Computer Forensics & E-Discovery Specialist : Electronic Evidence Retrieval L.L.C. : Data Recovery, Hard Drive Retrieval, Deleted Files : New Orleans, Louisiana

  Koosharem Corp. v. Spec Personnel, LLC, 2008 WL 4458864 (D.S.C. Sept. 29, 2008) has a well known “story line” but is very interesting in two respects. 

Kenneth Fuston was a former employee of Koosharem who left to join SpecPersonnel.    The plaintiff alleged that Fuston took confidential information, used it to hire some 20 of the plaintiff’s employees, and started a business in direct competition with the plaintiff.

The court ordered that the Fuston produce to produce emails between himself and any current or past employee of either company from both his home and work computer. He produced 1,936 pages of email, however

Plaintiffs noted several problems with defendants’ original production.  Notably, all of the emails produced reflected the date compiled rather than the date received or sent, several emails allegedly retrieved from Trevor Doyle did not have Doyle listed as a sender or recipient, and many emails were missing their attachments.  These irregularities, plaintiffs argued, called the authenticity of the documents into question.  Plaintiffs also argued that documents were modified even after notice of litigation and that defendants made no document retention efforts after the lawsuit was filed.  Specifically in support of production of home computers, plaintiffs argued that defendants’ new hires were not immediately provided with a company email account and thus conducted work from home computers and personal email accounts.  Also, according to the plaintiffs, former employees emailed confidential information to their homes before going to work for defendants.

The court granted the second motion to compel and required forensic inspection of, not only the defendant’s home and work computers, but also those of the employees who left Koosharem and went to SpecPersonnal.

I’m frequently asked for samples of various documents needed in e-discovery, for example, a litigation hold letter. In issuing his order in this case, Judge William M. Catoe included a detailed, 20-step protocol for conducting the forensic analysis. He includes a time line as well. It is excellent and I recommend it to anyone looking for a template for an expert examination of ESI devices.

Secondly, note that the home computers of the plaintiff’s ex-employees’ were subjected to forensic analysis. More and more I find myself recommending that you keep your personal and business communication and data strictly separated. I understand the convenience of sending a personal email from a work machine in the middle of a busy day (or sending a business email from a personal account at night), but as I see more cases in which inspection of personal, home computers is compelled, I’m beginning to think the risks are too high. 

• Email This
• Print
• Comments & Questions
• Trackbacks

Today’s blog is about deleting files and file slack space, a rich source of evidence for the forensic examiner—and a favorite topic of mine.

Most people have heard the expression “formatting a disk.” Formatting a drive divides up the space on the drive into pieces called sectors. Each sector has a numeric address. As an application needs disk space, the operating system assigns it enough sectors to fill its needs. To keep track of “who’s got what,” the operating system keeps a directory that is much like a phonebook.   When a user needs to access some data, the operating system goes to the directory and looks up the data’s location.

  But what happens when you delete a file that was stored in one or more of these sectors? Again, the operating system goes to the directory and finds the data’s location. However, rather than actually deleting (removing) the data, all the operating system does is place a special mark in the directory indicating the disk space is no longer needed and can be reassigned to other applications that need space. Nothing is done to the file itself. The file just remains on the drive

until the operating system reassigns the space to some application. It is much like a renter who is told by the landlord “I’m going to put the house on the marked, but you can stay until the new owner moves in.”

What happens when the operating system eventually reassigns the space? The first thing to know is that when disk space is needed, operating system assigns whole sectors at a time. That is, an application needing 2 ½ sectors would be assigned a full 3 sectors. When the information is

written to disk, the first 2 ½ sectors is over-written, leaving the last ½ sector unchanged. This unchanged space between the end of the file and the end of the sector is called slack space or simply slack. 

What is in the slack space? Remember, when a file is deleted the operating system only marked the space as available to be reused. If a new file only takes up a portion of the sector, the old data “stays” there until it, too, is eventually overwritten. In the example of the file needing 2 ½ sectors, the last ½ sector contains whatever was stored there before the overwriting occurred.

Slack space has the potential to contain any information that was ever stored—or even viewed—on the computer. Photos, documents, credit card numbers, internet browser histories, you name it.  The data in the slack space may be whole files or simply fragments of files (most often a mix of the two), but a forensic engineer can view, retrieve and catalog the evidence found in slack space. 

Slack space is a good example of the difference between a user doing a "copy-and-paste" and a forensic examiner making a valid forensic image.    Using "Copy" in our example, only the 2 ½ sectors would be copied, while a valid forensic image copies the entire 3 sectors.

The bottom line?  1, Don't assume that something is gone off your computer just because you can't see it!  2.  And the data in slack space can be the very piece of evidence you need in a case.

• Email This
• Print
• Comments & Questions
• Trackbacks

I came across several interesting items this week so this post is going to be about a variety of things. 

The Round Table Group, an expert services firm, approached me about writing an article for their newsletter. They wanted something different. I ended up writing about some actual scenarios from my practice. Although it was written for the Round Table Group’s clients, “Threading the E-Discovery Maze” is available publically.

IMS Services is another expert placement firm. Their latest newsletter, written by frequent blogger Robert Ambrogi, has an excellent compendium of e-discovery resources. He includes reading materials, blogs, and vendors. 

Recently President Bush signed into law Rule 502, an addition to the rules of evidence. I found an excellent discussion of it at Law.com: “How Rule 502 Affects Lawyers and E-Discovery.”

My expert reports often contain drawings, diagrams, and screen shots. That means they get too large to email. There are a number of web sites that enable you to send large files securely through their website. Robin Good has a list of four such sites along with definitions and range of services. Typically, they work by uploading your material to their website and sending an email to the recipient with a link to download. Some allow you to store materials for a substantial period of time, making them great for collaboration or working away from the office.  Obviously, if you have an ftp site (a technique for transferring files over the Internet), you do not need such services, but many small firms don't.

On July 1, a number of amendments to the rules of civil procedure went into effect in Ohio. According to the Ohio Supreme Court’s press release, key amendments include:

clarifying that issues related to electronically stored information are appropriate topics for resolution during pretrial conferences; clarifying that discovery of electronically stored information is permitted; amending to provide factors a judge should consider in determining sanctions when a party has destroyed potentially relevant electronically stored information; and specifying that a subpoena may be used to obtain electronically stored information from nonparties.

That reminded me that many states are making changes to their state version of the rules of civil procedure. Here is an updated list of the status of e-discovery rule changes in each state.

Ken Withers is Director of Judicial Education and Content for The Sedona Conference®, an Arizona-based non-profit law and policy think-tank which has been on the forefront of issues involving complex litigation, intellectual property and antitrust law.    His thoughtful upcoming article for the San Diego Lawyer Magazine is titled “E-Discovery and the Combative Legal Culture: Finding A Way Out of Purgatory” and proposes a more collaborative relationship between opposing counsel. He gives examples of the explosion of e-discovery and discusses moving beyond the adversarial legal culture. He argues “cooperative discovery” is a means of controlling e-discovery costs.  I’ve had some cases in which the opposing counsel cooperated with each other and some in which the definitely did not. And I can tell you from my perspective, cooperation is better. 

I'd be interested to hear from attorneys what their experience is with cooperative discovery and whether they think it has a chance.

• Email This
• Print
• Comments & Questions
• Trackbacks

  I had a client that was a small company. They were embroiled in some bitter litigation with an ex-partner who was demanding some Electronically Stored Information (ESI) as of the date of the dissolution of the company. Helping them respond to the discovery request taught them a lot about their handling of their ESI.

While discussing their situation, the owner marveled at how much he had learned in this process. He volunteered that he would now start counseling his own clients about their ESI quite differently! So I’m taking today’s blog as an opportunity to pass on to you some of my client’s new-found wisdom concerning ESI.

What should an organization do about ESI when an employee leaves? It’s natural to want to reuse the desktop and laptop computers. However, just passing them on to another employee is fraught with danger. There may be personal information, “remembered” passwords, and confidential information the new owner should not have access to. Worse still, there may be evidence of questionable web surfing activity. 

One might think the easiest solution to this is to erase the hard drive and build a new one. However, I have seen a number of suits filed after an employee has left and employers no longer had valuable evidence that could have helped their defense. Here is my advice: Preserve the ESI on the ex-employee’s drives. Create an inventory of what is on the drives.  A simple “print directory” program will work; there is no need for a full forensic image. Remove the drives and replace them with new ones. Store them in antistatic packaging and in a secure location for at least 3 years. This way, if you are ever faced with litigation, you have preserved the ESI and you know its location and content, as required by the e-discovery amendments.

Does this cost? Yes, the new drive and the work of installing and building the new system cost. But I think my client would assure that those costs are negligible “insurance” compared to the level of costs in having to try to reconstruct it years later!

Does the ex-employee have files stored on an office server? Email on a mail server? Are there backup tapes of the employee’s data, on their PC and/or on the servers? My advice concerning ESI on servers mirrors that for desktop and laptop computers. Inventory and archive a copy of all their server files. Delete any personal files to free up space on the server. 

Organizations face other changes that impact ESI, such as migrating to a new server. Prior to taking such actions, the organization should make a complete backup of the current server and place in safe storage. This backup should not go into a regular backup rotation procedure (since such tapes may soon be reused), but kept separate.

Computer storage has become, relatively speaking, cheap. Given the e-discovery amendments’ emphasis on preservation of evidence and the increasing number of cases involving ESI, preserving ex-employees’ hard drives intact makes good economic and litigation sense.

• Email This
• Print
• Comments & Questions
• Trackbacks

 Law.com has an interesting article “Work Blogs Take Off, and So Do the Suits” that discusses various approaches to the issue of employee blogging. Since blogging is so very public, an employer has a vested interest in the images its employees portray in their blogs.

Initially, employers prohibited employee blogs. That turns out to be hard to do since one can blog anonymously. In many cases, employers are not only encouraging blogging, but providing the resources to do so. They do this for many reasons. Some view it as marketing and actually employ media firms to help get positive messages in the blogs. Others, perhaps facing layoffs or stock declines, do it to keep a finger on the pulse of employees. Some law firms encourage associates to blog as part of their recruiting effort.

The problems that employee blogging can create for an employer seem almost endless: libeling a competitor, harassment, negative images of the company, exposure of trade secret information, leaking confidential information, defamation, and attempts to influence stock prices. Furthermore, employees can claim that company actions, such as termination, are retaliation for material in their blog. And , as Law.com points out, the suits have begun:

Earlier this year, Cisco Systems and one of its lawyers, Richard Frenkel, were sued for defamation over an anonymous blog in which Frenkel allegedly accused two Texas attorneys of engaging in criminal conduct in a case against Cisco. Ward v. Cisco, No. 2007-2502 (Gregg Co., Texas, Dist. Ct.); Albritton v. Cisco, No. 2008-481-CCL2 (E.D. Texas).

In Georgia, a former Delta Air Lines flight attendant who claims she was fired after she posted photos of herself in uniform on her blog sued the airline for sexual discrimination. The case was stayed last year while the airline is in bankruptcy. Simonetti v. Delta Airlines Inc., No. 5-cv-2321 (N.D. Ga. 2005).

In Colorado, a group of Quiznos Master franchisees last year sued the company for wrongful termination, claiming they were retaliated against for posting on their blog the suicide letter of a former franchisee, who attributed his suicide to troubles at work. The case settled in December. Bray v. QFA Royalties, No. 06-cv-02528-JLK-CBS (D. Del.).

My point here is that blogging is a fact of life and businesses need to take steps to protect themselves from liability. That means they need a clear policy on employee blogging. At a minimum, they need what Cisco did as a result of the Ward case: require a disclaimer stating that the opinions are those of the blogger and not the employer. 

Jeannie Wyatt of Schwabe, Williamson & Wyatt wrote an excellent guest editorial for the Puget Sound Business Journal on how businesses should discuss employee blogging. She offers four fundamentals in establishing blogging policy: 

• Instruct, don't restrict, employee bloggers. Keeping in mind that not all employee blogging may be restricted, use your blog policy to educate employees. The policy should clearly define permitted and prohibited content, as well as acceptable use of employer-owned technology. For example, employees should be prohibited from posting confidential company and trade secret information, as well as using unauthorized copyrighted material or trademarks. Finally, employees must be instructed not to criticize competitors, customers, or fellow employees.
• Educate and follow through. Once a blogging policy is in place, train employees on the policy and enforce it. If the blogging policy prohibits employee use of employer-owned technology for anything other than job-related duties, do not turn a blind eye when it is violated. Down the road, it will be very difficult for the employer to establish that violation of the company's blogging policy is grounds for termination if it is not consistently enforced. As with all company policies, be sure to revisit the blogging policy from time to time. This way, it will always adequately express expectations and reflect current law.
• Don't be too quick to terminate an employee for violating the blogging policy. It is important to consult with an attorney before terminating an employee for blogging. There are some instances where an employee's blog may be damaging to the reputation of the company but still be protected. This was the case in Konop v. Hawaiian Airlines, a case involving the blog of a Hawaiian Airlines pilot, Robert Konop. He claimed that he was wrongly disciplined based on the content of his blog. In his blog, Konop stated that the president of Hawaiian Airlines was suspected of fraud, incompetent, and "did his dirty work like the Nazis in World War II." Konop also criticized labor concessions sought by Hawaiian Airlines and the pilots union, and encouraged blog readers to consider alternate union representation. The Ninth Circuit Court of Appeals determined that the content of the blog represented protected union activity and lacked the actual malice needed to make it defamatory.
• Lead by example. Many probably remember the trouble Whole Foods CEO John Mackey found himself in last summer when it was discovered that over the course of several years, he had submitted anonymous posts bad-mouthing competitor Wild Oats. Mackey did not reveal that he was disparaging Wild Oats at the same time the two progressive grocery brands were considering a merger. When Mackey was found out, the Federal Trade Commission stepped in and halted the merger until it could assess what damage Mackey's postings might have had on Wild Oats' financials. While the merger eventually closed, the Securities and Exchange Commission is still investigating Mackey's postings -- a development that is likely the subject of many postings.

I wonder how many of you have Internet posting policies. 

Do they include blogging?

How many of your clients understand their risk in employee blogging? 

• Email This
• Print
• Comments & Questions
• Trackbacks

  Dennis Kennedy writing for the ABA Journal Magazine was clearly thinking about hurricanes Gustav and Ike, as I was in my last post.  His excellent article, "Master Your Disasters," discusses backup and disaster recovery in general. He also makes a case for using one of the many online backup services. I especially recommend his article because he discusses specific services, including some free ones, and techniques. And, like any good attorney, he poses questions and urges his colleagues to do their own due diligence.

• Email This
• Print
• Comments & Questions
• Trackbacks

Starting today, I am a judge in the Equivio Case Studies Contest. Equivio provides “near-duplicate” and “email thread” analysis on collections of electronic documents. Equivio users are invited to submit case studies of their use of Equivio. There are some lavish prizes; it is too bad the judges cannot win any of them. Submitting a case study is easy and short.   The contest runs through September 30.

In the wake of hurricanes Gustav (in the picture) and Ike, my thoughts turned to backups, disaster recovery plans, and such. I evacuated for Gustav and still haven’t unpacked all the boxes of paper files-and yes, I do still have paper files. I love my web-based automated backup service for the electronic files; it even sent me email when it hadn’t heard from my desktop computer for 5 days during the evacuation!

I get frequent calls from folks whose computer has just crashed and they need help in getting their data back. I try to be gentle when I ask about backups.  At least once a year the answer I get is “We have a backup. But it won’t load; the loader says it is corrupted.” A oversaw computer operations for more than 20 years and never tested my backup or disaster recovery system. Now I do!

• Email This
• Print
• Comments & Questions
• Trackbacks

  I came across a great blog on LegalLiteracy.com. This blog advertises “Building Bridges Between Business and Law” and talks about legal issues to the business community. In discussing a recent court decision in which a couple lost a suit filed by Recording Industry Association of America’s (RIAA) over their alleged distribution of copyrighted material, it provides an excellent discussion of the obligation to preserve evidence in civil cases vs. the right to non-incrimination in criminal cases.

The couple, after suit had been filed, reformatted their hard drive, thereby destroying evidence of whether or not they were using Kazaa (a file sharing program) to share copyrighted music. There was, as might be expected, quite a bit of commentary and criticism from the lay community when Judge Neil Wake ruled sanctions were warranted because of the spoliation.

I bring this article to your attention knowing that you fully understand the duty to preserve evidence. However, I thought that you may find it useful with clients who have never been informed (or who might need a reminder) of the necessity to follow litigation hold procedures.

For a litigation hold war story, check out Conrad Jacoby's blog on the outcome of Southern New England Telephone Company (“SNET”) v. Global NAPS, Inc., 2008 WL 2568567 in which defendants used software to overwrite relevant files in an attempt to thwart their discovery.

• Email This
• Print
• Comments & Questions
• Trackbacks

  White v. Graceland Coll. Ctr. for Prof’l Dev. & Lifelong Learning, Inc., 2008 WL 3271924 (D. Kan. Aug. 7, 2008) is a case I’ve been waiting for.

From a practitioners view point, I think the form in which ESI is produced is key in managing an e-discovery case. The form of ESI means the format and application that can process that format. Common forms are Microsoft Office documents such as Word (.doc) documents, Excel (.xls) spreadsheets, and PowerPoint (.ppt) presentations. Adobe’s Portable Document Format (.pdf)  is also popular, in part because Adobe makes reader for the format free to the public. (It is interesting to note that the .pdf format contains substantially less internal metadata than Microsoft Word files do.) The Tagged Image File Format, .tiff, was created in an attempt to bring standardization to scanners, but is now widely seen in scanning, optical character recognition, and faxing applications.

In discussing the form of ESI production, we also speak of native format. By that we mean the form in which documents were originally created, edited, and stored. Thus the native format for Word documents are the .doc files, as opposed to the Acrobat .pdf format to which a Word document can be converted. 

There are numerous tools and techniques available for investigating discovery production when it is in electronic, searchable forms. I know attorneys who say they prefer the traditional paper production, but when we start talking about terabytes of data, that is a warehouse full of paper documents! 

The e-discovery amendments to the Federal Rules of Civil Procedure allow the requesting party to specify the form in which the ESI is to be produced. If the requester fails to do so, the producer is directed to disclose the forms it will use. If the parties cannot agree on the form, they may have to confer with the court. The rules allow the producer to transform the ESI into a “reasonably usable” alternate form, however, the amendments are clear that if the ESI is searchable by the producer, it must be searchable by the requester. The Committee Notes that accompany the amendments warn “[the] option to produce in a reasonably usable form does not mean that a responding party is free to convert [ESI] from the form in which it is ordinarily maintained to a different form that makes it more difficult or burdensome for the requesting party to use the information efficiently in the litigation," and that "[i]f the responding party ordinarily maintains the information it is producing in a way that makes it searchable by electronic means, the information should not be produced in a form that removes or significantly degrades this feature." [Emphasis added.]

In the White case, the plaintiff called for certain documents including emails and attachments. In producing emails and attachments, the defendant forwarded the emails to an administrative assistant who then converted them into Adobe .pdf format. Those documents were then printed and provided to the plaintiff in paper form.

The court ruled that the emails and attachments were not produced in a “reasonably usable” form and that the plaintiff was entitled to them in native form with their metadata intact. U.S. Magistrate Judge David Waxse went on to say

The Court notes that this discovery dispute is an example of one which the re-production of discovery could have been altogether avoided had the parties adequately conferred at their Fed. R. Civ. P. 26(f) conference regarding production of electronically stored information ("ESI").  While not all disputes regarding discovery of ESI can be prevented by early efforts by counsel to investigate and consider the possible forms discovery may be produced, many disputes could be managed and avoided altogether by discussing the issue before requests for production are served.  Guideline 4(f) of the Guidelines of Discovery of Electronically Stored Information, available on the District of Kansas' website, specifically mentions that during the Fed. R. Civ. P. 26(f) conference, counsel should attempt to agree on the format and media to be used in the production of the ESI. [Emphasis added.]

While the point of this blog post is the importance of addressing the form of ESI production, I couldn’t help including the plug for adequate preparation for, and participation in, the Rules 26 conference.

• Email This
• Print
• Comments & Questions
• Trackbacks