Q: What steps should I take to secure electronic evidence?

A: It's a good idea to bring an experienced computer forensic examiner on board at the outset of the case to assist with preparation of relevant interrogatories, depositions and requests for production.

To safeguard and secure electronic evidence send opposing counsel - and your client - a preservation letter serving as notification of the duty to preserve evidence. The letter should specify the information to be preserved, places the information may be found, people who may possess the information, and the storage media (such as a hard drive or CD) on which the information resides.

Most important, the letter should include a request for the computer to be taken out of service until a mirror image of the hard drive can be created - of course, business disruption issues need to be addressed. Simply turning a computer on will alter hundreds of files, and can potentially destroy relevant evidence. A preservation letter may also provide a possible basis for future sanctions.

Additionally you may consider obtaining an injunction or protective/preservation order forbidding the opposing party from deleting electronic data from a computer.

Mark E. Borzych
Staff Counsel

Do you have a computer forensics or electronic discovery question? E-mail your question to: AskTheExpert@spinellicorp.com

Metadata: In the context of computer forensics, metadata is imbedded descriptive and historical information about an electronic file, such as the date it was created, modified or deleted; its location on the hard drive; or who created it.

A computer's operating system (for instance, Windows 98) stores and tracks metadata about every file.

In addition to metadata stored by the operating system, programs such as Microsoft Word or Adobe Acrobat can store a myriad of information, such as:

	the names of the last 10 authors of a file;
	the amount of time spent editing a file;
	the last time a file was printed;
	editing comments, and who made them; and
	in some cases, even previous versions of the file.

Some basic metadata, such as the amount of time spent editing a file, is readily available from the File Menu (click on Properties). But other information about a file requires specialized computer forensics software and training to access, such as the date and time a specific person made comments on a document.

Metadata often contains information that can establish a user's knowledge of the existence of a file and its content, can provide a timeline of events, and can produce additional investigative leads.

Interior Department Sanctioned for Resisting E-mail Discovery Request

The US District Court for the District of Columbia sanctioned the Secretary of the Interior and other trustees (Defendants), in a class action brought by beneficiaries (Plaintiffs) of Individual Indian Money (IIM) trust accounts. Plaintiffs requested sanctions after Defendants sought a protective order clarifying that "it may produce from paper records of E-mail messages rather than from backup tapes, and may overwrite backup tapes in accordance with departmental directives." Noting that Defendants resisted the E-mail discovery ruling on two previous occasions, the court denied Defendants' motion and granted Plaintiff's request for discovery sanctions under Federal Rule of Civil Procedure 37(a)(4). Specifically, the court ordered Defendants to pay expenses and attorneys' fees incurred by Plaintiffs' opposing Defendants' motion for a protective order.

Cobell v. Norton,  206 F.R.D. 324 (D.D.C. 2002); see also Cobell v. Babbitt, 30 F.Supp.2d 24 (D.D.C. 1998) for additional background.

Company-Owned Computer Used by Employee At Home is Subject to Discovery

TBG Insurance Services Corporation (Defendant) terminated an employee (Plaintiff) for allegedly violating the company's electronic policy by accessing pornographic Internet sites at work. Plaintiff sued Defendant for wrongful termination, arguing that the Web sites were not intentionally accessed, but rather just "popped up" on his screen. As TBG had provided Plaintiff with two computers - one he used in the office and another he used at home - TBG sought production of the home computer to determine whether the same or similar Web sites were accessed at home, so as to discount Plaintiff's "pop up" argument. Plaintiff opposed the motion, arguing that he had a privacy right in the information on the computer's hard drive. However, the California Court of Appeals for the Second District agreed with Defendant and ruled that the information on the home computer was "indisputably relevant" and subject to discovery. Moreover, the court held that Plaintiff had no reasonable expectation of privacy after signing Defendant's computer policy, acknowledging that the computer was company property and subject to monitoring by authorized personnel. The appellate court then directed the trial court to fashion a protective order defining the scope of the computer forensic inspection of the hard drive and copying of information, to prevent unnecessary dissemination of irrelevant information.

TBG Insurance Services Corporation v. Superior Court,  96 Cal.App.4th 443, 117 Cal.Rptr.2d 155 (2002)

Court Ordered Forensic Examination of Computer Owned by Former Playmate of the Year

The US District Court for the Southern District of California granted a request by Playboy Enterprises, Inc. (Plaintiff) to make a mirror image of the hard drive of a personal computer owned by a former Playmate of the Year (Defendant) in a trademark infringement and unfair competition case. Playboy also asked for access to the Defendant's personal computer to recover relevant E-mail. The court granted the request, ruling that under Federal Rule of Civil Procedure 34 "documents" included both hard copy and electronic formats. Further, because the Defendant had deleted potentially relevant E-mail, the court ordered a computer forensic specialist to produce a mirror image of Defendant's hard drive to retrieve the deleted information. In its order, the court addressed privacy and attorney-client privilege concerns by requiring the forensic examiner to act as an Officer of the Court, and to sign a protective order that forbade unauthorized disclosure of information found on the Defendant's hard drive.

Playboy Enterprises, Inc. v. Welles, 60 F.Supp.2d 1050 (S.D. Cal. 1999); see also Simon Property Group L.P. v. mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000).

There's Just No Substitute for Imaging a Hard Drive

In a recent case involving a partnership dispute, an attorney turned several CDs over to Computer Forensic Investigator Andrew Jolley to review.

The attorney had requested electronic files of accounting records, contracts, E-mail and other correspondence for a specific period of time from opposing counsel, and received this information on CD - but the electronic discovery request did not demand imaging of the computer hard drives on which those files resided.

Spinelli Corporation advised this attorney to send opposing counsel and the client a preservation letter requesting that the computers be shut down until we imaged the hard drives. Subsequently, computer forensic analysis found thousands of relevant files that were missing from the original production.

Comparing the material on the CDs to the contents of the hard drives, we quickly found a raft of altered documents - including the accounting files, which had been significantly altered just prior to being copied to CD - as well as deleted E-mail and contacts that were not included in the original production.

As this client learned, the only way to help ensure complete and accurate production of electronic files and data is to image a computer hard drive. When files are copied to CD, important metadata, such as the date the file was created, is altered. In this case, metadata showing the dates accounting files were modified established that the files on the CDs were not identical to the files on the hard drives.

In addition, a CD will contain only those files that are copied onto it. A hard drive, on the other hand, will contain deleted files, file slack and other relevant data that can be unearthed using specialized computer forensic tools.