Knoxville's EDiscovery Newsletter - Proving Spoliation with Computer Forensics

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proving Spoliation with Computer Forensics

With electronic discovery and computer forensics, there are varying methods in which spoliation occurs. In one instance, there could be failure to properly implement a litigation hold. This can occur when there is a "disconnect" between counsel and technical personnel. The opinion and order from Zubulake v. UBS Warburg summarizes this situation best, "What we've got here is a failure to communicate." On the other hand, there are blatant acts to destroy, hide, or withhold information stored on a computer. In either scenario, computer forensics will help you determine and likely prove the spoliation that has occurred.

For those of you that have worked directly with your client's IT department in a discovery request, I am sure that you can understand how difficult it can be to determine whether or not they completely understand what a litigation hold means to their department. Trust me, if they agree to implement the litigation hold without complaining, they do not understand. They often state that the custodians will be told not to delete anything. What they often fail to tell you are the little things of importance such as:

·   They have an email retention policy that automatically deletes email older than 365 days.

·   The email program used by the custodian automatically deletes all email sent and deleted when they close it.

·   All of the data for that custodian is on their PC and is not backed up.

·   The backup tapes will start overwriting in 2 weeks.

These are the simple miscommunications that you can almost guarantee will cause issues in your discovery process if not addressed at the appropriate time. My September and October newsletters go into detail of how to avoid this situation by working with your clients to gather the information prior to litigation ever occurring. For those clients that do not take the prospect of ediscovery affecting them, my November newsletter was written to assist you.

While miscommunications are often the source for spoliation that does occur in ediscovery, attempts of deliberate spoliation are a different story. Not only can computer forensic professionals oftentimes recovery the deleted information, we can also prove the act of spoliation. Let's walk through some examples from cases that Forensic Discoveries has handled and an example from a colleague:

·   In theft of intellectual property case, the defendant was given order not to alter any information on their computer. On the night that the defendant was given the order, numerous files that contained relevant information were deleted and recovered from the windows recycle bin.

·   In a routine discovery effort in a divorce case to determine hidden assets, it was found that the computer hard drive had been formatted and the Microsoft Windows operating system had been reinstalled two days prior to being provided to opposing counsel for analysis.

·   In a product liability case, emails discussing the dangers of the product between product development and senior management had been deleted less than one week after the preservation order had been issued.

·   In an investigation involving insurance fraud, it was found that the accused had deleted the Internet browser history on the computer prior to the investigation. Recovering the Internet history found the computer owner had been researching topics on google such as "how to burn a house" and "how long to collect insurance money".

·   In a contract dispute, it was found that various documents that contained meeting minutes, that had digital copies of board member signatures, had been altered prior to being produced.

In some instances, it may not be possible to recover the information. As the typical computer user is becoming aware, the "delete" key isn't labeled properly. The "delete" key should be relabeled to "hide" because it simply hides the information from the operating system waiting to be found by a computer forensics professional. To be a bit more thorough, destructive computer programs are being used to destroy the information. There are many applications that serve this function such as "file shredder", "windows washer", "eraser", and my personal favorite "evidence eliminator". "Evidence eliminator" is not my favorite based on its functionality but because the name alone welcomes suspicion and its behavior is the most obvious to detect in a computer forensics examination. While some people know that the delete key does little more than entertain you, the majority does not know that most operating systems keep track of the name of the program that was executed, when it was executed, and how many times it has been executed. There is currently a case in California in which this capability is getting some press. These "wiping" programs will make it difficult to recover the data that was destroyed in its entirety. However, being able to prove that these programs were executed could easily lead one to conclude that the information deleted was unfavorable to the spoliator.

Spoliation during electronic discovery can be attributed to different factors. Although it doesn't help the situation or improve the situation in the eyes of the courts, miscommunications can be a major contributor. On the other end of the spectrum are deliberate efforts to withhold, hide, or destroy information. The use of computer forensics will assist in possibly recovering the information and proving the act of spoliation.

Finding a Computer Forensics Expert