Electronic Evidence and Discovery:
What Every Lawyer Should Know
By Michele C.S. Lange and Kristin M. Nimsger
American Bar Association 1-800-285-2221
$89.95, softcover, (Science & Technology Section members $79.95), 224 pages; ISBN 1-59031-334-8 (2004).
Electronic evidence is a hot topic in legal circles today – and with good reason. If you haven’t yet been served with discovery requests seeking electronic documents or email, you soon will be. What are your obligations in responding to discovery seeking electronic evidence? Do you possess the technological sophistication necessary to properly advise your clients what to do regarding preserving electronic evidence once it becomes apparent that litigation is a possibility? When is it appropriate for you to request a computer forensic investigation? What is the current case law on which party is responsible for the costs of producing electronic evidence and what are appropriate sanctions for not producing electronic evidence or failing to prevent it from being spoiled?
These questions and many more are answered in this comprehensive analysis of electronic evidence. The book begins by examining the need for every lawyer to become familiar with this area of the law.
In addition to the "old-fashioned" method of discovery, electronic evidence is affecting virtually every investigation, whether criminal or civil. Today, there is not usually a "paper-trail" to establish who did what and when. Instead, electronic footprints and fingerprints often provide the clues to solving a multitude of question of conduct or action. Today’s investigators must understand computer forensic best practices as they mine metadata and electronic files for digital clues and evidence to support a case.
Today, many businesses are creating and storing documents in electronic format only. Due to the inexpensive cost of digital storage, those documents are often copied to a variety of locations and preserved for extended periods of time. In many cases, the computer is often a good starting point of investigation.
Almost every interaction with a computer or other piece of electronic media creates an electronic trial of evidence. Computer media is often the best place to begin looking for potential evidence, whether on one hard drive, a network of servers and desktops, or a pile of backup tapes. In order to discharge their duties to clients, lawyers practicing in the 21st century must now be prepared to handle this modern form of evidence, along with all the new and unique technical and legal issues that come along with it.
The authors succinctly describe how electronic documents and email are not easily deleted. Because electronic documents leave an electronic fingerprint on a computer’s hard drive, when data is deleted the space occupied by that file is merely marked as available for use. Unless new data is written
onto the part of the hard drive where that file was located, even "deleted" data is recoverable by experts. A common phrase used by those frequently dealing with electronic evidence is that "delete does not mean delete."
Case law is clear that deleted data can be discoverable. In addition, courts have ruled that electronic evidence is discoverable regardless of its location, including, desktop computers, laptops, servers, floppy disks, CD-ROMS, DVDs, Jaz and Zip disks, PCMCIA memory cards, USB drives, and backup tapes. Virtually any device that can store electronic evidence is potentially discoverable, including cell phones, PDA (personal digital assistants), Blackberries or MP3 players (such as iPods).
One of the more interesting issues presented dealt with the preservation of electronic evidence once a lawsuit or investigation has begun. One area that many lawyers may not have considered is the inadvertent destruction of electronic evidence by simply maintaining the status quo.
Many businesses (including law firms) employ a tape backup procedure to create a copy of all data produced by a company. These tapes are retained for purposes of disaster recovery and are often recycled or reused as a cost savings method. In other words, daily backup tapes are sometimes reused the following week or month, and data on the older tape is overwritten with updated information. When litigation is likely, it may be necessary to advise clients to suspend or at least modify their automated tape recycling protocols. For a large organization, this may require immediate discussions with the client’s I.T. manager or staff. The authors suggest that it may require even more drastic steps.
Until appropriate copies or backups are created, a party under a duty to preserve should work with their I.T. team to ensure that (1) all document destruction policies are halted, including recycling of backup tapes; (2) any automated destruction protocols or system maintenance such as defragmentation are stopped; (3) new software that might overwrite relevant data is not installed; (4) virus protection software and techniques are up to date and properly working to protect from data loss; and (5) website content and links are preserved.
The authors warn that the best way to avoid unintentional spoilation due to everyday computer use is to make a mirror image of the hard drives in question. It’s best to use computer forensic experts for this process since most commercially available software fails to copy deleted files or remnants of older files. Unless a lawyer is familiar with this area of practice, it’s easy to see how lack of technical knowledge can quickly get the client – and the lawyer – into serious trouble.
The authors ably describe the importance of electronic discovery and they fully explore all the legal and technology issues in this fast-changing area of the law. The book has an excellent Appendix that cites and summarizes all the important electronic discovery and computer forensics case law (conveniently organized by topic). The Appendix also presents local and state statutes dealing with electronic evidence, along with sample electronic evidence preservation letters to clients and opponents. In addition, sample interrogatories and requests for production of documents are given, together with secondary research resources.
Computers have become an integral part of everyday life. Electronic data is all around us. Lawyers must recognize that discovery of electronic evidence in many cases will be essential. This book provides a wealth of information that will help attorneys navigate the potential land mines found in this emerging legal practice area. This book is aptly titled – every lawyer should know at least the basics about electronic evidence and discovery.
