X

Thank you for sharing!

Your article was successfully shared with the contacts you provided.
Each month new tools and gadgets that claim they can permanently delete computer data and eliminate evidence enter the marketplace. “Evidence Eliminator,” “HistoryKill,” “Incinerate Software,” and “Window Washer” are just some of the commercially available data-wiping software on the market. While these tools are often used for legitimate purposes, some individuals have used wiping software to hide or destroy evidence of criminal activities, corporate fraud, and other inappropriate conduct. Attorneys and information technology staff working in an increasingly tech-savvy business environment must be aware of these utilities, how they function, and what kinds of trails of information they may leave behind. After all, being able to demonstrate that the opposing party attempted to destroy computer evidence may lead to a favorable verdict. For example, in a recent case, Electronic Funds Solutions v. Murphy, the court entered terminating sanctions, ending the lawsuit, for the use of data-wiping software. In that case the plaintiffs’ computer forensic expert discovered that four of the defendants’ hard drives had been “wiped” by “Data Eraser” software after the court ordered the defendants to produce their hard drives. The defendants appeared to have aborted “Data Eraser” on one of the computers minutes before they were required to turn it over to the plaintiffs’ expert. On appeal, the court upheld the terminating sanctions, stating the “Plaintiffs recovered e-mails from the computer only because defendants had not run the program properly.” The court also said the “defendants’ actions have made it virtually impossible to determine what items defendants destroyed.” The Murphy case represents just one example of how courts will sanction parties for using wiping utilities to deliberately destroy data in the wake of impending litigation. Attorneys also should take care to ensure their clients are aware of the problems associated with using data-wiping utilities when a lawsuit is imminent or under way. Clients may assume that running a wiping tool will permanently destroy data and that such data will never resurface. These tools do not always work flawlessly, however, and they may leave behind some of the files or references to the files intended to be wiped. Even when a data-wiping tool successfully deletes data, evidence that the tool itself was used may show up on the drive. Thus, a court may infer that the destroyed data would have been valuable evidence against the party and may award sanctions in the form of monetary awards, unfavorable comments to the jury about the party’s conduct (known as adverse-inference instructions), or even a dismissal. By developing a firm grasp of data-wiping concepts, lawyers will be in the best position to assess how the use of a wiping utility can benefit or harm their cases. DATA-WIPING UTILITIES 101 Files stored on a hard drive are saved with a precise pattern of characters generated by the computer’s operating system. When a hard drive or portion of a hard drive is “wiped” using a wiping utility, the program attempts to overwrite data with a benign or randomly generated pattern of characters. If run properly, a wiping utility will make the data unrecoverable by most computer forensic experts. But in some instances, even when the product is run according to instructions, traces of data are left behind. In some circumstances that data may provide the telltale evidence for proving a case. In most cases investigators discover the presence of a data-wiping tool after the data have already been deleted and are rendered unrecoverable. But even though many of these utilities are highly successful, most are rarely foolproof. Experienced computer forensic investigators can often find bits and pieces of files left on the computer. Even more damaging, investigators frequently uncover evidence of the program itself as well as the date and time the program was used on the computer. Here are some concepts counsel must understand. •�Some data-wiping utilities can leave crucial file traces on the drive. Even when data have been wiped, opportunities to recover evidence may still exist. Many wiping utilities do not completely live up to their manufacturers’ claims, and some products leave full files or file names intact, making them ripe for detection and recovery by a trained computer forensic investigator. These file traces could be enough for a judge or jury to surmise what evidence existed on the drive before the wiping software was used and why the user was attempting to permanently delete this information. • A reference to the wiping tool is usually recorded on the drive. Even if data have been wiped effectively, discovering the existence of a wiping piece of software, its installation date, and when it was used may be relevant to a fact-finder attempting to discern events in a case. It may also form the basis for an adverse-inference instruction, which may tip the scales in favor of the attorney’s case. • Some wiping utilities are capable of permanently destroying data. While data-wiping software may successfully eliminate crucial evidence, courts will not hesitate to impose sanctions for intentional or even unintentional electronic data destruction. To avoid being sanctioned, attorneys should communicate with their clients about their data-preservation obligations, warn them about the potential consequences of data destruction, and ensure to the greatest extent possible that relevant data are preserved. Attorneys need to be able to recognize when the data they are trying to preserve or obtain may have been tampered with by a wiping utility. In these instances counsel should immediately engage a computer forensic expert who can begin putting the pieces of the puzzle together. Attempting to try to identify if and when a wiping program was used without the assistance of a qualified expert can lead to unintentionally altered data. TAKING IT TO COURT Courts have acknowledged the importance of digital evidence in civil cases and criminal investigations. When litigation arises, parties have a duty to preserve electronic evidence that is relevant to the claims and defenses in the matter. Courts can use a variety of remedies against individuals who intentionally overwrite or “scrub” their computers using data-destruction utilities. Here are a few of the possible remedies courts could use. • Preservation orders. When there is proof that data destruction is likely to occur or actually has occurred, courts will not hesitate to issue an order requiring the offending party to preserve relevant information. For example, in Hypro, LLC v. Reser, the plaintiff filed a motion to preserve and protect evidence, claiming the defendant installed and used “Incinerate” on his company laptop to wipe 94 megabytes of information and then returned the laptop without mentioning the wiped files. Based on the plaintiff’s allegations, the court ordered all parties to preserve and “not erase, alter, modify, or destroy” any evidence, including e-mail and electronic documents. • Investigation costs. Some courts have required parties to pay costs incurred in a computer forensic investigation where data-wiping has occurred. In a recent embezzlement case, United States v. Gordon, a computer forensic analysis revealed that an employee ran “Evidence Eliminator” at least five times the night before he turned his computer over to his employer for examination. At trial, the employee was convicted of embezzlement and ordered to pay restitution, including reimbursing the employer for a portion of the investigation costs. An appellate court upheld the award, noting the employee “purposefully covered his tracks as he concealed his numerous acts of wrongdoing from [his employer] over a period of years. As the victim, [the employer] cannot be faulted for making a concerted effort to pick up his trail and identify all the assets he took amid everything he worked on.” • Negative-inference instructions. Several courts have held that adverse-inference jury instructions can be an appropriate remedy for litigants who have attempted to destroy documents using a wiping program. For instance, in Advantacare Health Partners, LP v. Access IV, a computer forensic expert discovered that before one of the defendants left the company he used “BCWipe” to delete more than 13,000 files from his home and office computers and server, including 100 files deleted just hours before the defendants submitted the hard drives for analysis. The court awarded the plaintiffs $20,000 in sanctions and indicated it would instruct the jury to assume the deleted files would have damaged the defendants’ case. • Default judgments. One of the harshest sanctions for intentionally deleting relevant computer documents was issued in Communications Center Inc. v. Hewitt. In this case the defendant ran “Evidence Eliminator” on three hard drives and claimed he had used the program to cover up evidence of an affair and to prevent the disclosure of embarrassing Web sites he had visited. The magistrate found this conduct “a stark affront to the judicial process” and awarded the plaintiff $145,811 in costs and fees. Perhaps even more damaging, the magistrate recommended a default judgment, a ruling against the defendant, be entered for six out of the eight causes of action. • Dismissal. In Kucala Enterprises Ltd. v. Auto Wax Co., based on digital clues left on the hard drive, computer forensic experts determined the plaintiff had used “Evidence Eliminator” to delete and overwrite more than 12,000 electronic files. Although there was no clear indication that relevant evidence existed among the destroyed files, the magistrate judge described the plaintiff’s actions as “egregious conduct” and recommended that the plaintiff’s case be dismissed with prejudice and that the plaintiff be ordered to pay the defendant’s attorney fees and costs incurred in defending the motion. What’s the lesson here? The sooner an attorney is aware that a data-wiping tool may have been used, the sooner he or she can enlist the assistance of a computer forensic expert who can help assess the effects of the utility and its ultimate impact on the merits of the case. Attorneys who understand some of the basic issues surrounding the use and evidentiary implications of data-wiping software will be best equipped to offer effective legal arguments in support of their cases when data-wiping spoliation issues arise.
Michele Lange, based in Minneapolis, is a staff attorney, and Jason Paroff, based in Secaucus, N.J., is director of computer forensics, for Kroll Ontrack.

This content has been archived. It is available exclusively through our partner LexisNexis®.

To view this content, please continue to Lexis Advance®.

Not a Lexis Advance® Subscriber? Subscribe Now

Why am I seeing this?

LexisNexis® is now the exclusive third party online distributor of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® customers will be able to access and use ALM's content by subscribing to the LexisNexis® services via Lexis Advance®. This includes content from the National Law Journal®, The American Lawyer®, Law Technology News®, The New York Law Journal® and Corporate Counsel®, as well as ALM's other newspapers, directories, legal treatises, published and unpublished court opinions, and other sources of legal information.

ALM's content plays a significant role in your work and research, and now through this alliance LexisNexis® will bring you access to an even more comprehensive collection of legal content.

For questions call 1-877-256-2472 or contact us at [email protected]

 
 

ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2020 ALM Media Properties, LLC. All Rights Reserved.