X

Thank you for sharing!

Your article was successfully shared with the contacts you provided.
Many corporations routinely issue laptops, mobile phones, and personal digital assistants to their workers. More recently, USB drives and other portable electronic devices have become more common. A USB drive, a small data-storage device (commonly viewed as the next generation of the floppy drive), can hold multiple gigabytes of electronic data and plugs into a common USB port of any computer. These devices allow corporations to keep their employees connected to the office — whether they are physically there or not — increasing their flexibility without sacrificing the need to communicate with colleagues throughout the day. But the technology boom is also having an impact in the halls of justice. Companies and their employees are creating and saving electronic evidence faster and in more places than they ever did with paper. They are saving documents to USB drives and then making edits on their home computers. They are drafting e-mails on their BlackBerries while having dinner with their families or sitting in traffic. They are sending instant messages while sitting in teleconference calls. For today’s litigator this influx of gadgets means searching for evidence in an ever-increasing number of digital places. For instance, in Smoot v. Comcast Cablevision, decided by the Delaware Superior Court, on Nov. 16, 2004, a case involving an employment dispute, the plaintiff had engaged in a four-hour instant-message conversation with two of her co-workers on her company laptop. The conversation included numerous sexual references as well as racially derogatory remarks and profanity. The instant-message transcript served as more than sufficient evidence to find that the company had just cause for discharging the employee. Since the vast majority of all communication today occurs electronically and very little ever makes its way to paper, the efforts expended to find the needle in one of today’s digital haystacks can be overwhelming. It is critical that legal professionals be aware of some of the hottest — and most perilous — mobile office devices on the market and understand what they need to stay ahead of the tech-toy trends as they relate to legal discovery. THE NEEDLE IN THE HAYSTACK Instead of collecting box after box of paper documents, modern document collection teams typically gather backup tapes, hard drives, floppy disks, and CD-ROMs. But in addition to this standard electronic evidence, new technical devices are complicating legal discovery. When searching for electronic evidence, investigators and forensic experts must not dismiss the nontraditional media devices. Rather, with the help of a computer forensic expert, investigators may find that these devices contain some of the most powerful evidence. Cell phones. Consumers are increasingly buying “smart phones” — cell phones that offer limited computer capabilities such as e-mail, Web browsing, and instant messaging. Many phones also take and store photos and videos. If media equipment can store music, it can store nearly any other form of data, as well. Cell phones can hold a wealth of data, including text messages, pictures, Web pages, contact information, and calendar items. For instance, Nokia recently announced the release of a phone with a four-gigabyte hard drive. At this capacity, it could potentially hold up to 400,000 pages of e-mail and file data. The phone also comes with a camera, Wi-Fi, and Bluetooth technologies. Wi-Fi, short for wireless fidelity, will allow the phone to connect to the Internet through a wireless connection. With Bluetooth technology, the phone can communicate directly with a computer, PDA, or other mobile phone to download information between each gadget. Cell phones often can offer clues about a user’s actions. As cell phone investigations are relatively uncharted waters, both the law and technology involved with investigating cell phone data are still in their embryonic stages. Nevertheless, if cell phone evidence is important to a case, it may be worth consulting an expert to find out what data can be recovered. PDAs. Personal digital assistants such as Palm Pilots, BlackBerries, and Pocket PCs combine a range of basic functions, including computing tasks, cell phone and fax capabilities, and personal organizational capabilities. A search performed on a PDA can reveal appointment and contact information, e-mail exchanges, and evidence relating to electronic documents. PDA users also can create and save information, including confidential data, and then synchronize the data with their computer. Since this option is available, relevant evidence may exist on a PDA that was never saved to a laptop or operating system, making it available only through a thorough forensic examination of the PDA. Because most PDAs use technology similar to that of a computer, nearly any kind of file or program that can be saved and run on a computer can be saved and run on a PDA. If data on a PDA is potentially important in a case, it may be a good idea to enlist the services of a computer forensic expert. PDAs are unique in that they do not record the same file information found on a standard computer system. A competent computer forensic expert, however, can extract and keyword-search files, e-mails, address books, memos, and other information on a PDA. Keep in mind that some PDA models contain password-protection features that are virtually unbreakable. If possible, ensure that the expert conducting the examination also has access to the PDA’s accessories, such as software, cradles, cables, chargers, flash-memory cards, and manuals. USB drives. Universal Serial Bus drives (pen drives, thumb drives, lipstick drives, flash drives) allow data to be transferred to and from digital devices. The days of the 3.5-inch diskette are numbered, as it is being replaced with devices smaller than a human finger that can store hundreds of times as much data. A USB drive is a compact flash-memory drive that acts like a portable hard drive. About the size of a pack of gum or a small tube of lipstick, a USB drive can be slipped easily into a pocket, conveniently around one’s neck, or onto a keychain. They also can be found attached to pens, pocket knives, flashlights, and other common office supplies. They have become popular as marketing giveaways. Thus, it is not uncommon to see employees with multiple USB drives, which they received at trade shows and educational conferences. But these new devices can be an increasing threat to corporate security. USB ports on modern computers make it possible for electronic data theft to occur quickly, quietly, and discreetly. In the typical case, an individual seeking to steal confidential or trade-secret information simply inserts the device into the USB port on a computer, saves the data to the device, removes the device, and walks away from the computer — all with relative anonymity. Fortunately, computer forensic examiners can typically locate transactions to or from a hard drive and a USB drive. Instant messaging. A cross between e-mail (it is a typed message) and a telephone call (it is instant and not usually recorded), instant messaging enables users over the Internet to engage in “real-time” communication. Most users download free IM software from the Internet. Some IM software providers offer companies “secure IM” for a fee. Secure IM allows companies to track every communication to a database. Once the software is in place, users can set up a list of correspondents (often called a buddy list) and send an instant message to any of their contacts who happen to be online. In an IM conversation, both users see the messages as text that appears in windows on their computer screens. Some programs also feature video and voice conferencing as well as the ability to transfer files through a single IM session. Depending on the instant messaging software used, forensic analysis of computers featuring IM programs may or may not recover user conversations. In State v. Voorheis, on Feb. 13, 2004, the Vermont Supreme Court affirmed the trial court’s finding that “instant messaging” text was sufficient evidence to support the defendant’s conviction for incitement and attempt to use a child in a sexual performance. Similarly, in United States v. Brand, decided by the U.S. District Court for the Southern District of New York on Jan. 12, 2005, the government claimed the defendant used America Online IM software in an attempt to engage in sexual conduct with “Julie,” an undercover government agent posing as a minor. The court admitted a transcript of one of these sessions between the defendant and two other undercover agents, who had sent and received instant messages from the defendant. Typically, IM sessions are saved in volatile memory — that is, memory that purges its contents when the computer or hardware device loses power. Recovering an IM session stored in this format is not likely. It is possible, however, to recover the contents of an IM session if it was cached to the hard drive or to a swap file. A swap file is a portion of the hard drive set aside for the exclusive use of the operating system, which uses the space as virtual memory. Data that is in memory, but unused at the moment, can be “swapped” from actual memory to the hard drive swap file and later moved back into actual memory when needed for processing. Typically, data stored by the operating system in its swap files can be accessed using computer forensic technology. If this occurs, keyword searches for the user names or contents of the messages may locate remnants of the conversation. In addition, third-party software — such as private IM software available for company-wide use — may log the chat sessions, increasing the chances of recovery. Digital cameras. Although it looks and functions like a normal camera, a digital camera stores images for later transfer to a computer. Devices of all sizes are being fitted with digital camera capabilities, allowing individuals to take pictures of highly sensitive areas or documents. Digital cameras can hold evidence such as images, sound, video, data on removable cartridges, and time and date stamps. Besides photographs, a camera can be a gold mine (or minefield) of other types of data, as well. When connected to a computer, digital cameras can appear to the computer as another local hard drive, meaning the computer user can store nearly any type of data on the camera’s storage media. The camera then becomes yet another repository of digital evidence. Similarly, music devices (such as iPODs and similar MP3 players) and video-game consoles (such as the PS2 and Xbox) should not be overlooked for their ability to transfer, store, and hide data valuable to your case. Today’s technology simply gives criminals and ne’er-do-wells the means by which to conduct hi-tech hijacking and high jinks. High-tech digital devices could become fundamental pieces of evidence in litigation. In-house and outside counsel cannot afford to miss that one e-mail stored in an executive’s PDA, at the cost of being sanctioned for discovery abuses or paying large damage awards. As technology continues to advance, other sources of electronic evidence will surface, and a careful counsel has to keep up with these changes. The best course of action is to work with computer forensics or electronic-evidence experts. Not only will the experts have an opportunity to explore the limits of the technology, but they may be able to help uncover smoking-gun evidence in your next case.
Christopher D. Wall is a legal consultant for Kroll Ontrack Inc. He is based in Washington, D.C.

This content has been archived. It is available exclusively through our partner LexisNexis®.

To view this content, please continue to Lexis Advance®.

Not a Lexis Advance® Subscriber? Subscribe Now

Why am I seeing this?

LexisNexis® is now the exclusive third party online distributor of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® customers will be able to access and use ALM's content by subscribing to the LexisNexis® services via Lexis Advance®. This includes content from the National Law Journal®, The American Lawyer®, Law Technology News®, The New York Law Journal® and Corporate Counsel®, as well as ALM's other newspapers, directories, legal treatises, published and unpublished court opinions, and other sources of legal information.

ALM's content plays a significant role in your work and research, and now through this alliance LexisNexis® will bring you access to an even more comprehensive collection of legal content.

For questions call 1-877-256-2472 or contact us at [email protected]

 
 

ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2020 ALM Media Properties, LLC. All Rights Reserved.