2014: Winter Issue

Home – Electronic Evidence Is Threatened By A Computer’s Normal Use . . . And What Attorneys Can Learn From Monkeys

Electronic Evidence Is Threatened By A Computer’s Normal Use . . . And What Attorneys Can Learn From Monkeys

With the exception of your most embarrassing emails or photographs from, say, a tequila bar in Cancun--which seem blessed with immortality--digital data are frequently and easily lost through error, deception or normal daily use, such as when files are overwritten.


Given the fleeting and vulnerable nature of data on laptops, smartphones, and flash drives, how can litigants make sure relevant electronic evidence--especially from the proverbial "time in question"--is preserved? 


And what about the privacy concerns of the individuals who own the devices?  Data that are relevant to a court case may be mixed together with unrelated information, such as the device owner's emails to friends, their tax returns, or photos depicting their failed experiments with eyeliner.


These issues were raised in federal court in Las Vegas in a case involving a couple that both worked for the same furniture manufacturer. They were fired for allegedly accessing company data, such as board member emails and customer information, and altering company data, such as expense accounts. The couple had filed a wrongful termination claim in state court; their employer sued them in federal court for violating laws including the Computer Fraud and Abuse Act. 


Saying the couple improperly gained access to trade secrets, sensitive business information and customer credit information, the company wanted to get snapshots of the couple's home computers and other devices to ensure relevant evidence was not lost through normal use or--given the couple's alleged history of monkeying around with data--subterfuge. If they knew a device contained incriminating information, the company feared,the couple might have altered its contents. The couple protested all of this as an invasion of privacy. They also argued that discovery had not yet even begun.


Not all evidence is apparent

As reported in a recent issue of Mealey's Litigation Report: Discovery,U.S. Magistrate Judge Cam Ferenbach held in United Factory Furniture Corp. v. Alterwitz that mirror-imaging was justified to prevent spoliation. In addition to preventing the loss of relevant data from a critical point in time, Judge Ferenbach said he had an interest in protecting people from unauthorized dissemination of personal credit information as well as protecting the furniture company's trade secrets. 


"This evidence could not be obtained through simple document production, as information describing the history, tracking or the management of an electronic file is usually not apparent via a hard copy or a screen image," the judge wrote, adding, "For the action to be fairly litigated [the Alterwitz couple's] computers must remain unaltered."


Judge Ferenbach did not ignore the couple's privacy protestation, however, and accounted for it in his five-part protocol:


1. The court will appoint a forensic computer expert who specializes in electronic discovery to create a mirror image of the defendants' computers and any of their devices that store electronic information. The court directed the parties to agree on the specialist; otherwise he would make the selection.


2. The couple's attorneys are to meet with them to determine which devices they have (or had) during the relevant time period, and then make those devices available for mirror imaging. If any relevant devices are no longer in the couple's possession or are not working, their attorneys will provide a log of those devices with details, such as where they are today.


3. The computer specialist will serve as an officer of the court. Any access he or she has to information that is protected by attorney-client privilege will not result in a waiver of privilege.


4. The parties must agree on a schedule for when the imaging will take place, and only counsel for the couple may be present during the process.


5. The mirror images must be delivered to the court along with a copy of the order in a sealed envelope marked with the name of the case. The files will remain in the court's custody during the litigation.


How normal use of a computer can destroy evidence, as it exists at a specific time, was addressed in the April issue of Wisconsin Lawyer. Computer forensic expert Bruce A. Olson, president of ONLAW Trial Technologies LLC, cautions attorneys to not even boot up a computer and especially not to start poking around on it.


"Even the process of booting the computer can alter information, and certainly accessing and reviewing files on the computer will alter file metadata. This could result in serious spoliation of evidence and the imposition of sanctions," Olson wrote.


Computer forensics examiners are trained to collect evidence and create forensic images of the original media "in a way that ensures that the data on the source device is not altered during the collection process," he continued.


Small drives kill data faster

"When a forensic image is made, the examiner copies not only the files that are visible to the average user but also the unallocated space from which deleted files may be recovered," Olson added. "Deleted files are randomly overwritten by the normal operation of a computer's operating system. This makes electronic evidence extremely volatile. The longer one waits from the time a file is deleted to the time a recovery effort is made, the more likely it is that the file will have been overwritten."


Data have a shorter life expectancy on smaller drives. "Cell phones and smartphones in particular overwrite data much more often than do personal computers," Olson warned.


Perhaps a good way for an attorney to remember Olson's warning is to remember the monkey and the toaster. While a monkey can knock a toaster over and smash it to bits--and eventually even learn to make toast--without proper training, he is more likely to cook a finger. If you need a visual image of a monkey's encounter with one of the best inventions of all time to help you remember, we have supplied one here.  Or, you can watch our monkey friend in action in this clip on YouTube. You're welcome!


At the time of this writing, this video clip had a shockingly low view-count of 81, but we will have a difficult time proving that fact a year from now. 


For more information about LexisNexis products and solutions, connect with us through our corporate site