FORDHAM FORENSICS When It Really Matters770-777-2090
Forensic Preservation:
Don't Lose Before You Begin
Failure to preserve digital evidence for litigation can be costly, since simply continuing to use a computer can destroy evidence. It is more than simply just not deleting anything. The continued use of a computer can alter important metadata such as file system date and time stamps. Similarly, continued use can overwrite dynamic system data such as virtual memory stored to disk. In addition, continued use can overwrite deleted data so that it is unrecoverable.
Preservation is the most important step in litigation. If not performed, relevant evidence can be lost. If not performed properly, relevant evidence could be inadmissible. In either case, sanctions are both possible and likely.
In Gates Rubber Co. v Bando Chem. Ind., Ltd., 167 F.R.D. 90 (Dist CO, 1996) an inferior preservation technique contributed to the award of monetary sanctions.
In Zubulake v UBS Warburg, 229 F.R.D. 422 (S.D.N.Y. 2004), an adverse inference and monetary sanction were ordered when evidence was not preserved because counsel failed to adequately inform the client of its preservation duties and monitor the client’s preservation efforts.
In Phoenix Four, Inv. v Strategic Resources Corp., 2006 WL 1409413 (S.D.N.Y. 2006), both client and counsel were ordered to split monetary sanctions resulting from destruction and late production of evidence.
In Consolidated Aluminum Corp. v Alcoa, Inc., 2006 WL 2583308 (M.D. La. 2006), monetary sanctions were ordered because backup tapes were not preserved under the theory that they were inaccessible and not discoverable.
Since preservation is the first step that every litigator should take, a misstep can mean defeat before the enemy is even engaged. As a result, there are several steps that litigators should take regarding preservation.
First, they need to place both client and opposition on notice of their duty to preserve digital evidence. The notice should occur early--even prior to filing suit.
Second, litigators should preserve electronic evidence in a forensically sound manner. In other words, in a way that will not alter the data and will capture the full spectrum.
It is not just the active data that needs to be preserved. Deleted data and all forms of metadata should be preserved as well.
In fact, the preservation effort is best focused at the storage media such as hard drives and backup tapes and not the data itself. If the media is preserved, everything on it will also be preserved.
Third, preservation can be done rather economically. It is not necessary to analyze the data during preservation. Rather, it only needs to be preserved for future analysis.
Fourth, a party must still preserve relevant evidence even if it is not accessible. The new rules do not alter any of the prior statutory and common law duties.
Fifth, just as a party is not required to preserve every scrap of paper, it is not required to preserve every electronic document. Indeed, it is only required to preserve those relevant to the dispute.
Sixth, as is apparent from Zubulake, litigators will have to be proactive in their client’s preservation efforts to ensure that relevant evidence is properly preserved. In order to succeed, litigators may have to interview or even cross examine their clients about their electronic data and computer systems.
Since the same basic questions may be relevant from situation to situation, litigators may want to consider developing a generic questionnaire that would be applicable in multiple situations. Such a questionnaire could serve as a checklist of issues not to be overlooked. Also, it could be valuable during the discovery planning conference and for a 30(b)(6) depositions of the opposing party’s IT designee.
Not only is preservation important. It is economical. So, there is no real reason not to preserve. As the litigation unfolds, the parties can decide what to analyze. But, if nothing has been preserved there maybe nothing to analyze and both client and counsel could be sanctioned.