Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

confidential customer lists, quotations and price books – in a new, competing business. One of the
defendants admitted that he downloaded price books from the company’s server to his laptop on
the day he resigned. The plaintiffs hired a computer forensic expert to examine the laptop, and the
expert discovered confidential files were accessed, downloaded and placed in a Zip file. The expert
also determined a new Zip folder – containing quote histories and budgets – was created and
subsequently copied from the hard drive to a CD-Rom on the same day the defendant was served
with the plaintiffs’ complaint and preliminary injunction motion. During the copy, the computer
automatically placed the files in a “CD burning folder”, a folder most computer users are not aware
exists. During the next few days, in a “mass wave of deletion,” over 12,000 files were deleted from
the defendant’s computer. The laptop’s application log, which tracks programs like the CD-Rom
burning program, was also deleted four days after the complaint was served. Despite this
evidence, the trial court denied the plaintiff’s motion for a preliminary injunction, finding insufficient
evidence existed to prove any of the defendants used the price books before they were destroyed.
On appeal, the court reversed the decision, determining the trial court abused its discretion, and
ordered the trial court to grant a reasonable preliminary injunction. The appellate court noted,
“[b]ecause [the defendant] destroyed this crucial piece of evidence [the application log], we
presume it would have showed he successfully copied the price books on a CD.”
� DirecTV, Inc. v. Borow, 2005 WL 43261 (N.D.Ill. Jan. 6, 2005). The plaintiff brought a motion for
summary judgment, claiming the defendant used the plaintiff’s satellite television signal without
authorization and then spoliated evidence of the unauthorized use. The court had previously
awarded sanctions against the defendant for deliberately destroying evidence by using “Evidence
Eliminator,” a software wiping utility program, to erase electronic evidence requested by the
plaintiff. The plaintiff’s computer forensic expert examined the computer and recovered some of the
deleted files, including programs used by satellite pirates to intercept the plaintiff’s encrypted signal
and files listing the name of piracy websites the defendant visited. Other files were permanently
deleted. The defendant argued “somebody else” was responsible for these actions, even though he
declared the computer remained in his exclusive possession. Granting the plaintiff’s summary
judgment motion, the court noted, “[t]he fact that [the defendant] deleted certain files on his
computer only five weeks after the start of this litigation creates an inference that he destroyed
evidence that would have been harmful to his defense.”
� Peter Rosenbaum Photography Corp. v. Otto Doosan Mail Order Ltd., 2004 WL 2973822
(N.D.Ill. Nov. 30, 2004). Claiming the defendants violated a limited publication agreement, the
plaintiffs subpoenaed relevant electronic documents. The defendants refused to comply with the
subpoena claiming undue burden and expense. The plaintiffs brought a motion to compel
document production. In response, defense counsel advised the court that the automatic stay
provision under bankruptcy law did not subject a debtor to civil discovery unless a bankruptcy court
lifts the automatic stay. Based on this representation, the court gave the plaintiffs leave to withdraw
their motion to show cause. Filing in bankruptcy court, the plaintiffs moved a second time to compel
the document production. The plaintiffs also sought sanctions against defense counsel for her
“unsupported verbal representations” regarding the automatic stay provision. Noting the
defendants’ non-compliance argument was unsupported by case law and the plaintiffs had
attempted to minimize compliance costs, the bankruptcy court granted the plaintiff’s motion to
compel the electronic documents. The bankruptcy court also granted the motion for monetary
sanctions against defense counsel, declaring “[t]here is a not so fine line…between zealous
advocacy and intentional misrepresentation of the facts of this case.”
183