Is Wiping Software Ever Innocent in Electronic Discovery?

7 May 2014

Plaintiffs alleged certain business torts in First Senior Financial Group LLC v. Watchdog, Civil Action No. 12-cv-1247 (E.D.Penn. April 3, 2014) against an IT professional as Defendant. (It must be noted that this Order came about via a Motion to Vacate a Default Judgment by Defendant.) During the time period the allegations arose, Defendant lived with her mother and frequently used her mother’s computer (“target computer”) to access email accounts Plaitniffs alleged were relevant to the case.

The “target computer” was ordered by the court to be produced for a forensic examination on June 13, 2013. Defendant resisted the forensic examination of the computer in written and oral form to counsel and the court. It was only when her mother’s son-in-law finally produced the computer to plaintiff trial attorneys that the forensic examination was completed on August 21, 2013.

The plaintiff computer forensic expert testified that after making a mirror image of the hard drive and performing a forensic examination, it was clear that on July 7, 2013, someone had reinstalled Windows 7. The expert concluded that two different types of wiping software were used on the computer prior to July 7, 2013. He also testified that while the first type of wiping software, CCleaner, is sometimes pre-installed on computers, but the second type, Tracks Eraser Pro, must be installed after the computer is purchased. He testified that finding both types of wiping software on a computer was “fairly rare.”

Moreover, the expert searched the computer for 51 search terms, and got many hits on system-related files and fragments from the unallocated space. Unallocated space is where fragments or files are relocated when they are deleted off a computer.

The court considered Plaintiff’s Motion for Spoliation and Sanctions. It found:

1. Defendant had control over the target computer, even though it was not always in her physical possession.

2. At least some of the documents or files deleted were “unequivocally relevant” to the suit.

3. Actual suppression of evidence had took place, and Defendant acted intentionally and in bad faith. This conduct rose above mere negligence or inadvertence.

As sanction, the court ordered only attorney fees and the costs of the forensic examination by Defendant. This was because the prejudice was minimal in the case at hand, which was only a Motion to Vacate a Default; an adverse inference instruction would have no bearing on vacatur of default.

ILS – Plaintiff eDiscovery Experts