Why Deleted Data Might be Okay
The first spoliation case of its kind is almost a decade old…. But there are still lessons to be learned from it. The case is known as the "Arista Records, Inc. v. Sakfield Holding Co" case. While this case may not mean much to some, it is a well-known case in the digital forensics world because it brings up an interesting point: What happens when the data you are looking for is gone?
In this case, the plaintiff sued the defendant for conspiracy to engage in unlawful acts. Specifically, the defendant operated a website that allowed users to download music free, which was owned by the plaintiffs’ clients. During the case the plaintiff sent their expert to examine the servers in question, what they found was interesting to say the least.
The plaintiffs’ expert discovered that the majority of information that was stored on the defendants’ servers had been intentionally destroyed, and all after the case had been filed. It was determined that an unknown person had logged on at least 50 times to accomplish this task. What did the defendant say to this? They asserted that they had in fact committed the act of wiping the server, and did so to “preclude further transmissions of copyrighted music.” Eventually it was acknowledged by the defendant that they could have simply shut down the website, rather than destroying evidence which was known to the defendant as being important to the case. Even with all of this, the forensic expert was still able to recover some information and was able to make the determination that they sought.
The point is this: there is no excuse for destroying evidence, even if you think your intentions are good. The law regarding this is very clear on this matter “While a litigant is under no duty to keep or retain every document in its possession once a complaint is filed, it is under a duty to preserve what it knows, or reasonably should know, is relevant in the action, is reasonably calculated to lead to the discovery of admissible evidence, is reasonably likely to be requested during discovery, and/or is the subject of a pending discovery request.”
The court found in favor of the plaintiff and a motion to appeal was denied, showing us that the courts do not take kindly to this type of behavior.
Evidence of use of a wiping software can be readily apparent to a trained digital forensic examiner, and while it may not be the answer that you are looking for, it may help you and your client to get the result they deserve.
(Sakfield Holding Company, S.L. is a Spanish Company, organized under Spanish law, and located in Madrid, Spain)
(Arista Records, Inc. was a United States Company owned by RCA, headquartered in New York, NY)
For over 30 years, Scott Greene has been helping companies meet the challenges of the swiftly evolving computer technology industry.
Directly from high school, Scott went to work for IBM. Scott studied Systems Engineering at the University of Arizona. He has since earned certifications in many products and programming languages.
The Evidence Solutions team analyzes data from Computers, Cell Phones, Black Boxes, Dispatch Systems, Medical Records, Email systems and more. Scott then explains the digital evidence in plain English.
Scott’s extensive knowledge draws clients to him from all over the United States as well as Internationally for consulting, Forensics and expert witness services. His extensive and diverse experience allows him to be an expert in many facets of digital and electronic evidence. Scott, a sought after speaker and educator, travels throughout the country sharing his knowledge and presenting to local, regional, national and International organizations.
Copyright Evidence Solutions, Inc.
Disclaimer: While every effort has been made to ensure the accuracy of this publication, it is not intended to provide legal advice as individual situations will differ and should be discussed with an expert and/or lawyer.For specific technical or legal advice on the information provided and related topics, please contact the author.