|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"When to Preserve"
Electronic information has provided great value in litigation for quite some time. Since the updated Federal Rules of Civil Procedure went into effect on December 1st of 2006, electronically stored information (ESI) is now handled as carefully as relevant paper documents. Or is it? With involvement in federal and local cases, my experience is that electronically stored information is often an after thought. The reality is that electronically stored information is much more volatile than paper and must be handled appropriately. In addition, failure to preserve at the beginning of litigation will likely require additional time and expense to later obtain the desired information, if it is available at all.
Electronic discovery and computer forensic professionals who work in civil litigation are often envious of law enforcement computer forensic professionals who deal with criminal investigations. When there is a criminal case and the search warrant is served, everything found that is relevant from a digital perspective is collected and preserved: computer hard drives, portable media, cell phones, etc. The information collected may not be analyzed for months or even years. However in the arena of civil litigation, electronic information is typically collected much later in litigation when it is deemed to provide "value". The "after thought" to request digital information is often after a paper document, deposition, or another source of new information is introduced that points to additional information of interest on a computer or cell phone. I was involved in what is now considered to be the 7th largest eDiscovery case of 2007. And even in that instance, ESI was actually an after thought rather than being addressed in pre-trial conferences. Sometimes the motivation to go after electronically stored information can be an effort to continue digging after the production of the first discovery request did not produce the desired results. To one's delight and the others despair, the computer often contains that information that was sought after in the beginning.
Electronic information is much more volatile than paper documents. If you walked into your client's office and found that they were storing relevant documents above a fireplace, you would immediately take drastic actions to preserve those documents. However with the documents above the fireplace analogy, there is only a probability that the information will be destroyed. If a computer is not properly preserved early in litigation, there is certainty that information will be lost or altered. Normal everyday use of a computer inadvertently alters and deletes information. Disk cleanup utilities remove deleted information of value, anti-virus applications can change metadata information on files, automated data retention routines will alter and delete information, and then there is "accidental" deletion of responsive information. All of these complications can be easily avoided in a cost effective manner by simply preserving the digital information early.
In various speaking engagements and presentations with attorneys, I am often asked, "When is the best time to preserve electronically stored information?". Without hesitation, my answer is always "As soon as you know that there are computers involved anywhere in your litigation". If there is a computer or multiple computers involved, regardless of the litigation you are involved in, you can almost be certain that there is relevant information contained within it. The irony is that the majority of the information provided to you on paper was printed from those very computers, but the printed copy lacks a wealth of information that could be key in the litigation at hand. Failing to properly preserve that information immediately will create complications and additional expense when it is later analyzed for responsive information. At this point many of your are thinking "but deleted information can be recovered" and you are correct that many times we can recover deleted information. However, it is much easier and much less expensive to produce a piece of paper off of your desk than to piece it back together after it has been through the shredder. In addition there are software tools available for those that are determined to destroy the information, which can render the data unrecoverable.
Unfortunately, electronically stored information is not always preserved at the beginning of litigation. When it comes to ESI, there is typically little to no preservation. Unless a hold that applies specifically to ESI has been issued, there is only the collection of the data for analysis. As soon as you are aware that there is a computer involved, take immediate steps to preserve a copy of the computer(s) the same way you would a client that stores their files above a fireplace. Imagine the value of having the ability to make a verifiable copy of potentially relevant files, activities, and communications of the parties of the litigation at the beginning of litigation to be reviewed at a later time. For cases involving a single computer, the cost of the proper preservation could be less than $300. This cost is much less than the potential expense to reconstruct deleted information or the opportunity cost of having the information destroyed.
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sample ESI Preservation Letter
Here is a link to an ESI preservation letter template used by one of the nation's best trial attorney/electronic discovery experts, Craig Ball.
The first page outlines various types of information that provides value in litigation. I will save you a bit of frustration, a low cost forensic image of the computer(s) involved will handle almost every aspect of preservation requested in this letter.
Craig Ball has also written a great article titled "The Perfect EDD Preservation Letter" that is also a very good read.
For any assistance with drafting or responding to preservation letters specific to ESI, please feel free to call Forensic Discoveries at (865) 809-7590 for no obligation consultation on the technical aspects.
|
|
U.S. Courts' Notice: Invalid Subpoenas
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The U.S. Courts' website (www.uscourts.gov) has the following alert:
Reports have been received of bogus e-mail grand jury subpoenas, purportedly sent by a United States District Court. The e-mails are not a valid communication from a federal court and may contain harmful links. Recipients are warned not to open any links or download any information relating to this e-mail notice. The federal Judiciary's email address is uscourts.gov. The e-mails in question appear to be sent from a similar address that is not owned and operated by the federal courts. Law enforcement authorities have been notified.
More information about the e-mail scam may be found in this New Jersey Law Journal article by Mary Pat Gallagher, "Businesses Hit With E-Mail Blast of Virus-Carrying Pseudo-Subpoenas," an excerpt from which follows:
Continue Reading...
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
EDiscovery Case Law Plaintiff Ordered to Produce Hard Drive for Forensic Examination by Defendant
Orrell v. Motorcarparts of America, Inc., 2007 WL 4287750 (W.D.N.C. Dec. 5, 2007). In this sexual harassment suit, the plaintiff sought damages alleging sexual harassment, gender discrimination, hostile work environment and wrongful discharge based on receipt of inappropriate e-mails from co-workers and customers. Alleging improper destruction of evidence and incomplete compliance with discovery obligations, the defendant filed a motion to compel seeking production of the plaintiff's home and work computers and an order prohibiting further destruction of evidence. The plaintiff argued that complying fully with all of the defendant's requests would create an undue burden. Agreeing with the defendant, the court determined that the burden to preserve evidence was not eliminated due to the alleged crashing of the plaintiff's home computer. The court found the defendant's requests to be "reasonably calculated to lead to the discovery of admissible evidence", and ordered the plaintiff to produce her home computer for forensic examination. The court also ordered the plaintiff not to further destroy relevant evidence. Additionally, the court warned the plaintiff that failure to comply may result in sanctions including dismissal of the case with prejudice and payment of the defendant's attorney's fees.
Appellate Court Upholds Order to Allow Plaintiff Access to Mirror Image of Defendant's Hard Drive
In re Honza, 2007 WL 4591917 (Tex. App. Dec. 28, 2007). In this real estate litigation, the defendants sought a writ of mandamus to set aside a discovery order requiring them to produce office hard drives for imaging by a computer forensic expert in an effort to locate two particular documents. The defendants objected to the discovery order, arguing it was overbroad and would lead to the disclosure of privileged and confidential information. The court looked to federal and state courts for guidance on the general process of hard drive mirror imaging for discovery. Disagreeing with the defendants, the court found the order was not overbroad, as the defendants
were granted a right of first refusal in determining whether information obtained was relevant to the two documents at issue. Further, the court found there were adequate safeguards against disclosure of privileged information as the defendant was able to review for privilege prior to production.
Court Sanctions Defendant for E-Mail Preservation Failure
Connor v. Sun Trust Bank, 2008 WL 623027 (N.D.Ga. Mar. 5, 2008). In this litigation alleging interference and retaliation claims under FMLA, the plaintiff filed a motion for sanctions based on the defendant's failure to produce a highly relevant e-mail during discovery. The plaintiff located, through other means, a relevant e-mail that explained her dismissal to other employees. The defendant moved for summary judgment relying on their 30-day e-mail destruction policy which automatically deleted e-mails that were thirty days old, unless they were first archived by the user. The court, un-persuaded by the defendant's reasoning, granted the plaintiff's motion for sanctions and issued an adverse jury instruction.
Court Grants Motion to Amend Complaint to Include a Spoliation Claim
Ed Schmidt Pontiac-GMC Truck, Inc. v. DaimlerChrysler Motors Co., 2008 WL 668267 (N.D.Ohio Mar. 11, 2008). In this suit alleging breach of a settlement agreement, the plaintiff sought to amend the complaint to include a claim for spoliation following two years of discovery. The plaintiff alleged the defendant knowingly destroyed relevant evidence - specifically the defendant replaced employees' hard drives days before the plaintiff could make forensic images of those drives. The defendant argued that a spoliation claim would be futile and cause undue prejudice. Applying state law for spoliation and appropriate sanctions, the court granted the plaintiff's motion and allowed the plaintiff to add a claim of spoliation. | |
