Extract from Toyja Kelley and Noah Mason’s article “Following the Trail of Lost or Destroyed ESI with Forensic Imaging”
When there is potentially crucial evidence on a computer or device once controlled by the opposing party, an ex-employee plaintiff, or someone suspected to have stolen trade secrets we want to track it down as soon as possible. For anything done on a computer there will be a trail of data that can be traced. That information can reveal what files were on the device, when those files were downloaded or transferred, and how they were used. But what do we do when the trail goes cold or comes to a dead end? Even when a user attempts to cover their tracks by deleting or overwriting files there is often a traces of data left behind that can provide valuable information the deleted information or even allow for the recovery a file.
This article discusses tactics litigants used to hide or destroy electronically stored information (“ESI”), how attorneys can detect it with forensic experts, and how courts have looked at such behaviors to determine whether suspicious behavior warrants forensic imaging. It is not an exhaustive study of these topics –as tactics change as rapidly as technology and features on the newest device. But we will look at recent cases to provide insights into the issues, expose common tactics, and show how counsel uncover suspicious activity despite efforts to hide it.
A forensic expert can be hired to track and assess whether a file has been erased or modified as well as how and when a file was last accessed. However, forensic examination may only be available after the party seeking examination can show unauthorized access to data or some other improper conduct. As a result, defense counsel must have both the technical and legal skills to uncover and address attempts at spoliation. See SHANNON BROWN, ESQ., MA, JD, PEEKING INSIDE THE BLACK BOX: A PRELIMINARY SURVEY OF TECHNOLOGY ASSISTED REVIEW (TAR) AND PREDICTIVE CODING ALGORITHMS FOR EDISCOVERY, 21 Suffolk J. Trial & App. Advoc. 221, 223 (2016). In order to properly supervise technology vendors as required by the Model Rules of Professional Conduct, we must be informed users of forensic imaging technology and exhibit more than an uncritical reliance on these experts in our cases. Id.
