Computer Forensics In The Age Of Electronically Stored Data
By Joel H. Mirman

Where's that Selectric® typewriter when we need it?
It doesn’t seem so long ago that people communicated by writing letters or memos created on Selectric® typewriters.  When they tore up the originals, the carbons and the carbon paper, there was no trail to follow.

How things have changed since I began to practice law some 35 years ago.  Today there are 10 billion e-mails generated daily.  It takes only eleven days of e-mail to equal the 107 billion pieces of first class mail delivered in the United States in 1998.

In an organization of 100 employees, each generating an average of 10-15 e-mail messages per day, there will be 240,000 to 360,000 e-mail messages per year, even before factoring in backups and copies.

Over 99% of all new information created today is stored electronically.  Less than one third of electronically created data is ever produced in hard copy.  And the information is decentralized.  In other words, it could have been created at the office on a desktop computer, on a laptop, on a home computer, on a Palm Pilot®, Blackberry® or a similar device.  It could have been printed, saved on a hard drive or a floppy disk, a Zip® disk or a Jaz® cartridge, on a tape backup, or on a CD.  It could have been e-mailed to countless recipients.

And written words are not the only form of communication that is stored electronically.   In many cases, voice-mails are converted to electronic WAVE files and are preserved.  Telephone systems, including land-based, cellular and digital systems, as well as pagers, Palm Pilots® and Blackberrys® maintain call records that can be retrieved by a qualified forensic expert.

The impact of electronic data storage on the operation of businesses is enormous.  Most companies generate their information electronically, but spend little or no time making sure that the information is secure.  At most, the typical small company makes some form of backup to enable data restoration.  Few have document retrieval programs that allow for the orderly retrieval of discreet pieces of information.

Protection of electronically created information may become important in all sorts of settings.  It may involve protection of patient medical records or proprietary company information, or it may be critical in the defense of (or decision to settle) charges of sexual harassment, age discrimination, wrongful discharge and the like.

Because less than one third of all electronic data created is reduced to paper, just looking through a patient file, a personnel file, a correspondence file, etc. should give no comfort that one is seeing everything that has been said or written.

E-mails are a treasure trove of information.  One of the problems with e-mail is its ease of use.  It is impersonal—there is no one staring the author in the face when it is created.  People say things in e-mails that they would “never” say in person.  And unlike the careless statement made in person, the e-mail message is preserved for posterity—often in multiple copies and in multiple locations—locations that may not be known to the author or the owner of the system where they were generated.

E-mail can be incredibly incriminating.  Take for example the recent investigation of Merrill Lynch by the New York Attorney General.  Attorney General Spitzer released e-mails and other documents showing that Merrill Lynch analysts had privately derided stocks to which they had given top investment ratings.  These electronic pieces of evidence also showed that Merrill Lynch had compensated its Internet analysts in part based upon how much investment banking business they helped to win. 

Or consider someone who should have known better—Bill Gates—apparently authoring an e-mail in which he said, “do we have a clear plan on what we want Apple to do to undermine Sun?”

The forensic computer expert often deals with the following scenario: someone sends an inappropriate e-mail.  A supervisor learns of it and suggests that it be deleted immediately.  The sender deletes it from his “sent” folder and the recipient deletes it as well.  This is far from the end of the story.  The expert will search to see who else received copies and who received copies of the copies.  Are there different versions on the system?  Is the information backed up somewhere?  Did anyone make a hard copy?  Did anyone save it on another medium?  Can it be retrieved from a server?  Can a search of the ISP—the Internet Service Provider—prove fruitful?

And even if it has been deleted from all systems, “deleted” does not mean destroyed.  When a file is deleted, the computer makes the space occupied by that file available for new data.  Reference to the deleted file is removed from directory listings and from the file allocation table, but the bits and bytes that make up the file remain on the hard drive until they are overwritten by new data, unless they are successfully wiped by use of utility software.

When computer storage was expensive, hard drives were small, and it did not take long for data to be overwritten.  Now that it is common to have even home computers with 40 or more gigabytes of storage, it is much less likely that deleted data will be quickly written over.  This means that a file that appears to have been deleted is probably still recoverable.

Forensic experts agree that one cannot rely on paper documents.  Litigants should insist on full access to electronic document creation and storage devices.  These electronic versions have imbedded data—called meta data—that will allow a forensic person to find when they were created and by whom, when they were edited and by whom, what those edits were, and who received a copy.

Other examples include:

Importantly, these documents can be electronically searched—so the expert can conduct Boolean searches much like those on Westlaw® or Lexis®.  Instead of manually sifting through thousands—if not millions—of pages looking for that needle in a haystack, the investigator can have the system search for it electronically.

Little Protection Afforded Employee E-mails
In a recent case, an employee was assured that e-mails were confidential.  He was later fired because of inappropriate and unprofessional comments on his employer’s e-mail system.  He sued his former employer.  A Pennsylvania federal court held in favor of his employer, finding no reasonable expectation of privacy in communications made in the company e-mail system.  Given the employer assurance, many courts would have found a privacy right.  Employers usually are held to have the right to search an employee’s e-mail “if” notice is given.

In a Northwest Airlines suit against the flight attendants’ union, there was a flight attendant’s website chat room providing a forum to discuss work-related issues including “sick outs” and strikes.  Northwest Airlines sought an order to search the hard drives and home computers of union officials and some of its employees.  Forty-three people were ordered to turn over their computers. Even what was said on a home computer was “fair game” for discovery in litigation.

Keeping everything forever is generally a bad idea.  Keeping too much can make retrieval a bigger problem than it needs to be.  This can actually be used as an offensive weapon by some.  There are stories of a website instructing people to sue a certain company and ask for certain kinds of documents.  People were told that the company’s records were so voluminous that it would rather pay a settlement than go through the production process.

Just because you “can” keep something a long time, doesn’t mean you “should.”  Some organizations simply box up old files and store them away without any attempt to cull out what should not be kept.  Now that electronic document storage is so inexpensive, the “easy” decision may seem to be that everything should be electronically stored.  Generally speaking, that is a mistake.  Most organizations should not retain documents longer than they are needed; yet, most do retain them in one form or another. 

How long should documents be retained?  Perhaps 75% of all documents created have no legally required retention period.  For the other 25%, there are retention periods in statutes or regulation periods, statutes of limitations, or other factors requiring their retention.

And how will they be retained?  Tapes are fragile.  Humidity and heat affect microfilm.  And will the medium you use be readable when you need it?  Do you remember CP/M, an early operating system?  Or 5¼ inch floppy disks?  Will the Word® document you save today be readable in 10 years?  Should it be saved in a static form such as PDF or TIFF?

The decision regarding how long to keep documents should be a combined management/legal decision.  Certain documents are not legally required to be maintained, but may be helpful for historical purposes.  After all, people die, retire, quit or even have honest differences in their recollections of what took place.  Management needs to decide what makes sense for the organization.

Whose cost is it?
While the responding party normally bears the cost of gathering responsive documents, Federal Rules 34 and 26(c) allow courts to shift the cost of document production upon a showing of “undue burden and expense.”  In some cases, courts require some sort of expense sharing, or may require the requesting party to pay the entire cost.

An example of the reasoning employed by some courts can be found in Rowe Entertainment, Inc., et al. v. The William Morris Agency, Inc., et al., in which eight cost shifting factors were considered: (1) specificity of the discovery requests; (2) likelihood of a successful search; (3) availability from other sources; (4) purposes of retention; (5) benefit to the parties; (6) total costs; (7) ability of each party to control costs; and (8) the parties’ resources.

Why keep it at all?
Given the grief involved in document retention, companies may ask why they should retain anything.  Obviously, the documents may be needed for the company’s own defense.  There may be a statutory or common law duty to retain the records in their original form.  And the company will have the best chance of defeating a spoliation claim if it has a “reasonable” records management policy that is consistently enforced.

A finding of spoliation can be very costly.  Even in jurisdictions where there is no independent tort of spoliation, courts have given juries an instruction on “spoliation of evidence” which essentially say that if a party destroyed it, you can assume that it was harmful to that party.

Not only traditional “documents” must be preserved, but it is also important that other electronic media such as website content be retained as well.  While there is little case law to date, at law, a California court sanctioned a party under a spoliation theory when it changed its web site during litigation.

Who pays for all this?
The approach many courts took in the early years was that the computer was “fair game” for discovery in litigation.

Other systems keep records
If you are in a secure environment where employees must gain access electronically, there may well be a running record of where employees traveled throughout the course of a day.

The computer system tracks how long employees were on the system, how much time they spent on various documents, and where they went on the system.

Modern telephone systems keep records of calls.  How long are these records retained?  And is voice-mail retained as a WAVE file discoverable?

Joel Mirman is a Shareholder and member of the Litigation Practice Group.  He can be contacted at jmirman@bdblaw.com or 614.227.4264.

BDB Active In Martindale-Hubbell’s Counsel To Counsel Forum

On Wednesday, September 18, Nick George and Jerry Chattman participated in Martindale-Hubbell’s Counsel To Counsel Forum. The event was held in Cleveland and included high-level counsel from northeast Ohio corporations and representatives from major area law firms. The Counsel To Counsel series is a global initiative that gives senior corporate counsel the opportunity to discuss best practices in delivering or contracting for corporate legal services.

“We felt that this was a great way to keep in touch with the evolving needs and expectations of our corporate clients,” explained Nick George. “Based on the concerns expressed by several corporate attorneys, I think our message of focusing on being responsive, solving problems and continuing to develop relationships with the clients we serve as well as the basics – returning calls, keeping clients up to date with events, and so on – was timely and appropriate.”

Jerry Chattman agreed. “The forum was excellent. We definitely intend to continue our participation when the Counsel To Counsel series is again held in Cleveland or the other cities we serve.”

• October 16, 2002, Akron, Ohio - The City Club of Akron
• October 23, 2002, Independence, Ohio - Holiday Inn Rockside Road

• October 15, 2002 - Akron, Ohio - Sheraton Suites, Cuyahoga Falls

October 24, 2002 - Health Law Seminar for Long Term Care, Columbus, Ohio -

Arena Grand Theater (The State of Ohio has approved this seminar for 3 Credit Hours for Nursing Home Administrators)

To register on line visit www.bdblaw.com/seminars.asp or contact Maria Denisiak at mdenisiak@bdblaw.com or 330.258.6478.

On October 29, 2002, Thomas J. Sigmund (Buckingham Columbus^SM) will present “New Qualified Plan Designs After EGTRRA” at the Columbus Tax Conference sponsored by the Columbus Bar Association.  Please reference www.cbalaw.org or 614.221.4112 for additional information. 

On November 7, 2002, Rana M. Gorzeck and Mary Sue Donohue (Buckingham Boca Raton^SM) will be giving a presentation, on behalf of the Firm, titled “The Patriot Act,” to the local chapter of American Woman’s Society of Certified Public Accountants at the Tower Club in Fort Lauderdale, Florida.

On November 13, 2002, Phylip J. Divine (Buckingham Akron^SM) will be presenting at the Canton Estate Planning Forum sponsored by the Akron/Canton Chapter of the Ohio Society of CPAs.  For additional information, please contact Bruner Cox – Estate Planning Forum at 330.497.2000.

On November 15, 2002, Bret A. Adams and Paul J. Hess Jr. (Buckingham Columbus^SM) will be presenting “Current Trends in Sports Law” sponsored by the Columbus Bar Association.  Please reference www.cbalaw.org or 614.221.4112 for additional information. 

On November 21, 2002, Robert A. Hager (Buckingham Cleveland^SM) will be speaking on “Lien Law” for Lorman Education Services.  Reference www.lorman.com for registration and additional information.

On November 21 - 22, 2002, Robert W. Malone (Buckingham Akron^SM) will be the Chair of the Cleveland Tax Institute Panel for the Cleveland Bar Association. Please visit www.clevelandbar.org for additional information. 

On December 10, 2002, Gerald B. Chattman and John P. Slagter (Buckingham Cleveland^SM) will be presenting on “Legal Issues Involving Ohio Local Governments” at a National Business Institute sponsored seminar.  Please reference www.nbi-sems.com for additional information. 

Out and About – Recent Presentations:

Business Law Practice Group

Deborah D. Hoover (Buckingham Akron^SM) spoke at the Leadership Akron Retreat on “Grant Review Procedures” for the Philanthropy Project. 

David J. Hrina (Buckingham Akron^SM) presented “Environmental Concerns for Developers,” at the “Current Issues in Subdivision Annexation and Zoning Law” Seminar sponsored by the National Business Institute.  

Robert W. Malone (Buckingham Akron^SM) gave a presentation to the Akron Area Board of Realtors regarding the “New Summit County Proposed Sales Tax for the Public Schools.”

Employment Law Practice Group

Gerald B. Chattman, Douglas S. Paul and Jeffrey T. Royer (Buckingham Cleveland^SM) conducted a Confidentiality Training Seminar for the Western Reserve Area Agency on Aging. 

Vincent J. Tersigni (Buckingham Akron^SM) presented “HR & Legal Crossroads:  Addressing Performance Problems in the Workplace,” in Fairlawn, Ohio at the Rosemont Country Club. 

Health Law Practice Group

Joseph J. Feltes (Buckingham Canton^SM) and Patrick H. Reymann (Buckingham Akron^SM) spoke at the Firm’s Health Law Seminar for Physicians and Hospitals.  The topics were “Effectively Managing HIPAA Issues” and “10 Major Physician Billing/Coding Problems.”

Eric M. Simon (Buckingham Cleveland^SM) and Thomas W. Hess (Buckingham Columbus^SM) were presenters at Buckingham’s Health Law Seminar for Long Term Care.  Their topics were “Effectively Managing HIPAA Issues” and “The Survey Process.”

Medical Malpractice Defense Practice Group

Christopher S. Humphrey (Buckingham Canton^SM) spoke on “Risk Management for Long Term Care: A Defense Perspective” to The Ohio State Bar Association.  He also spoke at the Firm’s 2002 Health Law Seminar for Long Term Care on “Patient Bill of Rights/Negligence Litigation Update.”

Ronald M. Wilt (Buckingham Cleveland^SM) presented “Medical Malpractice/Negligence Litigation Update” at Buckingham’s Health Law Seminar for Physicians and Hospitals. 

Real Estate & Construction Law Practice Group

Nicholas T. George (Buckingham Akron^SM) was a Professor for a Day at the University of Akron, in Akron, Ohio.  The topic of the course is “Legal Environment of Business.”

Frederick  M. Lombardi (Buckingham Akron^SM), Alan P. DiGirolamo, Robert A. Hager, and John P. Slagter (Buckingham Cleveland^SM) were presenters at “Using Ohio Construction Laws To Your Advantage” sponsored by Lorman Education Services.  They presented “Legal Aspects of Construction Contracts and Ohio Construction Law.”

Donald B. Leach, Jr. (Buckingham Columbus^SM) spoke on “Design Build Construction: Contracting and Insurance Issues,” in Columbus, Ohio for Lorman Education Services and “Ohio Mechanics’ Lien Law: The How’s and Why’s of the Paperwork,” for the Builders Exchange of Central Ohio.  He also presented “Design Build Construction: Contracting and Insurance Issues,” in Columbus, Ohio for Lorman Education Services.

Trusts & Estates Law Practice Group

David L. Drechsler and David W. Woodburn (Buckingham Akron^SM) spoke at Buckingham’s Complex Probate Litigation Seminar in Akron, Ohio.  Their topics were “Will Contest:  Procedures, Lack of Testamentary Capacity and Undue Influence,” “Intentional Interference with Inheritance,” and “Concealed & Embezzled Assets.”

Thomas J. Sigmund (Buckingham Columbus^SM) hosted the Buckingham Breakfast Exchange in Columbus.  The topic was “Distribution Planning from IRAs and Qualified Plans under the New Rules.”