Logo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter

March 2008
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Knoxville's EDiscovery and Computer Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm and value of Electronic Discovery and Computer Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, the link to subscribe is http://www.forensicdiscoveries.com/newsletter.html or follow the instructions at the bottom of this newsletter. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept our apologies for intruding.
in this issue
In Search of the Holy Grail
Case Law Libre - Free Access to Federal Decisions
Search Enron e-mails at the KBA Legal Tech Expo
EDiscovery Case Law - Spoliation
Previous Newsletters
We hope you enjoyed last month's article on the value of Computer Forensics in cases involving intellectual property theft. Forensics Discoveries has some new subscribers this month that have requested to learn more on the basics on the value of electronic and computer forensics in their routine cases. Therefore, this month we will be providing an article with this general focus. This month's installment is "In Search of the Holy Grail" and future newsletters will continue to include articles covering routine cases that each of you encounter. As others have done, please let us know of a specific topic you would like to see covered.
 
Below is a review of our previous newsletters:
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

In Search of the Holy Grail

In a recent meeting with an attorney, I realized that very seldom is there a conversation about computer forensics in the legal realm without the term "smoking gun" being used at some point. The attorney made a profound statement, "Finding the smoking gun is like finding the Holy Grail". As many attorneys who leverage computer forensics in its many applications will attest, computer forensics is a valuable tool in this quest. In addition to succeeding in your hunt, evidence and/or attempts of spoliation can also be proven along the way.

Before 95-98% of all information was created digitally, parties could selectively produce the paper documents of relevancy then destroy what was chosen not to produce never to be recovered. Fortunately for those in search of the "Holy Grail" and to the detriment of those trying to hide it, digital information is not so easily destroyed or concealed.

In litigation, the proverbial "Holy Grail" will vary from case to case.  Evidence of adulterous communications, hidden assets, or unknown lifestyles may be found on computers, cellular phones, and Blackberrys to provide value in family matters. In cases of intellectual property theft, the aspiration may be determining if company information was stolen using portable hard drives and e-mail attachments. The target in contract disputes would be the evolution and modification of relevant documents prior to them being produced. If the focus of your case is harassment or employment matters, your efforts may revolve around e-mail communications to support or refute the claims. And in many cases, the goal may not be a "document" at all, but rather an activity on the computer instead.

A key value in leveraging computer forensics is the ability to recover information that was previously assumed to be "deleted". Unlike paper, digital information is very difficult to destroy. Although methods to truly destroy digital information do exist, evidence of the efforts is often detectable and obvious. Acts such as deleting files, formatting hard drives, and even attempting to reinstall Microsoft Windows onto an alternate hard drive to avoid producing unseen evidence are quickly determined by qualified computer forensics professionals. With little patience for spoliation, Courts often issue sanctions and even give default judgments based on evidence of these attempts of spoliation. However, there are differences between willful destruction and negligent destruction of information.  Negligent destruction of digital information may result in miscommunications with companies on the proper steps to implement a preservation hold on e-mail that IT departments typically delete based on age.

When beginning your quest for the "Holy Grail", the usage of computer forensics could prove to be the difference in your success. Computers and cell phones are unintentional diaries detailing past, current, and future activities of their users that could provide the information that makes the difference in your case. Digital information also has the ability to provide concrete evidence of successful and unsuccessful attempts of deliberate spoliation.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Case Law Libre - Free Access to Federal Decisions

On Feb. 11th, the non-profit Public.Resource.Org published 1.8 million pages of Federal case law online. There information is free of copyright or other restrictions. The release includes all U.S. Supreme Court Cases and all federal circuit decisions since 1950.

 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Knoxville BAR Association Legal Tech Expo
 
Mark your calendars for the Knoxville BAR Association's Legal Tech Expo on Friday, April 25th. In addition to providing cutting edge legal technology seminars, the KBA Legal Tech Expo offers more than 20 booths sponsored by KBA vendor partners to learn more about their business offerings. The KBA conference planning committee includes seasoned CLE veterans, and local lawyers with an interest in law office technology and management issues. There will be 12 hours of CLE courses available.
 
Forensic Discoveries will be a participant in booth #20. We will be demonstrating some of the tools used in Computer Forensics and Electronic Discovery. Forensic Discoveries will be demonstrating the speed and accuracy of keyword searching a dataset of 500,000 e-mails from the Enron case. Start thinking about your keywords and stop by booth 20 to try them out!
 
More information on the Legal Tech Expo can be obtained here:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
EDiscovery Case Law - Spoliation
 

Adverse Inference Instruction Issued for Spoliation of Computer Files

Minnesota Mining & Mfg. v. Pribyl, 259 F.3d 587 (7th Cir. 2001). The plaintiff brought suit against three former employees for misappropriation of trade secrets. The appellate court affirmed the trial court's negative inference instruction to the jury where the one defendant committed spoliation of evidence by downloading six gigabytes of music onto his laptop, which destroyed many files sought by the plaintiff, the night before the defendant was to turn over his computer pursuant to the discovery request. However, the fact that hard drive space was destroyed on one defendant's computer did not relieve the plaintiff from proving the elements of its claims.

 

Adverse Inference Sanctions Granted Where Plaintiff Destroyed Computer Evidence

Anderson v. Crossroads Capital Partners, L.L.C., 2004 WL 256512 (D.Minn. Feb. 10, 2004). In a sexual harassment and whistleblower lawsuit, the defendants sought to recover the hard drive of plaintiff's personal computer because it allegedly contained an October 2001 document outlining the harassment. After a protracted discovery battle, the defendants sought a Motion to Compel and the judge ordered the plaintiff to furnish the defendant with a "copy of all documents/files relevant to this litigation that exist on Ms. Anderson's personal computer as well as those that have been deleted or otherwise adulterated." Pursuant to the judge's Order, the defendants' computer forensic expert examined the plaintiff's hard drive and discovered that a data wiping software application had been installed after the plaintiff had agreed not to "delete any existing documents" in a deposition. The computer forensic expert also found that the hard drive installed in the machine was manufactured in August 2002. The plaintiff claimed that she did not use the software program to destroy evidence, but that she used it routinely to protect her computer files. She also stated that in her view she owned the same computer throughout the litigation despite changing the hard drive in 2002. The defendants then moved to dismiss the complaint due to plaintiff's alleged discovery violations and destruction of evidence. The court noted that the plaintiff's "exceedingly tedious and disingenuous claim of naivete regarding her failure to produce the requested discovery defies the bounds of reason" but was not sufficiently egregious to warrant dismissal of the case. Instead, the court issued an adverse inference jury instruction because the plaintiff intentionally destroyed evidence and attempted to suppress the truth.

 

Appellate Court Affirms Spoliation Instruction for Failure to Preserve Email

Arndt v. First Union Nat'l Bank, 613 S.E.2d 274 (N.C. Ct. App. 2005). In a dispute involving a contract made between the defendants and the plaintiff, the jury awarded the plaintiff over $830,000 in damages, relying in part on a spoliation instruction. Although the plaintiff had requested various emails and profit and loss statements relating to the allegations, the defendant failed to preserve and produce these documents. As a result, the trial court had instructed the jury that, "[e]vidence has been received that tends to show that certain profit and loss statements and E-mails were in the exclusive possession of the defendant and, [sic] have not been produced for inspection. From this, you may infer, though you are not compelled to do so, that the profit and loss statements and the E-mails would be damaging to the defendant." On appeal, the defendants argued, inter alia, that the instruction was unfairly prejudicial. The appellate court noted that testimony from one of the defendants' employees indicated the defendants were on notice early on of the plaintiff's intent to sue but failed to preserve the plaintiff's emails or hard drive. The employee further testified that no effort was made to save the hard drive even after receiving a letter from the plaintiff's counsel about the case. Based on this evidence, the appellate court determined the trial court did not err in giving the spoliation instruction.

 

Appellate Court Upholds Default Judgment for Intentional Spoliation of Evidence

Oved & Assocs. Constr. Servs., Inc. v. Los Angeles County Metro. Transp. Auth., 2006 WL 1703824 (Cal. Ct. App. June 22, 2006). In a construction dispute case, the appellate court affirmed the trial court's award of terminating sanctions against the defendant for years of discovery abuses and the intentional spoliation of evidence. After the defendant repeatedly failed to produce financial documents responsive to the plaintiffs' discovery requests, the plaintiffs sought an order to conduct a forensic examination of the defendant's computer hard drive. When the trial court awarded the plaintiffs request, the defendant filed an interlocutory appeal. The retained computer forensic examiner determined a number of files had been individually selected and manually deleted. In addition, the expert testified that the recycle bin had been emptied on the same day the Court of Appeals denied the defendant's appeal and issued an order to preserve and produce the computer hard-drive. Finding that the financial records were integral to the case, the court observed, "[the defendant's] conduct effectively destroys the ability of [the plaintiffs] to litigate the trial." In affirming the default judgment against the defendants, the appellate court noted, "any lesser sanction for this willful failure to comply would have condoned [the defendant's] behavior and by definition would have been insufficient." The court also awarded the plaintiffs' attorneys fees and the costs of appeal.

 

Canceling YAHOO! Account Justifies Sanctions for Destruction of E-mail


Easton Sports, Inc. v. Warrior Lacrosse, Inc., 2006 WL 2811261 (E.D. Mich. Sept. 28, 2006) The plaintiff sought sanctions against the defendant for bad faith destruction of relevant documents and e-mails. The defendant in this case was a competitor of the plaintiff in the sporting goods business. The defendant hired a former employee of the plaintiff after he voluntarily ended his employment with the plaintiff. When the employee left the company, he forwarded several confidential documents from the plaintiff's company e-mail account directly to his personal Yahoo! account. A computer forensics expert determined the employee opened the documents on his home computer, and several of the confidential documents were also found on a computer issued to the employee from his new employer. Upon the filing of the plaintiff's lawsuit, the employee cancelled his Yahoo! e-mail account, thereby causing all e-mails stored on the account to be destroyed and unrecoverable. The plaintiff motioned the court to issue sanctions in the form of dismissal for bad faith destruction of key documents after litigation commenced. The defendant argued no knowledge of the stolen trade secrets from the plaintiff and alleged the employee transferred and deleted the files on his own. The court found the employee destroyed wrongfully obtained records when he cancelled his personal e-mail account with Yahoo!. The court did not find enough evidence to prove the defendant willfully and in bad faith supervised or instructed the destruction of the trade secrets. However, the court did find the defendant negligent in its failure to preserve relevant evidence from its employee. The negligence by the defendant did not warrant a dismissal of the case as the plaintiff urged, but the court ruled a negative inference may be allowed at trial because it "should have done more to detect and preserve relevant data under [the employee's] control."

 

Computer Expert Exposes Attempts to Destroy Electronic Data

Arista Records, Inc. v. Sakfield Holding Co. S.L., 314 F.Supp.2d 27 (D.D.C. 2004). In a copyright infringement suit, the court issued an order compelling the defendant to produce computer servers, which hosted the defendant's web site and contained records of its users. When the plaintiffs' computer expert inspected the servers, he discovered that the vast majority of that information had been intentionally destroyed after the defendant learned that litigation was imminent. The expert found that the defendant ran a program, designed to erase electronically stored information, more than 50 times from a remote location in an attempt to delete all electronic data from the servers. In spite of the defendant's attempts, the expert recovered a small amount of data to support the plaintiffs' claims. Although the defendant attempted to attack the plaintiffs' methodologies for extrapolating the number of users and downloads, the court indicated that the defendant was "in a poor position to attack plaintiffs' evidence," noting that "[d]estruction of evidence raises the presumption that disclosure of the materials would be damaging." The court decided not to issue sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as the case progressed.

 

Court Affirms Default Judgment as Sanctions for Reformatting Hard Drive

 

QZO, Inc. v. Moyer, 594 S.E.2d 541 (S.C. Ct. App. 2004). A corporation alleged that the defendant, a former officer and shareholder of the corporation, violated state trade secret laws by planning to compete with the corporation. The corporation requested the defendant turn over a computer, which allegedly contained evidence of the defendant's plans to compete. The trial court granted a temporary restraining order (TRO) directing the defendant to hand over the computer to the corporation or to a neutral third party. The defendant waited until seven days after the TRO was issued to deliver the computer to the corporation. After receiving the computer, the corporation hired a computer expert to inspect and retrieve any potential evidence from the computer's hard drive. The expert discovered the hard drive had been reformatted a day before the defendant delivered the computer to the corporation, which erased any evidence that may have been on the computer. The corporation requested sanctions in the form of a default judgment against the defendant for intentionally violating the TRO. The trial court granted the corporation's motion for sanctions and entered the default judgment in favor of the corporation. The defendant appealed stating that the evidence was insufficient to support such severe sanctions. On appeal, the appellate court affirmed the trial court's judgment, determining that the sanctions were not too severe.

 

Court Finds Defendants Acted in Bad Faith by Failing to Halt Email Destruction Policy

Broccoli v. Echostar Communications Corp., 2005 WL 1863176 (D. Md. Aug. 4, 2005). In an employment discrimination case, the plaintiff filed a motion for sanctions against the defendants for failing to preserve electronic documents and for spoliating email evidence. Citing Zubulake, the court addressed the defendants' duty to preserve emails and other relevant documents. The evidence showed the defendants were on notice of the lawsuit long before they halted their data destruction policy. In fact, the defendants admitted they never issued a company-wide instruction regarding suspension of their data destruction policy and they did not save the plaintiff's emails relating to the harassment incidents or his termination. Based on this evidence, the court granted the plaintiff's motion for sanctions and issued an adverse inference jury instruction relating to spoliation of the emails. The court declared the defendants acted in bad faith by failing to suspend their email and data destruction policy and by failing to preserve essential personnel documents in order to comply with their preservation obligations. The court further stated, "Given [the defendants'] status as a large public corporation with ample financial resources and personnel management know-how, the court finds it indefensible that such basic personnel procedures and related documentation were lacking."
 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Quick Links...
 
Forensic Discoveries is available to provide onsite presentations or Q&A sessions on topics such as Electronic Discovery, Technical Implications of the updated Federal Rules of Civil Procedure, or Computer Forensics. Forensic Discoveries is also available to you, obligation free, to answer any specific questions pertaining to these topics. Simply give us a call and we will be glad to answer any questions pertaining to Electronic Discovery and Computer Forensics.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contact Information
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Phone: (865)-809-7590

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

If you have a topic that you would like addressed in the newsletter, please let us know. Either visit http://www.forensicdiscoveries.com/newsletter.html and submit your suggestion there or reply to this e-mail with your suggestion. 

For previous versions of Forensic Discoveries EDiscovery newsletters, visit http://www.forensicdiscoveries.com/pastnewsletters.html  

 

This document does not provide legal or other professional advice and should not be relied upon as anything other than a starting point for research and information on the subject of electronic evidence and computer forensics.