Computer Forensics

Computer forensics, the search for “missing” electronic information, locates and restores data from a corrupted, deleted or hidden source. Experts in the field often can go beyond the procedures used by many information technology specialists to find files declared dead. Computer forensics is used most often by corporate defendants during the discovery phase of civil cases.

Danger of Spoliation

Since its arrival as a cause of action in the 1980s, spoliation has become an increasingly threatening tort against businesses that have vast amounts of data. Juries may award damages when a defendant destroys evidence related to a civil claim. Plaintiffs may request electronically stored information that is only remotely relevant to a case, and the defense must produce these files. At times, computer forensics is the only way to do so.

Corporations that act ethically to avoid deletion of documents, using the best technological practices in order to put a sweeping litigation hold on data, still may find that certain electronically stored information has been lost. Additional files could be lost during testing while investigating for the company’s defense.

Owing to precedents such as Zubulake v. UBS Warburg LLC and Qualcomm Inc. v. Broadcom Corp., defendants may be subject to not only damages for spoliation but also an unfavorable instruction to the jury in a case in which spoliation becomes an issue. On the court’s discretion, jurors may be instructed to presume the missing evidence would have been harmful to the spoliator’s case. This rebuttable presumption instruction leads the jury to believe the party intentionally or negligently destroyed evidence against it, according to the maxim omnia praesumuntur contra spoliatorem, or “all things are presumed against the spoliator.” A second, possible presumption shifts the burden of proof back to the spoliator instead.

Defense attorneys also are accountable for their clients’ ability to produce documents. According to comments by the presiding judge in Zubulake v. UBS Warburg, counsel should take an active role in convincing their employers to enact policies to implement a litigation hold to preserve all relevant electronically stored information. The threat of severe sanctions looms for those lawyers who find their clients unable to respond to discovery requests. Computer forensics techniques can recover virtually any files ever written on a particular drive, though the cost increases greatly when those files have been deleted and written over.

Computer forensics will yield clues in other types of cases, as well. Criminal prosecutors use it at times to reveal evidence in homicide, financial fraud, drug and embezzlement, record-keeping and child pornography cases.

Source Information

Coomer, Jason. “Spoliation of Evidence: A Survey of Texas Law.” TexasLawyers.com.

Robbins, Judd. “An Explanation of Computer Forensics.” ComputerForensics.net.

Toth, John M. “Spoliation of Electronic Evidence: Concerns over Counsel’s Responsibilities.” In the Spotlight, Counsel to Counsel, April 2007.