FROM THE BENCH: COURTS ISSUE TERMINATING SANCTIONS WHERE PLAINTIFFS DESTROY COMPUTER EVIDENCE
	THE BRILL FILES: COMPUTER FORENSIC EXPERTS INVESTIGATE SUSPECT HARD-DRIVE
	TECHNOLOGY YOU SHOULD KNOW: COMPUTER FORENSICS CAREERS AND EDUCATIONAL OPPORTUNITIES PROJECTED TO FLOURISH
	KROLL ONTRACK NEWS & EVENTS

FROM THE BENCH: COURTS ISSUE TERMINATING SANCTIONS WHERE PLAINTIFFS DESTROY COMPUTER EVIDENCE

Suit Dismissed After Computer Forensics Expert Discovers Plaintiff Altered Laptop Documents
Plasse v. Tyco Elec. Corp., WL 2623441 (D. Mass. Sept. 7, 2006). In a wrongful termination suit, the defendant claimed the plaintiff misrepresented his credentials when applying for employment. When the defendant indicated the laptop used to create the resume would be inspected, the plaintiff accessed his resume and cover letter files and modified the documents’ electronic properties. After a computer forensics expert discovered the deleted metadata and the plaintiff’s alterations, the court stated “[The] plaintiff has destroyed or concealed evidence, engaging in an egregious pattern of misconduct that has hampered the proceedings in this case.” It also noted the “Plaintiff's explanation for this behavior is more than unconvincing; it verges on the absurd.” The court granted the defendant’s motion to dismiss and for sanctions.

Deliberate Deletion of Files from Laptop Warrants Dismissal
Leon v. IDX Sys. Corp., 2006 WL 2684512 (9th Cir. Sept. 20, 2006). In a discrimination suit based on an ADA claim, the plaintiff appealed sanctions against him for evidence of spoliation involving the deletion of 2,200 files from his work-issued laptop. The defendant’s computer forensic expert determined the plaintiff intentionally wiped the laptop’s hard drive before turning it over to the defendant for examination. The plaintiff admitted to running a program designed to delete any files from the unallocated space on his hard drive but argued the deletion was only performed to protect his privacy. The court, however, stated the plaintiff had “ample notice” to preserve any relevant evidence and “the files he destroyed were not merely ‘private’ and were potentially relevant to the litigation at hand.” The appellate court determined the district court did not abuse its discretion when determining the plaintiff acted in bad faith in destroying electronic files and the defendant was prejudiced because of such destruction. The court agreed that lesser sanctions would not be useful since any attempts to rectify the harm done by plaintiff would be “futile.”

THE BRILL FILES: COMPUTER FORENSIC EXPERTS INVESTIGATE SUSPECT HARD-DRIVE

*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflects his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor. ***

With advanced computer knowledge, specialized data recovery and analysis skills, ingenuity and highly specialized forensic tools, a computer forensic expert can help set the stage for success in a computer investigation.

Recently, a law enforcement unit retained Kroll Ontrack to forensically recover a hard drive belonging to a terror suspect. Because the drive had suffered electrical damage, their investigators couldn’t recover the information, create an image, or begin a forensic investigation. This is where the Kroll Ontrack team was called into the case. Using proprietary data recovery tools and a cleanroom environment, we recovered most of the data on the drive. However, this particular investigation involved a more complex analysis; we discovered one of the drive partitions contained a non-standard file system. The law enforcement investigator wasn’t able to see the non-standard file system during his initial investigation. At first, we could not access the file system using our forensic and data recovery tools. However, one of our computer forensic experts took this challenge and developed a forensic plan using a variety of tools and techniques that included building the same non-standard file system to better understand how it worked. He successfully copied the non-standard data onto a drive, recovered the deleted information, and made it available to our law enforcement client.

The law enforcement unit told us the recovered data they received from Kroll Ontrack was integral in their investigation of the terror suspect. As demonstrated by this case, damaged media and hidden data may be difficult to recover without specialized skills and equipment. If a computer forensic investigation is needed in your next case, consult a skilled computer forensic investigator early to ensure the most successful digital recovery and analysis possible.

*** If you would like to explore the opportunity of Alan Brill speaking at a conference you are supporting or organizing, please contact Amanda Karls at (952) 516-3637or at akarls@krollontrack.com. ***

TECHNOLOGY YOU SHOULD KNOW: COMPUTER FORENSICS CAREERS AND EDUCATIONAL OPPORTUNITIES PROJECTED TO FLOURISH

In its recent “Hot Jobs for 2007” article, Careerbuilder.com listed the computer forensic field as the fourth fastest growing job market. The U.S. Department of Labor forecasts similar trends over the next eight years, stating computer systems design and other related areas, including computer forensics, will grow as much as 39 percent and account for almost ¼ of all technology-related jobs.

Computer forensics has been recognized as a forensic discipline by the American Society of Crime Laboratory Directors, and is one of the areas covered by the American Academy of Forensic Sciences. In addition, specialist organizations like the High Technology Crime Investigation International bring together computer forensic personnel from the public and private sectors.

This hearty job market for computer forensics experts can only indicate similar growth in computer-related education. Five years ago, only a handful of universities and colleges offered a class related to computer forensics. Today, computer forensic courses and majors are offered at over 100 schools across the county, with many other colleges planning to implement similar programs at the undergraduate and graduate levels.

To become a computer forensic expert, employers generally require a four-year degree in any computer related field such as computer science or engineering. Law enforcement training, government service, or technology investigation skills are also seen as valuable experiences. In addition, many employers require specialized training courses in computer forensics. Knowledge and skills in a broad range of areas including operating systems, programming, software applications, networking, and forensic tool applications are also helpful, in addition to consulting and analysis proficiency.

Computer forensic experts typically are employed by organizations providing investigative consulting services or governmental agencies focusing on high-tech crimes. However, corporations and businesses are beginning to employ in-house computer forensic specialists as well.

KROLL ONTRACK NEWS & EVENTS

Meet Kroll Ontrack Representatives at the Following Events:

Visit http://www.krollontrack.com/upcomingevents/ for more information on these events and others.

KROLL ONTRACK REQUESTS YOUR INPUT

Our legal consultants, project managers, and technology experts strive to stay on top of electronic discovery law. If you are aware of any additional local court rulings or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com.

This newsletter is written by Michele C.S. Lange, staff attorney with Kroll Ontrack. Ms. Lange has published numerous articles and speaks regularly on the topics of electronic discovery, computer forensics, and technology's role in the law. She can be contacted by writing to mlange@krollontrack.com.

For more information about electronic discovery and computer forensics services, contact Kroll Ontrack at 1-800-347-6105 or http://www.krollontrack.com.