There is software designed to eliminate certain kinds of electronic evidence on computers. One example is Evidence Eliminator - click here to read more. Evidence Eliminator is mentioned in the commentary on the Sedona Principles and if a company decides to run this on their computers, there could be sanctions imposed because, when the company was aware that litigation might ensue, they failed to stop the use of the Evidence Eliminator software. See page 197 of the PDF file in our file cabinet where we find this illustration:
Two days after a party is scheduled to turn
over the laptop of a key executive, the executive runs a program called “Evidence Eliminator” on the laptop resulting in the loss of relevant ESI to the prejudice of the requesting party. The requesting party provides the court with forensic evidence establishing the foregoing facts. The court finds an intent to deprive the requesting party of the use of relevant ESI on the laptop. The court may order both remedial measures and sanctions against the responding party and, if appropriate, the
key executive individually.
It is best not to have this kind of software running on a company's computers as it can both slow down the computer and can result in sanctions under certain circumstances.
If your law firm is going to write a motion to compel, the fact that a company may be running such software on their computers needs to be taken into consideration so that the motion includes the halting of this type of software's operation on the company computers.
We will explore the tools and methods of preserving and recovering deleted information.
Way back when audio tapes were still being used we had someone accidentally press record on the tape player and it erased a minute or so of the evidential tape and it was the only copy we had. Fortunately, there was/is a company we found in New York City that had the technology to recover the audio that was erased from that tape.
So even if data is deleted on purpose or accidentally it still may be recovered.
Bad practices, however, in handling ESI can result in Sanctions - so a few things to be careful of:
1. Removing a USB stick from a computer before you have safely chosen to eject it with the proper procedure
2. Placing USB sticks or external hard drives near magnets
3. Dropping a USB external drive
4. Booting up a computer before you have made a forensic copy can change data on the internal drive
Litigation hold (also known as "preservation orders" or "hold orders") is a stipulation requiring a company to preserve all data that may relate to a legal action involving the company. This requirement ensures that the data in question will be available for the discovery process prior to litigation.
https://www.washington.edu/admin/ago/litigationhold.pdf
This pdf does well in its explanation of such holds and it attached to the bottom of this page but also available from their link above.
We will review this PDF document during one of our sessions.
How to avoid loss of your ESI? Is it really lost?
See:
https://percipient.co/is-that-discovery-or-esi-you-want-really-lost/
The below is from the American Bar Association:
Prepare a clear, specific litigation hold notice. The litigation hold notice should include enough detail that the recipients understand what type of information is potentially relevant and where it might be stored, including identifying specific systems or resources that are known at the time. Merely mentioning the case name is typically not sufficient and can result in the over-preservation of ESI by cautious recipients or under-preservation (if at all) by frustrated or distracted recipients. Specifics will also help reduce the volume of data preserved, as well as time and costs in the future. You should also distribute reminder litigation hold notices to your recipients, often after six to twelve months, or if there have been notable changes in the case, such as the filing of an amended complaint or issuance of specific discovery requests that may expand the potential scope of the matter. It is often extremely helpful to not only include a reference to a legal contact that can address questions related to the scope of preservation, but also an IT member that can assist with any technical challenges or questions that the recipient may have.
Initially identify custodians broadly. Individuals who may have relevant information should be identified and notified through a litigation hold that they need to preserve any potentially relevant information. It is far easier to remove someone from a preservation listing once you have a better sense of the facts and issues of a matter than to restore information from backup recordings, servers, or other sources at a later point in time, if such an option is even possible. Further, asking your initial listing of custodians who might also have unique, relevant data related to your case can be a great way of streamlining the identification of supplemental individuals that should receive the litigation hold notice.
Ensure potentially relevant devices are preserved. Many IT departments are, understandably, focused on supporting the business interests of the company and often take the opportunity to redeploy devices as soon as they become available. This can result in the loss of unique, relevant evidence if a machine is wiped and redeployed before steps can be taken to preserve that data. Proper coordination with outside counsel and between the IT, HR, and legal departments to identify whether a particular individual’s devices may be relevant to reasonably anticipated litigation is critical to guaranteeing that no data is lost.
Suspend standard retention policies. As the volume of email and the creation of other data types increases exponentially, many organizations have implemented strict retention policies to securely remediate data that is no longer required for business or regulatory purposes. In tandem with the distribution of the litigation hold notice, IT should identify and suspend any retention policies that may result in the deletion of potentially relevant ESI from the recipients’ accounts. Alternatively, when suspension of certain retention policies for specific individuals may be difficult, a viable alternative is to create a forensically sound snapshot or collection of these sources for preservation.
Consider non-traditional sources. Most parties have existing procedures for preserving and collecting traditional sources of ESI, such as email, workstations, and network directories. However, other sources, such as chats and text messages, cloud-based storage platforms, and collaboration software like Slack and Microsoft Teams can be far more complicated. An early consideration and discussion of what sources custodians may use to create and maintain potentially relevant information can avoid preservation issues in the future. It is often helpful to ask what types of information you would want if you were in opposing counsel’s shoes, particularly due to the fact that it is increasingly common for employees to use unapproved software to communicate and transfer documents that IT may simply not be aware of.
Discourage “sneak peaks” of data. It is not uncommon for IT members or other “tech experts” to want to play detective and find the smoking gun or other incriminating evidence on a device or account, particularly in trade secret misappropriation cases. Unless these individuals have appropriate forensic training, they are far more likely to alter or permanently delete highly relevant metadata and other information that would have been helpful to your case. If you are dealing with a matter that focuses on the transfer, activity, or deletion of information, notify your client immediately that they should focus on identifying and preserving those sources while a reasonable and defensible plan is developed for the investigation and analysis of those sources by appropriately credentialed experts.
Continually revise your preservation plan. The types of sources of potentially relevant ESI are not static and new technologies and methods of creating and transferring data are continually being released. While it is often helpful to review prior preservation response plans, you must ask your clients whether there have been any changes in systems or technologies that would impact your case. Further, if you encountered preservation issues in a past matter, you should spend time identifying the underlying cause and be ready to avoid similar issues in future cases.
Recuvr software:
This software is in our file cabinet where you can download and install it with the permission of your I.T. staff.
It can help you recover files that may have been deleted from a hard drive, usb stick or sd card.