FROM THE BENCH: KUCALA II – COURT REJECTS MAGISTRATE’S RECOMMENDATION OF DISMISSAL FOR PLAINTIFF’S DESTRUCTION OF COMPUTER EVIDENCE
	THE BRILL REPORT: DIGITAL MYOPIA
	TECHNOLOGY YOU SHOULD KNOW: DELETE DOES NOT MEAN DELETE
	KROLL ONTRACK NEWS AND EVENTS

FROM THE BENCH: KUCALA II – COURT REJECTS MAGISTRATE’S RECOMMENDATION OF DISMISSAL FOR PLAINTIFF’S DESTRUCTION OF COMPUTER EVIDENCE

After conducting an evidentiary hearing, the magistrate judge in the patent infringement suit Kucala Enters. Ltd. v. Auto Wax Co. recommended that the Plaintiff’s claims be dismissed and that attorneys' fees and expenses attributable to the motion for sanctions be assessed against the Plaintiff for destroying computer evidence. (See the July 2003 issue of Kroll Ontrack’s CyberCrime and Computer Forensic News, http://www.krollontrack.com/LawLibrary/computerforensicsnewsletter/Archive/.) After stating that the Plaintiff's use of a computer software called "Evidence Eliminator" to delete files the night before a scheduled discovery inspection indicated a blatant disregard for the litigation process, the federal district judge nevertheless rejected the magistrate's recommendation that the Plaintiff's claims be dismissed with prejudice. See Kucala Enters. Ltd. v. Auto Wax Co., 2003 WL 22433095 (N.D.Ill. Oct. 27, 2003).

The federal judge stated, “Kucala, seeing himself as David, took the law into his own hands in the short-sighted belief that sabotaging discovery would fell his Goliath. He was represented by counsel, had been advised of his obligations to make discovery, resisted at every turn, and eventually took the drastic step of running Evidence Eliminator. The result is multiplication of expense, delay, and ravage of the common law method of seeking the truth in his case.”

Despite this, the court refused to dismiss the case, revealing that the interest of justice would be best served by adjudicating the claim and counterclaim at issue. Because the Plaintiff continues to manufacture its product, the claim of infringement could still be established if the Plaintiff is forthcoming about its formula and methods. The court warned that absent full cooperation in discovery, default judgment is inevitable. The court upheld the magistrate's recommendation that the Plaintiff bear the expenses flowing from the discovery misconduct.

THE BRILL REPORT: DIGITAL MYOPIA

*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflect his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor.***

Don’t let a focus on high-technology cause you to miss important low-tech data in an investigation. One of our clients had heeded our advice and formed their own High Tech team to react when there was a need to collect potential evidence from computers and storage devices. They had IT specialists, IT auditors, and representatives from their in-house counsel’s office on the team. In one case, the High-Tech team was called to gather data from several employees’ computers after business hours so the targeted users would not know that their workstations were being investigated. The team used a digital camera to photograph the users’ desk arrangements before and after imaging the drives so that they could verify that nothing had been disturbed in the office.

But they were facing a problem -- counsel seemed to feel that an important chunk of evidence was missing. The High Tech team was stumped and called us to discuss the situation. I asked the team to send me their digital camera pictures. The items on the users’ desks were what you might expect...desk calendars, diary books, notepads. We asked if these were reviewed as part of the work. No, we were told, the team just handles computer data. Unfortunately, in looking at the underlying case, it turned out that when people made appointments, they entered them in paper date books, not a computerized calendaring system. This information ended up being exactly what counsel was missing – a log of people’s meetings, work hours, and daily tasks.

While counsel should always be consulted before searching anyone’s workspace – digital or physical, it is vital to remember that people still keep appointment books, notes, and other evidence in low-tech forms, and those should never be ignored!

TECHNOLOGY YOU SHOULD KNOW: DELETE DOES NOT MEAN DELETE

***As technology continues to play a larger role in litigation and internal company investigations, lawyers and investigators are expected to comprehend the inner workings of computers and how they relate to any computer conduct at issue. ***

Most lawyers by now understand the basic tenet that “delete does not mean delete.” However, learning exactly how computers retain deleted data is a technological lesson that most attorneys have not encountered.

When a computer file is deleted, several behind the scenes processes occur. For a FAT based file system, the first character of the file's name is replaced with a special character that tells the computer system that the file has been deleted. For example, a file named “thesmokinggun.doc” would become “~hesmokinggun.doc,” making it virtually impossible to find the file by searching for it under its title. Also, the file’s mapping of the File Allocation Table (FAT) and its associated sectors of the drive are marked as available to store new data. This available space is now deemed as “unallocated space.” Until new data, which is stored in a random fashion on the drive, is written to each and every sector that has been marked as available, portions of that data are recoverable. Even then, if the new file is smaller in size than the footprint of the deleted file, portions of the deleted file might still be recoverable. This area of space is called “slack space.”

Deleting a computer file can be compared to a library’s “card catalog” system, where when a book’s index card is pulled from the card catalog, the book still remains on the shelf. The book is not removed from the shelf until the space it occupies is physically removed by the librarian and replaced by a new book.

How long is computer data retrievable? Factors influencing the recovery of deleted files include: how the files were deleted, the amount of time passage and computer usage since deletion, the use of file deletion/destruction programs, etc. Typically, data does not change or grow as rapidly on a user’s laptop or desktop as it does on a file server. In addition, with larger hard drive space becoming cheaper to acquire, deleted data tends to remain for longer periods of time after a deletion occurs. Unless steps are taken to hide or remove deleted data more permanently, the possibility exists for computer forensic experts to recover or examine data otherwise thought to be destroyed. In next month’s column, we will discuss some of the common ways to destroy computer data permanently.

Visit our Upcoming Events section at http://www.krollontrack.com/upcomingevents/ to learn about these presentations and more.

Kroll Ontrack Requests Your Input

Our legal consultants, project managers, and technology experts strive to stay on top of e-evidence law. If you are aware of any additional local court rules or new cases in this area of the law, please do not hesitate to contact us by writing to electronicdiscovery@krollontrack.com.

For more information about electronic discovery and computer forensics services, contact Kroll Ontrack at 1-800-347-6105 or www.krollontrack.com.