X

Thank you for sharing!

Your article was successfully shared with the contacts you provided.
When does “delete” really mean “delete”? Almost never, according to experts on document retrieval. The case of destroyed documents — like those Enron materials sent into the void by Arthur Andersen employees — sounds like a debacle. But it turns out that a deleted document does not necessarily mean a missing document. By now, many attorneys know that pressing the delete button in Outlook does not mean an e-mail is gone forever. When a document or memo is deleted, it can often be recovered from a computer’s hard drive or possibly backup tapes. It is not as simple as lighting a match to a piece of paper. One reason electronic data are hard to destroy is that they can be infinitely replicated. TRACKING E-MAIL “Remember, those documents traveled,” said Andrew Levetown, chief executive of CoreFacts L.L.C., a computer investigative firm in Chantilly, Va. Memos get e-mailed, and e-mails get copied, forwarded and synched with BlackBerrys and Palm Pilots. Another reason data is hard to destroy is that it can often be resurrected. “Something has been deleted. Can it be undeleted?” asked Scott Charney, co-leader of the cybercrime prevention and response practice in the Washington, D.C. office of PricewaterhouseCoopers. The answer, he said, is often yes. A deleted e-mail, for example, can actually remain on the user’s hard drive, or the network server. Companies will often keep backup tapes of the server. They may keep those tapes for days, weeks, months or years. The likelihood of finding a deleted document on a server decreases with time, said Charney. But even if there is no backup, there may be remnants of the file on a hard drive. When a user deletes a file, the computer actually only deletes the name of the file from a master list. But it does not actually erase the file. The file still rests on the drive, where it will be overwritten, bit by bit, as other files are created. Sometimes a computer is seized before the file has been written over. File fragments can often be recovered, revealing at least some of those documents. But depending on who you are representing, this can mean different things. “You need to be cautious about [fragments] because you don’t know what you’re missing,” warned Charney. It is possible to write over the hard drive. Tons of new files can be loaded onto the hard drive. There are also programs that will scrub down the hard drive, like Norton Utilities Wipe Info or OnTrack’s DataEraser. Some information, however, can still be salvaged. MODERN WIZARDS A number of companies can, like wizards, make much of the missing data reappear. Arms of big accounting firms, like PricewaterhouseCoopers, and smaller companies like Eden Prairie, Minn.-based OnTrack Data International Inc., and CoreFacts do this kind of work. They typically handle investigative and discovery work in fraud and trade secrets cases. They create a copy of a hard drive and then cull it for those file fragments. They will look for records that say when a file was deleted, and how. These logs alone can often tell a story of how an employee may have, say, conspired to cover up information, said Peter McLaughlin, the partner in charge of Deloitte & Touche’s forensic and investigative service. MAGNETIC FORCE These companies can’t do everything. Some cutting-edge technology can help uncover data that have been wiped out by using a magnetic force microscope. This technology is not yet sold commercially. It is extremely expensive, say experts, and is currently used only by security agencies within the government. Like the Internet — originally created by military planners — this technology may someday be publicly available.

This content has been archived. It is available exclusively through our partner LexisNexis®.

To view this content, please continue to Lexis Advance®.

Not a Lexis Advance® Subscriber? Subscribe Now

Why am I seeing this?

LexisNexis® is now the exclusive third party online distributor of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® customers will be able to access and use ALM's content by subscribing to the LexisNexis® services via Lexis Advance®. This includes content from the National Law Journal®, The American Lawyer®, Law Technology News®, The New York Law Journal® and Corporate Counsel®, as well as ALM's other newspapers, directories, legal treatises, published and unpublished court opinions, and other sources of legal information.

ALM's content plays a significant role in your work and research, and now through this alliance LexisNexis® will bring you access to an even more comprehensive collection of legal content.

For questions call 1-877-256-2472 or contact us at [email protected]

 
 

ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2020 ALM Media Properties, LLC. All Rights Reserved.