Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

document preservation order. The requested order would require the government to index
electronic documents and would allow the plaintiff limited inspection of the documents. The
government contended that the proposed order was unnecessary and overly burdensome, in part
because document retention policies were already in place at the government agencies likely to be
implicated in the suit. The court held that the plaintiff was required to demonstrate “that absent a
court order, there is significant risk that relevant evidence will be lost or destroyed.” Additionally,
the plaintiff “must show that the particular steps to be adopted will be effective, but not overbroad.”
The plaintiff was able to produce evidence that the government had lost and destroyed documents
in the past, including electronic records containing potentially relevant information. Based on this
evidence, the court ordered the government to preserve all documents, including electronic
information, e-mail, and metadata that contained relevant information or that might lead to the
discovery of relevant information. The court further required the government to index all the
documents and to report any documents that were destroyed. The court indicated that the
possibility of sanctions “which the case law suggests may be severe…provides the
incentive…needed to effectuate this preservation plan.”
� Renda Marine v. United States, 58 Fed.Cl. 57 (Fed. Cl. 2003). In a government contract suit, a
dispute arose regarding both parties’ duties to preserve evidence. Specifically, the plaintiff moved
the court to compel access to the defendant’s hard drives, backup tapes, and e-mail systems,
alleging that the defendant did not search any hard drives or backup tapes in preparing its
response to the plaintiff’s document production requests. The defendant denied these allegations.
The plaintiff further alleged that the defendant routinely deleted e-mail even after commencement
of the suit and moved the court to sanction the defendant for such spoliation of evidence. The court
held that, upon notice that litigation might occur, the defendant had a legal obligation to preserve
evidence related to the plaintiff’s claim. The court directed the defendant to produce, at its
expense, backup tapes created after such notice and to provide the plaintiff with access to the
requested hard drive. The court further ordered the defendant to produce backup tapes pre-dating
notice of the suit at the plaintiff’s expense. In a subsequent decision, Renda Marine v. United
States, 62 Fed. Cl. 371 (Fed. Cl. 2004), the court determined e-mails sent to and from an attorney
in the defendant’s general counsel office were privileged even after they were forwarded to nonattorneys
in the agency.
United States Air Force Court of Criminal Appeals
� United States v. Sanchez, 59 M.J. 566 (A.F. Ct. Crim. App. 2003), aff’d in part and rev’d in part,
60 M.J. 329 (A.F. Ct. Crim. App. 2004), aff’d by 61 M.J. 330 (U.S. Ct. App. A.F. 2005). A federal
appellate military judge determined that the government produced sufficient evidence to prove that
the defendant knowingly possessed child pornography images stored in his computer’s temporary
Internet files. After making a mirror image of the computer’s hard drive, investigators used a
software program called "Carve This" to uncover remnants of files that were overwritten or deleted
from the hard drive. The program found that the presence of the images on the hard drive was
consistent with someone viewing them on the Internet and the images then being automatically
saved to the hard drive by the web browser. Combining this with evidence of the defendant’s
subscriptions to nude teen websites, the court determined that the evidence supported the
allegation that the defendant knowingly possessed the pornographic images.
United States Tax Court
311