, some of the information in the August 10th affidavit after his arrest should not be considered, e.g., the fruits of the protective sweep and his statements to the police. However, the government argued probable cause existed to support the August 10th search warrant even without this information.

After an evidentiary hearing the district court denied both motions. The court found Welch failed to point to any evidence or inference indicating the issuing judge was swayed by allegedly false or misleading information in the affidavit. Along this line, the court found the affidavit was not so lacking in indicia of probable cause for the agents to rely on it in good faith. It specifically found a minimal nexus between Welch's residence and his suspected criminal activity through the controlled delivery of boxes to his house. And, based on the information not excised from the affidavit, the officers had reason to believe evidence of a crime would be found at his residence. The court further rejected Welch's contention that much of this information was stale. It found Peyton's August 9, 2001 tip resurrected the investigation and Welch's acceptance of the controlled delivery provided a "burst of new evidence" effectively corroborating and refreshing the allegedly stale information. (Appx. at 84.)

With regard to the search of Welch's computer equipment, the court concluded the August 10th search warrant was not invalid merely because it failed to provide a computer search methodology. It also found the government properly complied with the search warrant's terms. Though the description in the warrant was not limited to a particular computer, the court found the language sufficiently enabled the searcher to ascertain and identify the things authorized to be searched and seized from Welch's computer equipment, namely items related to drug records, formulas for the manufacture of ecstasy and methamphetamine and items related to setting up and maintaining a drug manufacturing operation. Finally, it found Officer Castaldo understood and respected this limit and did not engage in a fishing expedition beyond the warrant's scope because he terminated his search after inadvertently finding eleven images of child pornography and properly sought an additional search warrant to pursue a search for child pornography.

After the denial of his motions to suppress, Welch waived his right to a jury trial and stipulated to case facts with the government. A bench trial was held on February 1, 2006, where Welch was found guilty. Judgment was subsequently entered and Welch was sentenced to 60 months imprisonment.

II. DISCUSSION

Welch argues the affidavit supporting the August 10th search warrant for his home lacked probable cause because it contained stale information. He also argues the same search warrant was facially overbroad because it failed to designate which computers could be seized and the execution of the computer search exceeded the warrant's scope. Finally, Welch argues the August 14th warrant was obtained as a result of the unlawful execution of the August 10th warrant and all evidence obtained pursuant to the later warrant should be suppressed as a fruit of the poisonous tree.

In reviewing a trial court's disposition of a motion to suppress, "we accept the factual findings unless they are clearly erroneous, and review questions of law de novo." United States v. Gonzales, 399 F.3d 1225, 1228 (10th Cir. 2005). Whether a warrant is supported by probable cause or is overbroad and whether the Leon good faith exception applies are all questions of law. See id.; United States v. Harris, 903 F.2d 770, 774 (10th Cir. 1990); see also United States v. Leon, 468 U.S. 897, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984) (establishing exceptions to the exclusionary rule where law enforcement officers rely in good faith upon a subsequently invalidated search warrant). We consider the evidence in the light most favorable to the government. See United States v. Green, 178 F.3d 1099, 1104 (10th Cir. 1999). However, the ultimate determination of reasonableness under the Fourth Amendment is a question of law. Id.

A. August 10th Search Warrant — Welch's Residence

1. Probable Cause and Staleness

The district court did not reach the issue of whether the August 10th search warrant lacked probable cause. Rather, it determined the officers acted in good faith reliance on the judge's decision to issue the warrant. We can assume the district court would have found probable cause lacking and agree with such a conclusion. The tip received from Peyton clearly established probable cause to believe evidence of drug manufacturing would be found at Welch's rental house in Overland Park. The problem arises with establishing probable cause to believe evidence of a crime would also be found at his Leawood residence. Welch argues the affidavit supporting the August 10th search of his residence was based on stale information which could not support probable cause.

In determining whether a search warrant was supported by probable cause, we review "the sufficiency of the affidavit upon which a warrant [wa]s issued by looking at the totality of the circumstances [to ensure] `that the [issuing judge] had a substantial basis for concluding that probable cause existed.'" United States v. Tisdale, 248 F.3d 964, 970 (10th Cir. 2001) (quoting Illinois v. Gates, 462 U.S. 213, 238-39, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983)). We afford the issuing judge's finding of probable cause great deference unless the affidavit fails to provide that substantial basis. See United States v. Rowland, 145 F.3d 1194, 1204 (10th Cir. 1998). However, like the district court, we disregard the information in the affidavit obtained after Welch's arrest and, from this view point, assess whether there were sufficient remaining facts to establish probable cause. See United States v. Cusumano, 83 F.3d 1247, 1250 (10th Cir. 1996) (en banc) ("In our review, we may disregard allegedly tainted material in the affidavit and ask whether sufficient facts remain to establish probable cause.").

"It is generally recognized that probable cause is one of probabilities and a valid warrant may issue when the circumstances before a proper officer are such that a person of reasonable prudence would believe that a crime was being committed on the premises to be searched or evidence of a crime was being concealed there." United States v. Rahn, 511 F.2d 290, 292 (10th Cir. 1975); see also United States v. Corral-Corral, 899 F.2d 927, 937 (10th Cir. 1990) ("Probable cause undoubtedly requires a nexus between suspected criminal activity and the place to be searched."). This belief "cannot be based on stale information that no longer suggests that the items sought will be found in the place to be searched." United States v. Snow, 919 F.2d 1458, 1459 (10th Cir. 1990). "Probable cause existing at some time in the past will not suffice unless circumstances exist from which it may be inferred that the grounds continued to the time the affidavit was filed." United States v. Neal, 500 F.2d 305, 309 (10th Cir. 1974).

Our concern is not with counting the number of days between facts to support probable cause and the issuance of the search warrant. See United States v. Shomo, 786 F.2d 981, 983-84 (10th Cir. 1986). Rather, we look to "the nature of the criminal activity, the length of the activity, and the nature of the property to be seized." Id., at 984. "Thus, where the property sought is likely to remain in one place for a long time, probable cause may be found even though there was a substantial delay between the occurrence of the event relied on and the issuance of the warrant." Id.

The district court determined Peyton's tip resurrected the stalled drug investigation against Welch and his acceptance of the boxes gave a burst of new evidence effectively refreshing any stale information in the affidavit. Recent evidence of continuing illegal activity may corroborate and refresh dated or stale information. See United States v. Harris, 369 F.3d 1157, 1165-66 (10th Cir. 2004) (evidence of drug related activities four years prior to search warrant sufficiently corroborated and refreshed by events occurring up to a month before its issuance); United States v. Jardine, 364 F.3d 1200, 1205 (10th Cir. 2004) (eight month old evidence of past drug sales refreshed by evidence of attempted drug sales days prior to issuance of search warrant), vacated on other grounds, 543 U.S. 1102, 125 S.Ct. 1024, 160 L.Ed.2d 1008 (2005). To be sure, Peyton's tip confirmed prior information in the hands of the police and provided new information as to the present location of evidence of a crime (the lab equipment) — Welch's rental house. Peyton's tip, however, provided no new information connecting the lab equipment to Welch's residence, in fact it did just the opposite.

What is known from the anonymous tip and trash pulls is that Welch had been manufacturing drugs at his residence the previous year. Peyton's tip corroborated this dated information. However, her information failed to fill in the gap in time between the stale information and the search warrant application, thus distinguishing this case from Harris and Jardine. More important, her information indicated the drug manufacturing enterprise ceased to exist several months prior to her statement and the evidence of drug manufacturing had been moved from Welch's residence to the rental house. Thus, nothing in the affidavit suggests a continuing criminal drug enterprise at Welch's residence nor does it contain probable cause to believe evidence of the past manufacturing operation would still be present there.

The district court also relied on Agent Scalise's suppression hearing testimony that someone with a significant investment in glassware and chemicals would not stop manufacturing methamphetamine, especially if addicted to it. But nothing in the record indicates Welch was addicted to methamphetamine. And any inference that he would continue to manufacture drugs because of his investment in equipment evaporated with Peyton's statement that he stopped manufacturing and stored the equipment. Peyton's statement was contained in the affidavit and therefore before the issuing judge.

Apart from the stricken evidence, the affidavit contained no indication that additional evidence of drug manufacturing would likely be found at Welch's residence. So the question necessarily becomes whether the delivery of boxes from the rental house in Overland Park to Welch's residence creates probable cause to believe evidence of a crime will be found at the residence. It does not.

Welch took possession of the boxes containing lab equipment which could reasonably imply ownership. And from all of the evidence one could reasonably infer the contents could have been found at Welch's residence in the past — some time before they were boxed up and moved. But this does not provide probable cause to believe additional evidence of drug manufacturing would be found at his residence. Nor does it provide probable cause for an arrest. Unlike actual drugs or contraband, the contents of the boxes were not per se illegal. Moreover, the agents (let alone Welch) were not sure what was in the boxes they had Holt deliver.

The information in the affidavit, sans excised material, could not provide a basis for the issuing judge to conclude there was probable cause to believe evidence of a drug crime would be found at Welch's residence. That brings us to the Leon exception.

2 Leon Good Faith Exception.

Even though the information supporting the search warrant was insufficient to establish probable cause, the evidence against Welch need not be excluded if the agents acted in good faith reliance on the judge's decision to issue the warrant. The district court concluded the Leon good faith exception was applicable here. In Leon, the Supreme Court held the purpose of the exclusionary rule is to deter police misconduct and "suppression of evidence obtained pursuant to a warrant should be ordered only on a case-by-case basis and only in those unusual cases in which exclusion will further" that purpose. 468 U.S. at 916, 918, 104 S.Ct. 3405. "Where an officer acting with objective good faith obtains a search warrant from a detached and neutral magistrate and the executing officer acts within its scope, there is nothing to deter." United States v. Nolan, 199 F.3d 1180, 1184 (10th Cir. 1999).

The Supreme Court recognized four situations in which an officer cannot be found to have relied on a warrant in good faith. See Leon, 468 U.S. at 923, 104 S.Ct. 3405. We can easily eliminate three of the four. Welch does not argue the "issuing magistrate wholly abandoned his judicial role" or the warrant was "so facially deficient . . . the executing officers [could] not [have] reasonably presume[d] it to be valid." Id., In the district court he argued the issuing judge "was misled by information in [the] affidavit that the affiant knew was false or would have known was false except for his reckless disregard of the truth," but, as the district court concluded, he failed to point to any evidence or inference proving such an allegation. Id., Because Welch does not argue this issue on appeal, we deem it waived. See State Farm Fire Can. Co. v. Mhoon, 31 F.3d 979, 984 n. 7 (10th Cir. 1994).

Welch does briefly argue that based on the stale information and lack of nexus to the Leawood address, the police did not have probable cause to believe evidence of a crime would be found at his residence. Therefore, "[a] reasonably well-trained officer should have recognized the warrant's infirmity and would have known that the search was illegal despite the magistrate's authorization." (Appellant's Br. at 14-15.) We read this to argue the warrant was "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable," the remaining situation from Leon. Leon, 468 U.S. at 923, 104 S.Ct. 3405 (quotations omitted). On this issue it is the government's burden to prove "its agents' reliance upon the warrant was objectively reasonable." Corral-Corral, 899 F.2d at 932 (quotations omitted).

"Just as reviewing courts give `great deference' to the decisions of judicial officers who make probable-cause determinations, police officers should be entitled to rely upon the probable-cause determination of a neutral magistrate when defending an attack on their good faith for either seeking or executing a warrant." Id., at 939. "This is particularly true, where, as here, with the benefit of hindsight and thoughtful reflection, reviewing judges still cannot agree on the sufficiency of the affidavit." Id.

In the ordinary case, an officer cannot be expected to question the magistrate's probable-cause determination or his judgment that the form of the warrant is technically sufficient. Once the warrant issues, there is literally nothing more the policeman can do in seeking to comply with the law. Penalizing the officer for the magistrate's error, rather than his own, cannot logically contribute to the deterrence of Fourth Amendment violations.

Leon, 468 U.S. at 921, 104 S.Ct. 3405 (quotations, citations and internal brackets omitted).

Such deference, "however, is not boundless." Id. at 914, 104 S.Ct. 3405. Law enforcement officials "are presumed to have a reasonable knowledge of the law and we determine good faith in this context by considering whether a reasonably well trained officer would have known that the search was illegal despite the magistrate's authorization." Gonzales, 399 F.3d at 1228 (quotations and citation omitted); but see United States v. Cardall, 773 F.2d 1128, 1133 (10th Cir. 1985) ("[I]t must . . . be remembered that the knowledge and understanding of law enforcement officers and their appreciation for constitutional intricacies are not to be judged by the standards applicable to lawyers."). "For good faith to exist, there must be some factual basis connecting the place to be searched to the defendant or suspected criminal activity." Gonzales, 399 F.3d at 1231. When such a minimal nexus is absent, "the affidavit and resulting warrant are `so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable.'" Id. (quoting Leon, 468 U.S. at 923, 104 S.Ct. 3405).

While the expectation of finding evidence of a crime at Welch's residence does not reach the level of probable cause, our test for good faith requires significantly less, merely a minimal nexus. The officers knew of Welch's past drug manufacturing in his residence, confirmed by trash pulls, telephone logs, anonymous tips and Peyton's statement. The staleness test does not apply with equal vigor to the minimal nexus test; while it may not be probable that evidence of drug manufacturing would (at the time of the warrant application) be present at the residence it was not illogical to suspect it might be. Officer misconduct has not been shown and the issuing judge found probable cause. The Leon test is satisfied.

B. August 10th Search Warrant — Welch's Computers

Welch argues the August 10th search warrant was unconstitutionally overbroad because it lacked a limitation on the computers to be seized and guidance as to the files to be searched. The district court found the term "computers" to be sufficiently contained within the context of the search for evidence of drug manufacturing. (Appx. at 85.) It also found Castaldo, the officer who searched the computers, understood the limitations of the search warrant and did not conduct a general search.

"The Fourth Amendment requires that a search warrant describe the things to be seized with sufficient particularity to prevent a general exploratory rummaging in a person's belongings." United States v. Carey, 172 F.3d 1268, 1272 (10th Cir. 1999). We look at the description of the items to be seized practically and the warrant's language in a common sense fashion. See Davis v. Gracey, 111 F.3d 1472, 1478 (10th Cir. 1997). A warrant is sufficiently particular "when it enables the searcher to reasonably ascertain and identify the things authorized to be seized." United States v. Wolfenbarger, 696 F.2d 750, 752 (10th Cir. 1982) (quotations omitted). Broad and generic terms may be sufficient if "the description is as specific as the circumstances and the nature of the activity under investigation permit." United States v. Leary, 846 F.2d 592, 600 (10th Cir. 1988) (quotation omitted). However, the description must be made "with as much specificity as the government's knowledge and circumstances allow, and warrants are conclusively invalidated by their substantial failure to specify as nearly as possible the distinguishing characteristics of the goods to be seized." Id. (quotation omitted).

In Leary, we invalidated the search warrant because it merely made an "unadorned reference to a broad federal statute," and authorized the seizure of "virtually every document that one might expect to find in a . . . company's office." Id. at 602. This included documents with no connection to the criminal activity at issue in the case. Welch argues the August 10th search warrant was analogous to the warrant issued in Leary and should likewise be deemed overbroad. See id. at 594. We find such similarities lacking.

The description of the items to be seized in the August 10th search warrant for Welch's residence, while not a model of clarity, was sufficient for the police to know which items could be seized. A reasonable interpretation of the warrant's language confined the computers (and files within them) to be seized and searched to those connected with the manufacture of ecstasy and methamphetamine. It did not merely reference a broad criminal statute or authorize the seizure of computers connected to the operation of a legitimate business. Under the circumstances of the case, the DEA had no information which could have provided further clarity. It had no idea what kinds of computer equipment it might find. As it turned out, Welch had a significant number of computers and other computer equipment throughout his house in both business and personal spaces. Without knowing ahead of time which pieces of equipment Welch used in conducting his drug business, the DEA could not specifically identify the computers to be seized. See generally United States v. Perrine, 518 F.3d 1196, 1199 n. 2 (10th Cir. 2008) ("The IP, or Internet Protocol, address is unique to a specific computer. Only one computer would be assigned a particular IP address.") (quotations omitted). The DEA was thus limited by the information it had to describing the computers suspected to be connected to Welch's criminal activity. The same applies to files and folders within the computers. The folders are unlikely to be conveniently labeled "Meth Manufacturing Files." More likely the names would be coded necessitating at least a cursory search of many folders. The same is true of files. The evidence relating to drug manufacturing could be in word processing files ( e.g., .doc, .docx, .wpd, .rtf, .txt, .wps extensions), spread sheet or presentation files ( e.g., .xls, .xlsx, .ppt extensions), database files ( e.g., .accdb, .mdb, .ldb, .wdb extensions), internet files ( e.g., .html, .mhtml, .xhtml, .xml extensions), or graphic files ( e.g., .jpg, .bmp, .gif, .tif extensions) to name just a few. See generally Wikipedia, List of file formats, http://en.wikipedia.org/ wiki/List_of_file_formats (last visited Aug. 28, 2008). It would not be possible for the warrant to restrict the search by folder name or file extension. Any guidelines would have to be functional — files likely to contain or capable of containing evidence related to drug manufacturing — not descriptive to the point of limiting file type, format or name.

The warrant's authorization to seize computers was implicitly constrained by context to those likely to house drug manufacturing information. Likewise the folders and files to be searched were, by clear implication, also so limited. The search warrant was not necessarily overbroad. Potential overbreadth concerns fade to oblivion when the DEA's execution of the warrant is factored into the mix. It knew it could only seize those computers and files connected to Welch's drug activities. It understood and respected the warrant's implied limits. It only seized computers in Welch's home office, declining to remove and inspect computers it believed could be supporting a legitimate network. Also, when the pornography files were discovered the DEA halted the search and obtained a warrant specifically authorizing such a search. See Carey, 172 F.3d at 1274-76.

Welch also argues the search of his computers exceeded the scope of the warrant because, without a limitation detailed in the warrant, the officers were unable to adopt the search methodology described in Carey. Id. at 1275-76 (outlining approach for law enforcement officers to search computers with relevant and irrelevant documents intermingled together). In Carey we were careful to limit the decision to the particular facts of that case. Id. at 1276. Nevertheless, we provided some rough guidance for those conducting searches (as opposed to those issuing warrants). In Carey, officers discovered child pornography jpg images in a directory with sexually suggestive titles while searching a computer for evidence of a drug crime (pursuant to a warrant authorizing the search of the computer for drug information). Id. at 1270-71. Upon that discovery, the officers abandoned the search for drug related information and focused their file search on pornography. They failed to obtain a new search warrant authorizing a search for evidence related to the newly discovered pornography crime. We concluded the officers exceeded the scope of the drug crime search warrant when they undertook a comprehensive pornography search with the knowledge that the images with sexually suggestive titles were most likely child pornography and not drug related. Id. at 1274-76. We instructed the proper procedure upon discovery of pornography when searching for evidence of a different crime would be to impound the computer and apply for a new warrant focused on the pornography, precisely the procedure followed here. Id. at 1275.

As we stated in United States v. Brooks, "[t]his court has never required warrants to contain a particularized computer search strategy. We have simply held that officers must describe with particularity the objects of their search," 427 F.3d 1246, 1251 (10th Cir. 2005). In some circumstances, "law enforcement must engage in the intermediate step of sorting various types of documents and then only search those ones specified in a warrant." Carey, 172 F.3d at 1275. This occurs "[w]here officers come across relevant documents so intermingled with irrelevant documents that they cannot feasibly be sorted at the site," and in that case, "the officers must seal or hold the documents pending approval by a magistrate . . . [t]he magistrate should then require officers to specify in a warrant which type of files are sought." Id. (citation omitted). "However, we have not required a specific prior authorization along the lines suggested in Carey in every computer search." Brooks, 427 F.3d at 1251.

In Brooks, we reiterated the factors requiring a predetermined search protocol is necessary. See id. at 1251-52. We consider: "(1) the object of the search, (2) the types of files that may reasonably contain those objects, and (3) whether officers actually expanded the scope of the search upon locating evidence of a different crime." Id. at 1252. In this instance, a predetermined search protocol was not necessary. The object of the search was for evidence of drug manufacturing. Castaldo looked at .html documents (web pages) and other images saved as .jpg, .bmp and .gif files on the data storage devices for information relating to the purchase of glassware and the assembly of a drug lab. Such evidence could reasonably be contained within these file types. Castaldo's search in the unallocated portion of the hard drives did not venture beyond the scope of the search. Logically, someone looking to conceal incriminating images would delete or hide them under a different name in an unlikely location. Furthermore, once the eleven images of child pornography were discovered, none of which had a title suggesting pornographic content, Castaldo ceased searching and obtained an additional search warrant to look for evidence of this different crime. He did not expand his search to look for more images. Castaldo's actions were far more reasonable than in Carey where the officer continued to open image files with names suggesting their content. The discovery of child pornography images during Castaldo's search does not, per se, mean he engaged in the type of general exploratory rummaging we prohibit. Officer Castaldo's actions were appropriately circumscribed within the bounds of the search warrant.

C. August 14th Search Warrant — Fruit of the Poisonous Tree

Finally, Welch argues the August 14, 2001 search warrant was obtained as a result of the unlawful execution of the August 10, 2001 warrant and all evidence discovered pursuant to the later warrant should be suppressed as a fruit of the poisonous tree. See generally Wong Sun v. United States, 371 U.S. 471, 83 S.Ct. 407, 9 L.Ed.2d 441 (1963). Because the officers acted in good faith reliance on the August 10th search warrant, and the search of his computer did not violate the Fourth Amendment, the evidence subsequently obtained need not be suppressed as a fruit of the poisonous tree.

AFFIRMED.