17.01.2013 Views

Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

against the defendant as a sanction for the state’s discovery violations. Pursuant to a court order,<br />

the defendant had requested a “forensically sound” image copy of his computer hard drive, which<br />

had been turned over to the state by someone other than the defendant. When the state failed to<br />

comply with this <strong>and</strong> other discovery requests, the defendant moved to suppress any evidence<br />

derived from the computer <strong>and</strong> to have the charges dismissed. Refusing to award sanctions at that<br />

time, the district court granted the state more time to produce the disclosures. However, the state<br />

still had not produced the requests or allowed the defendant to access the computer even after<br />

several months had passed. As a result, the trial court granted the defendant’s motions for<br />

suppression <strong>and</strong> dismissal. On appeal, the state argued that it did not want to lose the forensic<br />

value of the computer by giving access to the defendant since that would violate laws prohibiting<br />

dissemination of child pornography. Affirming the trial court’s decision, the appellate court noted,<br />

“[a]lthough dismissal is an extreme sanction, ‘[t]he values sought to be achieved through reciprocal<br />

discovery will be attained only if the rules are properly observed, <strong>and</strong> to this end the trial courts<br />

must have the ability to make those obligations meaningful’.”<br />

� In re Pemstar, Inc. Secs. Litig., Civ. No. 02-1821 (DFW/SRN) (D. Minn. Apr. 23, 2004). In a<br />

securities fraud class action lawsuit, the plaintiffs filed a motion to compel production of<br />

spreadsheets, electronic documents <strong>and</strong> databases in native format. In support of its argument, the<br />

plaintiffs declared that the “usual course of business” requirement set forth in Fed. R. Civ. P. 34<br />

should be interpreted as requiring production of the data in native format. The defendants claimed<br />

that the production format should be either paper, TIFF or PDF <strong>and</strong> argued that Fed. R. Civ. P. 34<br />

does not require native production <strong>and</strong> TIFF production would adequately address any of the<br />

plaintiffs’ concerns about retaining metadata <strong>and</strong> file structure. The court ordered the defendants to<br />

produce a sub-set of documents in native format, stating that “production of electronic discovery in<br />

native format is appropriate, feasible, <strong>and</strong> important under the circumstances of this case.” The<br />

court further noted that in this case the substantive allegations were based upon an employee’s<br />

native Lotus Notes file, making it “most useful to the fact finder to view, underst<strong>and</strong>, <strong>and</strong> step into<br />

the shoes of the information source that actually provided the alleged knowledge <strong>and</strong> access.”<br />

� Anderson v. Crossroads Capital Partners, L.L.C., 2004 WL 256512 (D.Minn. Feb. 10, 2004). In<br />

a sexual harassment <strong>and</strong> whistleblower lawsuit, the defendants sought to recover the hard drive of<br />

the plaintiff’s personal computer because it allegedly contained an October 2001 document<br />

outlining the harassment. After a protracted discovery battle, the defendants sought a Motion to<br />

Compel <strong>and</strong> the judge ordered the plaintiff to furnish the defendant with a "copy of all<br />

documents/files relevant to this litigation that exist on Ms. Anderson’s personal computer as well as<br />

those that have been deleted or otherwise adulterated." Pursuant to the judge’s Order, the<br />

defendants’ computer forensic expert examined the plaintiff’s hard drive <strong>and</strong> discovered that a data<br />

wiping software application had been installed after the plaintiff had agreed not to “delete any<br />

existing documents” in a deposition. The computer forensic expert also found that the hard drive<br />

installed in the machine was manufactured in August 2002. The plaintiff claimed that she did not<br />

use the software program to destroy evidence, but that she used it routinely to protect her<br />

computer files. She also stated that in her view she owned the same computer throughout the<br />

litigation despite changing the hard drive in 2002. The defendants then moved to dismiss the<br />

complaint due to the plaintiff’s alleged discovery violations <strong>and</strong> destruction of evidence. The court<br />

noted that the plaintiff’s “exceedingly tedious <strong>and</strong> disingenuous claim of naiveté! regarding her<br />

failure to produce the requested discovery…defies the bounds of reason” but was not sufficiently<br />

egregious to warrant dismissal of the case. Instead, the court issued an adverse inference jury<br />

206

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!