On May 4, 2010, ANZ Advanced Technologies (plaintiff) was ordered to produce all hard drives and storage devices used by two of the company’s officers (Irfan Sheriff and Rakesh Vashee) for forensic analysis and ESI production. ANZ moved to modify the order seeking to substitute forensic images of the devices for the devices themselves. The court refused to allow the use of forensic images and mandated that ANZ turn over the physical storage devices

ANZ was forced to submit its devices for forensic analysis because of misrepresentations made about creation dates of various documents. The court found that ANZ’s conduct cast serious doubt on the authenticity of any document it produced from the hard drives of any computers or other storage devices in the possession of Mr. Sheriff or Mr. Vashee.

For example, ANZ stated that a certain letter was created in August 2008, when, in actuality, the file submitted for discovery had been created in March 2009. ANZ claimed that the letter was simply “copied” when it was retyped by Mr. Sheriff’s assistant, Mr. Kahn. This retyping was done because Kahn was in a hurry and 1) he could not find a soft computer copy of the letter, 2) he did not have a scanner for the hard copy, and 3) the computer copy of the letter was in the possession of ANZ’s attorneys. Needless to say, the court was unhappy with this line of reasoning, especially since ANZ had represented the letter as having been created in August 2008. There was no evidence that the letter’s original contents were directly copied.

ANZ had also “copied” the minutes of a meeting that occurred in July 2008 by retyping them in March 2009. The “copy” was based on Mr. Sherriff’s notes and options that had been listed on a whiteboard at the meeting. ANZ claimed this “copying” was necessary because Mr. Sherriff had spilled a can of coke on his laptop. Once again, there was no evidence that the copy was made from the original minutes that were actually on file.

ANZ also claimed that it could not physically produce the requested hardware because it was being criminally investigated in India, and could not send out the devices. Like the “copied” documents, the court found ANZ’s claims to be flawed and half true.

Misconduct and misrepresentations regarding documents produced in discovery will cast serious doubt on the authenticity of any documents produced. When this occurs, the opposing party is clearly entitled to physical forensic analysis of all data storage devices with relevant documents, not just forensic images.

Michael Tucker Jr. received his B.A. in Political Science from The College of New Jersey. He will receive his J.D. from Seton Hall University School of Law in 2011. After graduation, Michael will be clerking for a trial judge in the Superior Court of New Jersey.

Comments (1):

1. Reply

   Larry said:
   November 10, 2011 at 10:28 AM

   I’m not sure characterizing ‘retyped’ documents/records as being ‘copying’ is accurate. That would be the same as saying files opened and re-saved on a computer that has had it’s system clock back-dated was ‘copying’ a file.

   One other items that can cause a forensic nightmare that wasn’t addressed here and is frequently left off stories similar to this is what happens when using certain legitimate duplication and data copying or drive imaging applications. Some of them will re-date the files EVEN THOUGH THEY ARE ONLY MAKING A DIRECT COPY because the application sees that as an ‘action’.

   In a legal sense, this is obviously problematic… but even more so from a business or operational sense when you’re seeking information from a specific time period. It’s important for users to understand the operations performed by backup and imaging applications PRIOR to using them and that they also log/document actions taken (and the purpose for the action) when mirroring a hard drive prior to replacing it or upgrading a system, or performing even routine or periodic backups.