FROM THE BENCH: COURTS ADDRESS ACCESSIBILITY AND EVIDENTIARY ISSUES IN COMPUTER FORENSIC CASES
	THE BRILL FILES: ‘TIS THE SEASON TO RECYCLE?
	TECHNOLOGY YOU SHOULD KNOW: KEYWORD SEARCHING – BUILDING A LIST FOR FINDING VIRTUAL CLUES
	KROLL ONTRACK NEWS & EVENTS

FROM THE BENCH: COURTS ADDRESS ACCESSIBILITY AND EVIDENTIARY ISSUES IN COMPUTER FORENSIC CASES

Defendants Must Allow Computer Expert Access to Servers and Computers
Tilberg v. Next Mgmt. Co., 2005 WL 2759860 (S.D.N.Y. Oct. 24, 2005). During discovery, the court ordered the defendants to give the plaintiff’s computer forensic expert access to two email servers and ordered the parties to split costs. However, when the forensic expert began his examination, he was unable to access the defendants’ second server. The defendants claimed this was the result of a system crash. After the discovery deadline passed, the plaintiff again sought access to the second server as well as permission to search the defendants’ central non-email server and two specific employees’ desktop computers. The defendants submitted an affidavit from its information technology personnel indicating the computer system did not contain relevant documents. However, the plaintiff’s expert “found 187 occurrences of the word ‘Tilberg’ in ‘active space,’ which could have been found with standard search tools, and 97 occurrences of ‘Tilberg’ in deleted files.” The plaintiff declared the defendants should have produced these files without the need for a forensic search. Additionally, the plaintiff presented documents obtained from third parties that further proved relevant documents existed despite the defendant’s contrary claims. Finding the defendants “either inadvertently or deliberately delayed and obstructed discovery in this case,” the court ordered the defendants to provide the expert with access to the second email server, the central server, and the two desktop computers.

Preliminary Injunction Upheld Based on Evidence from Computer Forensic Investigation
All Covered, Inc. v. Moore, 2005 WL 2764256 (Cal. Ct. App. Oct. 25, 2005). In an action alleging trade secret misappropriation, unfair competition and breach of contract, the plaintiff obtained a preliminary injunction that prevented the defendants from engaging in business with the plaintiff’s customers. The defendants appealed the injunction arguing the evidence was insufficient. The plaintiff claimed it lost a significant amount of customers after one of the defendants resigned from the plaintiff’s company. In support of its claim, the plaintiff presented evidence from a computer forensic investigation showing the defendants' work computer hard drives had been wiped clean before they left the company. The computer forensic expert also recovered an email from one of the defendants to an unknown correspondent. The email stated that another defendant was forming a new company and some of plaintiff's employees were going with him. Additionally, the plaintiff’s information technology employee discovered the defendants' work computers were not set up to automatically backup data pursuant to company policy and the defendants had destroyed copies of critical customer information. The appellate court upheld the preliminary injunction stating, “[T]he trial court had a reasonable basis to conclude that the defendants' acts in concealing this activity and in altering their company computers before returning them, to delete evidence of these activities, amounted to evidence of actual misappropriation and use of confidential information.”

THE BRILL FILES: ‘TIS THE SEASON TO RECYCLE?

*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflects his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor. ***

With the holiday season approaching and a new year dawning, companies may be planning to implement new computer systems and to upgrade their electronic equipment. If so, what should they do with the old equipment? The perfect solution may be to refurbish or recycle them for use by teachers, schools, nonprofits, community programs and other individuals in need. Some non-profit organizations specifically formed for recycling and redistributing this equipment will pick up unwanted computer items at little or no cost. Donating these digital devices may even warrant a charitable tax deduction.

While donating (or selling) old laptops, computers, cell phones, personal digital assistants, and other equipment may seem to result in a win-win situation for all, if the proper precautions are not taken, it can raise security red flags. Companies must ensure confidential and proprietary data stored on these systems is completely removed before they are donated. After all, “delete does not mean delete” in the electronic world, and companies cannot risk cyber-attacks on their private information – or even worse their clients data – due to improper sterilization of a hard drive.

If your company is planning to donate old equipment, even if only to its own employees, consider swapping out the hard drive before recycling the hardware. Removing a hard drive from a computer before donating it is the most effective way to ensure your data will not fall into the wrong hands. An obvious drawback is that many entities accepting these donations may not have the budget or resources to install new drives in the old machines.

Alternatively, companies may choose to wipe the hard drive using commercially available data wiping software programs. This software can be used to intentionally overwrite data using a specific or randomly generated pattern of characters. If run properly, a wiping utility will make the data unrecoverable. Be aware that in some instances, even when the product is run according to the product’s instructions, traces of data may be left behind. In many cases, it may be prudent to have an expert handle the wiping process. Even though many wiping utilities are highly successful, most are not completely fool-proof and the use of such products may require some expertise to ensure all the data is properly destroyed.

Finding new ways to use old tech products through recycling can benefit a company as well as individuals and entities receiving and reusing these products. By keeping security in mind before donating this equipment, companies will turn an old piece of equipment into the perfect solution for someone in need.

*** If you would like to explore the opportunity of Alan Brill speaking at a conference you are supporting or organizing, please contact Amanda Karls at (952) 516-3637or at akarls@krollontrack.com. ***

TECHNOLOGY YOU SHOULD KNOW: KEYWORD SEARCHING – BUILDING A LIST FOR FINDING VIRTUAL CLUES

*** As technology continues to play a larger role in litigation and internal company investigations, lawyers and investigators are expected to understand the inner workings of computers and how they relate to computer conduct issues. ***

News sources recently have reported a story involving digital footprints left behind by Mac computer specialist Robert Petrick, charged with murdering his wife. Relying in part on evidence of suspicious Google searches made shortly before Petrick’s wife died, a jury convicted Petrick of first-degree murder. Click on the following link to read the related story: http://www.networkingpipeline.com/174403050.

At trial, a computer forensic expert testified about a virtual trail of electronic clues discovered on nearly a dozen hard drives found in Petrick's home. The expert’s examination allegedly revealed that, in addition to conducting the Google searches, Petrick researched other details crucial to the murder plot shortly before he reported his wife missing.

As illustrated by the Petrick case, keyword searching for terms relating to a case can be an important source for experts charged with uncovering digital clues in a forensic investigation. Experts will frequently comb for telltale evidence on a hard drive by conducting keyword searches of active files, deleted files, unallocated space, cookies, logs, Temporary Internet Files, and more. Crafting a keyword search term list that will help pinpoint relevant information is crucial to successful keyword search results. When formulating a keyword search list, consider the following tips:

• Select keywords with care. The number of keywords in a given list will vary depending upon the type of forensic investigation and the facts of the case. Some cases may require as few as five words while other cases may require a hundred words or more. When choosing which words to incorporate, concentrate on the terms that are at the heart of the case. Focusing on the most relevant terms will avoid being over inclusive of irrelevant data while offering the greatest likelihood of finding potentially responsive information.
• Reduce search time using “whole words.” Searching for “whole words,” which match exact instances of a word, will significantly cut down on search time. For example, the term Sally (instead of Sal) will avoid finding irrelevant words like salmon, salamander or salt.
• Consider multiple word phrases. When looking for a particular document, isolating specific phrases likely to be found in the document can help achieve good results.
• Avoid noise words, initials, numbers and acronyms. Noise words, such as “it, a, an, and, the,” initials, numbers, and acronyms can result in an unreasonably high number of matches being returned. Use caution when including these words in a keyword list.
• Engage expert assistance. In addition to sorting through gigabytes of information during a keyword search, a computer forensic expert can assist users in selecting a set of keywords most likely to yield relevant results.

Keep in mind that a keyword search can be both under and over-inclusive. Ultimately, crafting the best keyword search may require trial and error, and the list may need to be refined as the expert begins to uncover virtual clues.

KROLL ONTRACK NEWS & EVENTS

Meet Kroll Ontrack Representatives at the Following Events:

Visit http://www.krollontrack.com/upcomingevents/ for more information on these events and others.

KROLL ONTRACK REQUESTS YOUR INPUT

Our legal consultants, project managers, and technology experts strive to stay on top of electronic discovery law. If you are aware of any additional local court rulings or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com.

This newsletter is written by Michele C.S. Lange, staff attorney with Kroll Ontrack, with assistance from Charity J. Delich, a Kroll Ontrack law clerk. Ms. Lange has published numerous articles and speaks regularly on the topics of electronic discovery, computer forensics, and technology's role in the law. She can be contacted by writing to mlange@krollontrack.com.

For more information about electronic discovery and computer forensics services, contact Kroll Ontrack at 1-800-347-6105 or http://www.krollontrack.com/.