Computer Forensics Docket Sheet

The plaintiffs filed suit against the defendants, former employees of the plaintiffs, alleging that the defendants' newly created company competed directly with the plaintiffs' business. To support their claims, the plaintiffs hired a computer-forensics expert to examine the defendants' former work computers. The forensics expert discovered that, prior to leaving the company, one of the defendants accessed the plaintiffs' computer network, copied company confidential files and deleted the copied files from his hard drive to conceal the file copying. Based on this evidence, the court granted the plaintiffs' request to make forensic copies of the defendants' current home and business computers and server. The forensics expert found that after the court issued the order, numerous computer searches for data-deletion software were performed and a program called BC Wipe was used to delete more than 13,000 files from the defendant's home and office computers and server. The forensics expert also found an additional 100 files deleted just hours before the defendants submitted the hard drives to the plaintiffs for analysis. Based on these facts, the court ordered the defendants to permanently delete the files and authorized the plaintiffs to re-image the defendants' hard drives to verify compliance. On re-imaging the hard drives, the plaintiffs' expert discovered that thousands of confidential files still existed on the drives. The defendants argued that they could not ensure whether they had deleted all the files because the plaintiffs failed to identify the files by name, directory and computer. Declining to accept the defendants' argument, the court stated, “[d]efendants' behavior, from the very inception of this case, has demonstrated willfulness, fault, and bad faith.” The court awarded $20,000 in sanctions and indicated that it would instruct the jury to make a negative inference concerning the deleted files. Advantacare Health Partners, LP v. Access IV, 2004 WL 1837997 (N.D.Cal. Aug. 17, 2004).

In a criminal prosecution for possession of child pornography, the state appealed a trial court's order dismissing the case against the defendant as a sanction for the state's discovery violations. Pursuant to a court order, the defendant had requested a “forensically sound” image copy of his computer hard drive, which had been turned over to the state by someone other than the defendant. When the state failed to comply with this and other discovery requests, the defendant moved to suppress any evidence derived from the computer and to have the charges dismissed. Refusing to award sanctions at that time, the district court granted the state more time to produce the disclosures. However, the state still had not produced the requests or allowed the defendant to access the computer even after several months. As a result, the trial court granted the defendant's motions for suppression and dismissal. On appeal, the state argued that it did not want to lose the forensic value of the computer by giving access to the defendant, because that would violate laws prohibiting dissemination of child pornography. Affirming the trial court's decision, the appellate court noted that “[a]lthough dismissal is an extreme sanction, '[t]he values sought to be achieved through reciprocal discovery will be attained only if the rules are properly observed, and to this end the trial courts must have the ability to make those obligations meaningful'.”

Court Sanctions Defendant For
Deleting Files To Hide Document Theft

The plaintiffs filed suit against the defendants, former employees of the plaintiffs, alleging that the defendants' newly created company competed directly with the plaintiffs' business. To support their claims, the plaintiffs hired a computer-forensics expert to examine the defendants' former work computers. The forensics expert discovered that, prior to leaving the company, one of the defendants accessed the plaintiffs' computer network, copied company confidential files and deleted the copied files from his hard drive to conceal the file copying. Based on this evidence, the court granted the plaintiffs' request to make forensic copies of the defendants' current home and business computers and server. The forensics expert found that after the court issued the order, numerous computer searches for data-deletion software were performed and a program called BC Wipe was used to delete more than 13,000 files from the defendant's home and office computers and server. The forensics expert also found an additional 100 files deleted just hours before the defendants submitted the hard drives to the plaintiffs for analysis. Based on these facts, the court ordered the defendants to permanently delete the files and authorized the plaintiffs to re-image the defendants' hard drives to verify compliance. On re-imaging the hard drives, the plaintiffs' expert discovered that thousands of confidential files still existed on the drives. The defendants argued that they could not ensure whether they had deleted all the files because the plaintiffs failed to identify the files by name, directory and computer. Declining to accept the defendants' argument, the court stated, “[d]efendants' behavior, from the very inception of this case, has demonstrated willfulness, fault, and bad faith.” The court awarded $20,000 in sanctions and indicated that it would instruct the jury to make a negative inference concerning the deleted files. Advantacare Health Partners, LP v. Access IV, 2004 WL 1837997 (N.D.Cal. Aug. 17, 2004).

In a criminal prosecution for possession of child pornography, the state appealed a trial court's order dismissing the case against the defendant as a sanction for the state's discovery violations. Pursuant to a court order, the defendant had requested a “forensically sound” image copy of his computer hard drive, which had been turned over to the state by someone other than the defendant. When the state failed to comply with this and other discovery requests, the defendant moved to suppress any evidence derived from the computer and to have the charges dismissed. Refusing to award sanctions at that time, the district court granted the state more time to produce the disclosures. However, the state still had not produced the requests or allowed the defendant to access the computer even after several months. As a result, the trial court granted the defendant's motions for suppression and dismissal. On appeal, the state argued that it did not want to lose the forensic value of the computer by giving access to the defendant, because that would violate laws prohibiting dissemination of child pornography. Affirming the trial court's decision, the appellate court noted that “[a]lthough dismissal is an extreme sanction, '[t]he values sought to be achieved through reciprocal discovery will be attained only if the rules are properly observed, and to this end the trial courts must have the ability to make those obligations meaningful'.”