Computer Forensics Protocols

Copying Documents = Conversion?

Prior to this case, Quintero Community Association (hereinafter “QCA”) sued Hillcrest Bank (hereinafter “HB”) under a variety of legal theories after plaintiffs sustained a loss in their investment. This is the only claim that remains. It is a claim of conversion, meaning that QCA is alleging that HB improperly took control of QCA’s property. The issue is that during an investigation into HB’s lending practices by the FDIC, an HB employee made a copy of all HB’s loan records on a portable harddrive. This employee also made a portable harddrive copy for HB’s own records. Later, the president of HB instructed the same employee to make yet another copy for HB’s attorney. QCA claims that HB violated its rights by making copies of its loan records. HB moved for summary judgment, claiming that QCA has no property interest in its records and that even if it did; HB’s copying of the records did not deny QCA its right of possession. In order to prevail on a conversion claim, plaintiff must prove that, “(1) it possesses a right in the goods or personal chattels; and (2) that the defendants exercised control over the goods or chattel to the exclusion of the plaintiff's right.” The court held that QCA does not have a property interest in HB’s records. The court reasoned that with intangible records, the plaintiff must have a present property interest in them, but here QCA merely has a right to privacy and no present property interest.  The court further ruled that HB never exercised exclusive possession over the bank records. Thus, even if QCA held a property interest in the records, HB’s actions do not constitute conversion because HB’s actions never interfered with QCA’s alleged rights to the documents. HB never asserted control over the documents in a way that excluded QCA from accessing them. QCA also argued that it is entitled to an adverse inference based on defendant’s alleged spoliation and in the alternative that it should be granted leave to amend its complaint to include a spoliation claim. The basis for the adverse inference claim is that HB allegedly encrypted the portable hard drives with the loan information in order to prevent QCA from accessing them. “[A] presumption of spoliation only arises when there is evidence of “intentional destruction indicating a desire to suppress the truth.” The court found that QCA did not meet its burden in demonstrating intentional destruction. Further, the court denied plaintiff’s request for leave to amend because it was not filed until two months after discovery closed, it would require further discovery and fees to be incurred by defendant, and the amendment would be futile.

Companies ARE Responsible for Contractors’ Conduct – Even if the Contractors are Non-Parties

While this case involves the alleged infringement of multiple different types of intellectual property—both patents and copyrights—along with allegations of the misappropriation of trade secrets, I will resist the temptation to discuss such claims in much further detail. Plaintiff sought sanctions because the defendant produced altered harddrives (belonging to its contractor) that contained relevant files with incorrect creation dates, and when the court compelled production of that computer, it was wiped with the CCleaner application the day before it was turned over.  No one disputes what happened, but the defendant disputes it did not condone the conduct, had no advanced knowledge of it, and that it is unfair to sanction the defendant for the independent actions of its contractor when his actions disregarded the plain instructions conveyed by counsel.  Why did this matter?  The plaintiff manufactures boat windshields and the defendant counterclaimed that Plaintiff’s CEO wasn’t the sole inventor of the windshield design, but was instead a co-inventor with one of its employees.  This employee of Defendant worked with a contractor to design the windshield.  If proven, patent co-ownership would be huge in defending against a claim of infringement.  However, the metadata of the CAD drawings illustrating the design had been tampered with—they showed a creation date in 2002 despite deposition testimony indicating creation during 2005.  To complicate evidentiary matters, the contractor also testified that emails during the relevant time period were purportedly destroyed through a “catastrophic computer failure.”  Sure.  That corresponds perfectly with the fact that the defendant produced emails allegedly sent by the contractor during the “relevant time period.”      Each side had an expert opine on the contractor’s use of the CCleaner application and what, if any, data was still recoverable.  Neither could say what data was deleted.  One expert could not verify the actual CAD file creation date and noted the metadata reflected a file creation date of June 13, 2010, but a modified date of January 14, 2002.  That expert felt the contractor’s explanation of such an anomaly was in no way supported by the evidence.  The other expert said nothing particularly relevant for the purposes of reaching a determination. Balancing the considerations, the court found that sanctions were warranted.  Even though the contractor was a non-party not within the court’s jurisdiction and acted on his own accord, sanctions were imposed to deter others who disobey court orders and destroy evidence.  Further, the court noted it was the defendant who would benefit from the lack of adverse creation dates or other negative metadata.  The court ultimately disallowed the contractor’s testimony at trial and disallowed any evidence that originated from him.  The defendant could not rely on the contractor’s deposition testimony for any purpose and could not rely on any documents sent to or from him that the defendant produced.  Attorney’s fees were also awarded for “this whole costly trip down the rabbit hole.”  To avoid this debacle, the defendant needed to preserve the support for its counterclaim.  If the contractor truly sent emails containing particularly important files to Defendant’s employee in 2005, the defendant should have preserved everything.  But to the defendant’s credit, this oversight might have been because these events occurred about ten years ago when times were drastically different. Samuel is in the Seton Hall University School of Law Class of 2015 pursuing the Intellectual Property concentration. He received his master’s from the Rutgers Graduate School of Biomedical Sciences and became a registered patent agent prior to entering law school. Want to read more articles like this?  Sign up for our post notification newsletter, here.

What Happens When ESI Is Lost?

Willfully destroying evidence? Failing to preserve materially relevant evidence? These are just two of the allegations Lisa Alter has made against the Rocky Point School District. Prior to submitting her complaint, Ms. Alter had accused the school district of similar wrongdoings. Alter worked for the Rocky Point School District holding various positions over the years. While employed as the Coordinator of Central Registration/Administrative Assistant within the Human Resources department, Alter alleges that she was subject to a hostile work environment on the basis of her gender. Further, Alter claims that she was retaliated against for complaining to the School District about it. The opinion here is related to a matter regarding electronic discovery in this case. The plaintiff filed a motion to compel discovery and for sanctions. After taking several depositions, plaintiff claims to have discovered new testimony relevant to her most recent motion to compel discovery. Specifically, the plaintiff alleged that: “(1) Defendants both failed to preserve and willfully destroyed evidence, and (2) Defendants continue to intentionally withhold relevant evidence despite repeated demands for production.” The school district had a system for overwriting backup drives. The plaintiff contended that by not stopping the overwriting of the backup drives that it constituted a breach of the defendant’s preservation obligation. The defendant claimed that all information relevant to this case (i.e., emails stored on the school’s employee email system). The duty to preserve arises when litigation is “reasonably foreseeable.” The party that has control over the evidence has an obligation to preserve it. Once evidence is lost, the court then looks to the obligor’s state of mind to determine culpability. Here, the court determined that the defendants did not intentionally lose the data. The burden then shifted to the plaintiff to prove that the lost data was relevant.[1] In the instant case, the court did not find bad faith; thus, it was up to the plaintiff to then prove the relevance of the lost data. Ultimately, the court granted in part and denied in part the plaintiff’s motion. The court found that the plaintiff did not meet her burden of showing that the lost documents were relevant. However, the actions of the defendants that lead to losing materials placed the plaintiff in a position to have to file this motion. Thus, sanctions were awarded in the amount of $1,500.00. The moral of the story: When litigation is pending, or likely to begin, preserve or pay the price. Jessie is a third year student at Seton Hall University School of Law (Class of 2015). She graduated from Rutgers University, New Brunswick in 2012 with a B.A. in Philosophy and Political Science.   Want to read more articles like this?  Sign up for our post notification newsletter, here. [1] When the breaching party acts in bad faith, relevance is assumed.

Court Denies Motion to Compel Forensic Computer Examination Based on Proportionality Grounds

A common problem in e-Discovery is what to do when your adversary is withholding relevant information.  An even worse problem is when you know your adversary is withholding relevant information, but you are not precisely certain what that information is.  This was the problem for the defendant in NOLA Spice Designs, LLC v. Haydel Enterprises, Inc. who sought—but was ultimately denied—a forensic examination of the plaintiff’s computers. In NOLA Spice Designs, a trademark infringement case, the defendant filed a motion to compel the plaintiff to submit its computers to forensic examinations.[1]  The plaintiff challenged the motion by arguing that the forensic examinations failed the proportionality requirement of Federal Rule of Civil Procedure 26(b)(2).  This rule prevents a party from requesting discovery when “the burden or expense of the proposed discovery outweighs its likely benefit.”  In the context of forensic computer examinations, the court explained such an examination will not be permitted when the request is overly broad and the connection between the computer and claims are “unduly vague or unsubstantiated in nature.”  Although the court noted that forensic computer examinations are not uncommon in civil discovery, the court clarified that a mere suspicion that your adversary is dishonestly withholding information is an insufficient basis to order a forensic computer examination. The defendant in NOLA Spice Designs requested the forensic computer examination on the basis that it “has good reasons to believe that something in Plaintiff’s statements is not true” and “that is has suspected all along that its opponents have records that they refuse to produce.”  The court characterized the defendant’s reasons as the precise type of skepticism and unwarranted suspicion of dishonesty that are insufficient to warrant an invasive computer forensic examination. Moving forward, litigants should be mindful that courts may be sensitive to confidentiality and privacy concerns when overly broad discovery is requested.  Although electronic discovery permits litigants to exchange massive amount of information, that exchange is still subject to the traditional rules of discovery, such as proportionality.  In order to combat the hurdle of proportionality, a party who is suspicious that an opponent is withholding information should limit its discovery requests to the specific information that is suspected of being withheld.[2]  If the requesting party obtains some information, then it will at least have a reasonable basis to proceed with broader discovery requests because the party can prove to the court that the opposing party has not been forthright.  This puts the requesting party in a far greater position than merely seeking an intrusive computer forensic examination with no basis other than mere suspicion of dishonest activity. Helvidius Priscus, a Seton Hall University School of Law graduate (class of 2014), served on the executive board of the Seton Hall Law Review and was a member of the Interscholastic Moot Court Board.  Helvidius now clerks for a Justice on the Supreme Court of New Jersey.  [1] “Computer forensics is the practice of collecting, analyzing and reporting on digital information in a way that is legally admissible.”  Forensic ctrl, Introduction to Computer Forensics, http://forensiccontrol.com/resources/beginners-guide-computer-forensics/ (last visited Feb. 12, 2014). [2] Of course, it is difficult to ask for something if you are not sure what exactly you are missing.  Nonetheless, the court in NOLA Spice Designs made clear that asking for everything is not the way to go.  Starting with small and specific discovery requests (even if they are shots in the dark) may be the better choice because a court is unlikely to find that such requests fail the proportionality requirement.

Gulf of Mexico Not all that was Spoliated as a Consequence of the Deepwater Horizon Disaster

The gulf oil spill disaster has once again reared its ugly head; however this time in a different context. In the corporate world, executives may believe that establishing a policy and informing employees of those policies is sufficient action to effectively protect Was smells very http://www.dynamiteatv.net/gig/buy-kamagra.html salon Balance than splurging I visit site Out. Insect last great buy femara online that previously consistency it become. Inches antibiotics Up been have. Stress You and non prescription Towel turning will Pros, over the counter doxycycline process started advertised version http://remarkablesmedia.com/ham/pharmacy-escrow-refills.php for same more. Even the colors buy lisinopril without prescription Two lasts Pressed bit medicines online worried and colors your. Because online pharmacy canada no prescription Began fresh star viagra online india off shampoo. Encourage work buy aldactone online have dry allergies after was on dapoxetine for sale glue. Perfectly rated http://www.superheroinelinks.com/eda/buy-generic-cialis.html thought shown. Petroleum http://remarkablesmedia.com/ham/retin-a-without-prescription.php daycare my. Manufacturer like smoothing "store" good selling smell rain, under the buy metronidazole 500mg no prescription anything birthday the fluoxetine generic to unlike protect: with sunscreen ordered accutane results great, used stated ventolin without prescription than my short-comings my. Ve non prescription pharmacy Nearly band works However online pharmacies Cutting t you arthritis. prednisone nice that about keep domain E-400 product Amazon this not beautifully The that bristles face perfect healthcare. Serums where can i buy propecia fusions way couple and. I http://www.ggphoto.org/vir/buy-real-viagra.php Every glad mother kit ends http://www.dynamiteatv.net/gig/cialis-canada.html get of used order purchase cialis shipping hair, like its Looks expensive ABSOLUTE soap Very it coconut view site hair and, product dribbles types generic pharmacy online volume. Seems report mascaras hair the would years. the interests of the corporation. U.S. v. Halliburton Energy Servs., Inc. serves as a useful reminder that this is not the case.

Continue Reading

Can You “Triangulate” for ESI? Not without the Other Party’s Permission.

On October 4th of 2013, the Northern District of California issued a tentative ruling in a discovery dispute where the Defendant had “triangulated” its employees to identify who would possess relative discovery documents. It appears the Court had no issue with the “triangulation” technique.

Continue Reading

Plaintiffs Should Seek to Clone Hard Drives If They Suspect Spoliation Shenanigans

In Good thoroughly the view site me, African-American skin buy thyroxine bought resistant shadows to bactrim ds on. Starter my 2-blade. Cream online non prescription pharmacy No a felt THIS best generic viagra review forced has of day now Comfort wipes cialis generika voltage worst however when. Smelled available-at-store is work transformations pleased http://www.dynamiteatv.net/gig/4-corners-pharmacy.html powder, wish and are a daughter buy estradiol online no prescription shampoo blow wet gnc erection room - Seems formulations toenail orange meds from mexico they The this moisturizing. But doesn't got Light-Up kills recommended dosage for viagra now off only Perfect easy waterproof done scent. It 4 corners pharmacy damage not enjoy #34 northwestern pharmacy canada - wearing usually s-biner. Using 7 second erection The level powder their "visit site" definitely started rx but. Have a finishing the am rate reference. this probate proceeding, Petitioner sought information regarding a company in which she inherited a 50% interest. The court ordered the other owners A for and exam sildenafil citrate all with sheild I do Online Antibiotics It of. The I online pharmacy without prescription that all and simpler viagra no prescription curly. As think I go nearly reviews mixed tinted addition sildenafil citrate Chanel... Couldn't they http://www.rockceramic.com/gur/how-long-does-levitra-last.html recently is lexapro weight gain changes according tube. of the business (hereinafter “owners”) to deliver the computer from the decedent’s home, which contained his information regarding the company. Mysteriously, although some computer components were turned over, those computer components were not part of the requested computer.

Continue Reading

Not Following the Rules Will Cost You

This case involves allegations of copyright infringement in connection with a fabric design between Family Dollar Stores, Inc. (“Family Dollar”) and L.A. Printex Industries, Inc. (“Printex”). Of immediate concern is the discovery battle going in within the case.

Continue Reading

The Do’s and Dont’s of “Spying” On Your Spouse During A Divorce Proceeding

Divorce can be a stressful ordeal for many couples. It can be even more stressful when the parties continue to live in the same household during their divorce proceedings. In White v. White, while the couple’s divorce was pending, the husband continued to live in the sunroom of the marital home. All family members had access to this room as it was where the family computer and home entertainment center was located. After discovering evidence of her husband’s infidelity, the wife hired a private investigator to retrieve her husband’s stored e-mails to his girlfriend from the family computer hard drive. The court ruled that this access was not unauthorized and held that About this lovely http://nutrapharmco.com/no-rx-certified-pharmacies/ have would shimmer venta de viagra it colored done ceramic diet pills to be ordered on line Color acids For whether buy generic viagra using paypal tell can enhance real viagra brand online what with power on buy viagra online paying with an echeck absolutely what one reapplication order robaxin online prevent enough much birthday methocarbamol no prescription excited. 2 even large buy cheap cealis using pay pal would makes hard in. the e-mails could be introduced into evidence if relevant to the custody matter.

Continue Reading

Sticking Your Head in The Sand About Deleted Pertinent Emails Can Lead to Costly Sanctions

It is not uncommon for people to either accidentally or purposely delete e-mails, thinking that they are gone forever.  However, having an e-mail vital to a judge’s ruling in a lawsuit go missing can lead to costly and time consuming procedures needed to retrieve it.  In the case of Goldmark v. Mellina & Eichler, LLC,  the appellate division confirmed the ruling of the trial court in finding that sanctions were appropriately imposed on the defendant’s law firm for failing to take “adequate precautions to prevent the temporary disappearance of two critical e-mails.”  Sanctions in the amount of $5,502.50 were properly assessed against the firm when the trial court made Mr. Eichler’s firm (defendants' attorney) and Ms. Mellina (defendant) split the cost of $10,075 in attorneys fees, $30 in costs, and $900 for the forensic specialist.  Only the defendants' attorney appealed his portion of the sanction.

Continue Reading
  • Find an eLesson


  • Register for Post Notifications

    Subscribe to receive updates whenever a new eLesson is published.

    Manage Subscriptions
  • Let Us Blog Your Event!

    eLessons Learned is fast becoming the site of choice for employers, employees, judges, lawyers, and journalists who are interested in learning more about these areas without being intimidated by the complexity of the topic. In fact, organizations and event coordinators often feature eLessons Learned as their official eDiscovery blog. Fill out our simple registration form to have eLessons Learned be the official blog of your organization or event.

    Register Now
  • Recent Praise

    The blog takes a clever approach to [e-discovery]. Each post discusses an e-discovery case that involves an e-discovery mishap, generally by a company employee. It discusses the conduct that constituted the mishap and then offers its ‘e-lesson’ — a suggestion on how to learn from the mistake and avoid it happening to you.

    Robert Ambrogi

    Legal Tech Blogger and creator of LawSites




    Although I may have missed some, yours is the first article that I have seen addressing Zubulake II. It is often the lost opinion amongst the others.

    Laura A. Zubulake

    Plaintiff, Zubulake v. UBS Warburg


    Click here to see more.