FROM THE BENCH: COMPUTER FORENSIC EXPERT UNCOVERS EVIDENCE OF INTENTIONAL ELECTRONIC DATA DELETION
	THE BRILL FILES: COURT FINDS ALLEGED MOVIE PIRATE WILLFULLY WIPES HARD DRIVE
	TECHNOLOGY YOU SHOULD KNOW: IDENTIFYING DATA STORED ON HIGH-TECH GADGETS
	KROLL ONTRACK NEWS & EVENTS

FROM THE BENCH: COMPUTER FORENSIC EXPERT UNCOVERS EVIDENCE OF INTENTIONAL ELECTRONIC DATA DELETION

Sony Computer Entertainment Am., Inc. v. Filipiak, 2005 WL 3556676 (N.D.Cal. Dec. 27, 2005). The plaintiff sought injunctive relief and damages claiming the defendant sold products that allowed users to play illegal copies of the plaintiff’s PlayStation video games. After receiving a cease-and-desist letter from the plaintiff’s attorneys, the defendant signed the letter and agreed to an injunction prohibiting the marketing, sale and distribution of the products. Although the defendant removed the products from his Web site, he continued to sell them. After confronting the defendant about his violation of the previous agreement, the parties executed a Consent Judgment against the defendant for an undetermined amount which was to be based on further discovery.

As a part of the discovery provisions, the defendant agreed he would not destroy any documents or computer files reflecting sales of his products. During discovery, the defendant’s hard drive was examined by a computer forensic expert, who determined thousands of files had been deleted from the hard drive just days before production of the hard drive. The deleted files included numerous documents with titles indicating they were sales records. Finding a “significant” statutory damage award was warranted under the circumstances, the court awarded more than $6 million in damages. The court stated, “[the defendant] intentionally and in bad faith violated the terms of the Consent Judgment as well as his discovery obligations under Rule 26 of the Federal Rules of Civil Procedure.”

THE BRILL FILES: COURT FINDS ALLEGED MOVIE PIRATE WILLFULLY WIPES HARD DRIVE

*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflects his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor. ***

Spoliation, the destruction or modification of data that must be preserved, is certainly nothing new in the litigation arena. Over the years, my fellow computer forensic experts and I have worked on hundreds of cases in which individuals have deliberately destroyed data to make it unavailable to the other side.

A case we recently worked on involved a data spoliation issue. See Paramount Pictures Corp. v. Davis, 2005 WL 3303861 (E.D. Pa. Dec 2, 2005). In this case, our client uncovered evidence indicating the defendant illegally obtained a copy of a major motion picture and distributed it one week after the movie's release date. After discovering this information, our client was granted access to the defendant’s computer and hired a Kroll Ontrack computer forensic expert to conduct an investigation.

Our expert’s investigation revealed that after wiping all the data off his hard drive, the defendant reinstalled the operating system just 16 days after receiving notice of the lawsuit. As a result of the wiping, it was impossible to determine whether the movie or related software was on the computer before the investigation. Based on this evidence, our client alleged the defendant’s conduct was deliberately aimed at preventing discovery of the defendant’s illegal activities. Our client sought sanctions against the defendant for spoliating relevant data and asked the court to grant summary judgment in its favor.

In defending his actions, the defendant claimed he wiped the drive in preparation for selling it to another individual. This claim held little weight with the court, which declared, “This argument does not obviate his duty to preserve the computer's memory...His failure to preserve this evidence places the fault for its destruction squarely upon [the defendant].” The court also said the defendant “knew or should have known that the computer's memory was relevant to the lawsuit against him because he received notice of the action against him…sixteen days before he wiped the hard drive clean.”

Although the court determined an adverse inference instruction would be appropriate, it did not issue the instruction because the case was not being tried to a jury. The court found summary judgment would be too harsh and noted it would instead take the defendant’s “willful destruction of evidence into consideration at the time of trial.”

*** If you would like to explore the opportunity of Alan Brill speaking at a conference you are supporting or organizing, please contact Amanda Karls at (952) 516-3637or at akarls@krollontrack.com. ***

TECHNOLOGY YOU SHOULD KNOW: IDENTIFYING DATA STORED ON HIGH-TECH GADGETS

*** As technology continues to play a larger role in litigation and internal company investigations, lawyers and investigators are expected to understand the inner workings of computers and how they relate to computer conduct issues. ***

"Never write when you can talk. Never talk when you can nod. And never put anything in an email." http://money.cnn.com/2005/11/28/news/newsmakers/goldenrule_biz20_1205/index.htm. The advice of New York Attorney General Eliot Spitzer has certainly hit home for individuals who have spontaneously sent e-mails that later proved damaging during a lawsuit or regulatory investigation. New technology features and innovations are being added to digital devices daily, making valuable evidence – such as impulsively written e-mails – available in a greater variety of locations. Computer forensic investigators can typically locate transactions made between a computer hard drive and these devices. In many cases, an investigator can extract and keyword search files, e-mails, address books, memos, and other information stored on such gadgets. A few of the newer high-tech toys that may contain important evidence include:

Digital Watches. Some digital watches can function as pagers and store digital messages. In addition, they may contain calendars, notes, address books, and e-mail. Some models also have the ability to synchronize information with computers.

USB Drives. Universal Serial Bus Drives are thumb-sized devices that allow the transfer of data to and from digital devices, much like its floppy-disk predecessor. USB ports on modern computers make it possible for an electronic data transfer to occur quickly and discretely. As USB drives have become commonplace, new features are being added making them useful sources of evidence. A recently released drive, for instance, boasts a scrollable window display enabling users to view stored file names, file sizes and create dates without a computer connection. Some drives even allow users to play music in the car by attaching the drive to a cigarette lighter.

Digital Cameras. Digital cameras can double as portable storage devices and can store images for later transfer to a computer. Devices of all sizes are being fitted with digital camera capabilities, allowing individuals to take pictures of highly sensitive areas or documents. Further, a camera’s USB port allows it to double as a portable storage device and Webcam. When connected to a computer, digital cameras appear to the computer as another local hard drive, meaning the computer user can store nearly any type of data on the camera’s storage media.

Music, Video and Photo Players. Music devices (such as MP3 players) and video game consoles can transfer, store and hide virtually any data type. Consider that a player equipped with a 30 GB hard drive can store tens of thousands of photos, 15,000 songs or 120 hours of video depending on file sizes and formats. These drives – such as one model scheduled for release by 2007 and claiming to provide 120 GB of storage – will continue to increase in capacity storage.

Personal Digital Assistants. Personal digital assistants (PDAs) and other handheld gadgets can contain addresses, appointment calendars, e-mail, text, pictures, videos, and voice messages. Some PDA’s even offer instant messaging capabilities. While some PDA models contain unbreakable password protection devices, password breaking techniques can override these devices on many models.

Cell Phones. Cell phones can hold a wealth of data, including text messages, pictures, Web pages, contact information and calendar items. Several cell phone companies are offering phones containing miniature hard drives capable of storing several gigabytes of data. With this capacity, these phones could hold up to several hundred thousand pages of e-mail and file data. The latest phones on the market are also equipped with cameras, video capabilities, Wi-Fi, and Bluetooth technologies. Wi-Fi, short for wireless fidelity, allows the phone to connect to the Internet through a wireless connection. With BlueTooth technology, the phone can communicate directly with a computer, PDA or other mobile phone to sync and download information between each gadget.

New high-tech devices are making their way to the market daily, giving attorneys and technologists a ripe minefield for electronic evidence. When a high-tech device may contain a key piece of evidence in your next case, a computer forensic expert can help assess the limits of these digital devices, determine what evidence is retrievable, and analyze pertinent data.

KROLL ONTRACK NEWS & EVENTS

Kroll Ontrack, Ibas and Vogon Join Forces
In a deal that further strengthens our worldwide leadership position in both the computer forensics and data recovery marketplace, we are pleased to announce the acquisition of Ibas Holdings ASA, a leading Norwegian-based provider of computer forensics, data recovery and data erasure services. In 2005, Ibas acquired Vogon International, a privately held U.K. company, specialists in computer forensics and providers of data recovery. By combining the strengths of these organizations, we are able to bring leading edge computer forensics and data recovery services to customers in 13 different languages through our presence in more than 21 countries. What more does this mean for you? The integration of our industry-leading companies will enable us to leverage and exchange resources, expertise and technical capabilities and reinforce best practices resulting in more opportunities for our customers, partners and for the computer forensics and data recovery industry at large.

Read the press release to learn more about the benefits offered through this exciting development.

Meet Kroll Ontrack Representatives at the Following Events:

Visit http://www.krollontrack.com/upcomingevents/ for more information on these events and others.

KROLL ONTRACK REQUESTS YOUR INPUT

Our legal consultants, project managers, and technology experts strive to stay on top of electronic discovery law. If you are aware of any additional local court rulings or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com.

This newsletter is written by Michele C.S. Lange, staff attorney with Kroll Ontrack, with assistance from Charity J. Delich, a Kroll Ontrack law clerk. Ms. Lange has published numerous articles and speaks regularly on the topics of electronic discovery, computer forensics, and technology's role in the law. She can be contacted by writing to mlange@krollontrack.com.

For more information about electronic discovery and computer forensics services, contact Kroll Ontrack at 1-800-347-6105 or http://www.krollontrack.com/.