Litigants are required to take reasonable efforts to preserve potentially relevant data. As lawyers, understanding when such reasonable efforts require engaging a digital forensic expert can be the difference between securing vital evidence and facing significant challenges in court. In many circumstances, self help is reasonable, although that may involve a litigant’s outside IT vendor. However, under some circumstances, what is reasonable, and indeed preferable, is engaging a digital forensic examiner to assist in search, collection, and possibly analysis. Several considerations play into the decision of whether data preservation for litigation requires the assistance of an expert.
The Importance of Data Preservation
Data preservation is the process of maintaining and safeguarding electronic data, generally in its original form, to ensure its availability and integrity for legal proceedings. The rules of civil procedure in most jurisdictions (such as Fed.R.Civ.P. 37(e)) emphasize the importance of preserving electronically stored information (ESI) when litigation is reasonably anticipated. Failure to preserve relevant data can lead to severe, and even case-altering, sanctions, including the exclusion of evidence, adverse inference instructions, monetary penalties, or even dismissal of claims (or striking defenses).
Recognizing the Need for a Digital Forensic Expert
Complexity of Data Sources. Modern businesses generate and store data across various platforms and devices, including emails, cloud storage, smartphones, and social media. The complexity of these data sources is increasing, and various data types (and the environments in which the data is maintained) require specialized knowledge to ensure sufficient data preservation. A digital forensic expert has the expertise to identify, collect, and preserve data from diverse sources while maintaining its integrity. Documents may contain links to other documents within them. Are those being collected? Do you know? What data may reside on cell phones besides text messages, and if you rely on your client to preserve solely text messages, do you know what is being left behind? Do you know how to preserve, collect, and produce IMs, social media direct messages, Slack conversations, Reddit posts, and more? Does your client’s IT department know how to search for, collect, and provide to counsel the data in a manner that preserves it? Have they documented the collection process so that decisions and actions can be defended 12-18 months later, possibly after a complete turnover of the IT personnel that performed the collection?
Potential for Data Manipulation. In cases where there is a risk of data tampering or spoliation, hiring a digital forensic expert becomes crucial. Forensic examiners can use specialized tools and techniques to detect signs of data manipulation, ensuring the authenticity and reliability of the evidence presented in court. Furthermore, those same tools and techniques can allow attorneys to more effectively establish that their own evidence has not changed. Overcoming authentication and hearsay objections to electronic evidence may be exceedingly difficult after the evidence has been collected and produced without sufficient tools and expertise. For example, suppose evidence was collected from a collaboration platform such as Google Docs or Slack, where any number of employees can access and alter a document. Months after it has been collected is not the time to try to establish that the form of the document that was produced is actually the same form the document was in at the relevant time. Similarly, can you challenge the opposing party’s electronic evidence (or even know if a basis for challenge exists)?
Volume of Data. Large volumes of data can be overwhelming to manage without specialized skills and tools. If your firm does not have its own litigation support team, bringing a forensic expert, experienced in working with large data sets, may be needed on a particular case. Yes, it can be an added expense, but an expense with a return on investment by reducing the amount of evidence being collected, analyzed, and reviewed.
Technical Expertise. Digital forensic experts generally possess knowledge different from general IT personnel. They are trained to handle various file formats, recover deleted data, and navigate encrypted or corrupted files, making them indispensable in complex litigation scenarios. They understand how to maintain data that is going to be scrutinized by opposing counsel. Probably the forensic examiner’s best role in many cases is helping you know what you do not know. https://www.inveniusforensics.com/post/do-you-know-what-you-don-t-know How well can you evaluate what opposing counsel produced from a key witness’s cell phone? How well can you determine what is missing that should be available? Even if opposing counsel provides a “viewer” to use in accessing data from a cell phone extraction, what about data from the apps that the “viewer” cannot parse and interpret? Should you be satisfied with the limited production from the other side, or is there additional data worth demanding for examination? Can you determine, based on what was produced, that the adverse party’s cell phone once had a texting app that has since been deleted, and that is why no data from it was produced?
Here is a common scenario: cell phone text messages. Many attorneys use consumer-oriented software to extract text message data. Depending on that case, that may be okay: maybe the budget does not support paying an expert. Maybe time is critical and even waiting a day or so is not advisable. Maybe law enforcement has seized the phone and that is not an option. But do you know how that software works? Can you establish that it is actually collecting all relevant data? Can you later determine whether text messages were deleted? What about the more recent capability of changing a text message after it is sent? What if the need arises to prove a negative—that an individual did not engage in certain communication? Or suppose later, in a deposition after the case has been pending for a year and you are confident that you have all of the relevant communications because your paralegal collected all of the text messages, a witness remembers a key communication was not by text message, but by some other channel (such as an IM or a direct message on social media)? What do you do at that point?
Standards for Data Preservation in Litigation
To ensure compliance with legal standards for data preservation, it is essential to understand the following guidelines:
Triggering the Duty to Preserve. The duty to preserve evidence arises due to applicable law, contract, or when litigation is reasonably anticipated. This can occur through a variety of triggers, such as receiving a demand letter, filing a lawsuit, or even during preliminary investigations. Recognizing this duty promptly is critical to avoiding spoliation claims.
Issuing a Legal Hold. Once the duty to preserve is triggered, issuing a legal hold notice is a fundamental step, and a decision not to issue the litigation hold in writing may be difficult to justify. This notice: (1) educates relevant custodians as to what may be relevant; (2) instructs them what data to preserve and how to preserve it; and (3) suspends routine data destruction processes. A digital forensic expert can assist in formulating a comprehensive legal hold strategy. The expert can help educate counsel as to where potentially relevant data may reside, to better analyze risks associated with preserving in place versus collecting data, what is “not reasonably accessible” (see Fed.R.Civ.P. 26(b)(2)(B)), and more.
Documenting the Preservation Process. Meticulous documentation of the preservation process is essential for demonstrating compliance with legal standards. Digital forensic experts can help create detailed records of data collection methods, storage locations, and chain of custody, ensuring transparency and defensibility. Decisions regarding data preservation may not be challenged for months or years. What documentation do you have to memorialize why certain data was or was not preserved?
Using Forensically Defensible Methods. Forensically defensible methods of collecting ESI are critical to maintaining the integrity of evidence. Digital forensic experts employ specialized tools and techniques that adhere to industry standards, ensuring that data remains unaltered during the preservation process. Additionally, methods such as hashing help establish the integrity of evidence through the litigation and presentation process.
Case Scenarios Highlighting the Need for Digital Forensic Experts
Employment Disputes. In cases involving allegations of wrongful termination, discrimination, or harassment, electronic communications such as emails, text messages, and social media posts often play a pivotal role. A digital forensic expert can retrieve and preserve these communications, sometimes even if the communications have been deleted or altered, providing crucial evidence for the case. The expert may also help identify other sources of relevant evidence if data deleted from a device cannot be recovered.
Intellectual Property Theft. When a company suspects intellectual property theft, identifying and preserving digital evidence is paramount. Digital forensic experts can track data access, recover deleted files, identify file activity, and analyze metadata to uncover evidence of unauthorized data access or transfers, aiding in the protection of valuable intellectual assets.
Financial Fraud. Financial fraud cases often involve complex digital trails, including transactions, emails, and internal communications. Digital forensic experts can help trace these digital footprints, reconstruct timelines, and identify patterns of fraudulent activity, providing critical evidence for prosecution or defense.
Criminal Defense. What story can a device tell? What evidence might be on the defendant’s device that was missed by investigators? Is the government’s digital forensic examiner interpreting data, such as correlating location data with timestamps, correctly or is there support for the notion that certain location data and timestamps are inaccurate?
Benefits of Hiring a Digital Forensic Expert
Enhanced Credibility. The involvement of a digital forensic expert can lend credibility to the evidence presented in court. The examiner’s specialized skills and adherence to industry standards help ensure that the data is reliable and admissible. Do you want someone other than solely the client to prove up this evidence?
Mitigation of Legal Risks. By ensuring proper data preservation and documentation, digital forensic experts help mitigate the risk of spoliation claims and associated sanctions. Their expertise can prevent inadvertent data loss or mishandling, protecting your case from potential pitfalls. Your expert can help formulate strategies regarding preservation, collection, analysis, and presentation of evidence. Can you argue that your preservation efforts were reasonable if you do not understand the data environment, structure, or the costs involved?
Efficiency and Cost-Effectiveness. While hiring a digital forensic expert involves an initial investment, their ability to efficiently manage and analyze large volumes of data can ultimately save time and resources through the litigation process. Their specialized tools and methodologies streamline the data preservation process, reducing the burden on legal teams. Very rarely can a matter be handled more cost-effectively after the wheels have come off rather than having an expert on board from the outset.
Bridging Gaps Between Stakeholders. Miscommunications between decision makers, counsel, witnesses, and IT personnel are common. While everyone is speaking English, we may not all be speaking the same language. Furthermore, concerns and issues recognized by one stakeholder, such as counsel, may not even occur to the IT vendor or the witness who is a custodian of ESI. Digital forensic experts will have experience that helps bridge these gaps, translate during discussions, and help maintain the big picture.
Conclusion
The preservation of electronic data is a critical component of building your client’s case. Recognizing when to hire a digital forensic expert is essential for cost-effectively ensuring compliance with legal standards, safeguarding the integrity of evidence, saving your client money, and enhancing the credibility of your case. While not every engagement or task undertaken by a digital forensic expert will translate to dollars saved, they can help mitigate risk and provide insurance. Their involvement can provide invaluable support, mitigate legal risks, and contribute to the successful resolution of litigation matters.
Comments