Computer Forensics Docket Sheet

A judge's sentence for a defendant convicted of embezzlement, inter alia, was increased by two levels for obstruction of justice ' namely the defendant's deliberate deletion of e-mail from a workplace-issued laptop. A computer-forensics expert determined that the defendant, a high-ranking official with the U.S. Drug Enforcement Administration (DEA), deleted incriminating e-mails and files from his government computer shortly after the agency placed him on administrative leave for suspicion of embezzlement. The defendant filed a motion asking the court to set aside the upward departure from the sentencing guidelines because the e-mails had not been deleted deliberately. He argued that he had deleted the files because department policy required departing employees to return laptops in the same condition in which they were issued. The defendant also argued that his personal America Online login information was deleted only to prevent others from obtaining his personal information. The court found the defendant's arguments 'patently ab-surd.' There was no doubt that the defendant was 'intentionally seeking to destroy this evidence to interfere with the investigation. By deleting the files ' some of which have not been recovered in usable form or at all ' he impeded the Government's investigation.' The upward departure of two levels in sentencing was affirmed by the court. United States v. Tamez, 2006 WL 2854336 (S.D.N.Y. Oct. 5, 2006).

In a copyright-infringement case involving illegal downloading of music from the Internet, the plaintiff motioned the court to award default judgment against the defendant for deletion of key computer records. The defendant was required to produce her computer for inspection two times to determine whether songs were illegally downloaded from the Internet. However, once the defendant eventually produced her computer, a computer-forensics expert determined that wiping software had been run shortly before and after production was ordered. The defendant argued that she had run a defragmentation program that comes installed on most computers and that is run automatically. The plaintiff argued that the defragmentation was performed at key moments in the litigation and was not indicative of a program running a monthly or weekly scan. The court held that the timeliness of the data deletion was consistent with intent to destroy. The defendant argued that the sanctions should be sufficient to prevent the destruction of any more evidence in the case. The court found that no other relevant evidence existed that the defendant could destroy. The court held, then, that only an order for default judgment would be fair because key evidence was missing and, without it, only piecemeal evidence would remain, greatly prejudicing the plaintiff in presenting its case. Arista Records v. Tschirhart, 2006 WL 2728927 (W.D. Tex. Aug. 23, 2006).

Deliberate Deletion of e-Mails Increases Prison Sentence

A judge's sentence for a defendant convicted of embezzlement, inter alia, was increased by two levels for obstruction of justice ' namely the defendant's deliberate deletion of e-mail from a workplace-issued laptop. A computer-forensics expert determined that the defendant, a high-ranking official with the U.S. Drug Enforcement Administration (DEA), deleted incriminating e-mails and files from his government computer shortly after the agency placed him on administrative leave for suspicion of embezzlement. The defendant filed a motion asking the court to set aside the upward departure from the sentencing guidelines because the e-mails had not been deleted deliberately. He argued that he had deleted the files because department policy required departing employees to return laptops in the same condition in which they were issued. The defendant also argued that his personal America Online login information was deleted only to prevent others from obtaining his personal information. The court found the defendant's arguments 'patently ab-surd.' There was no doubt that the defendant was 'intentionally seeking to destroy this evidence to interfere with the investigation. By deleting the files ' some of which have not been recovered in usable form or at all ' he impeded the Government's investigation.' The upward departure of two levels in sentencing was affirmed by the court. United States v. Tamez, 2006 WL 2854336 (S.D.N.Y. Oct. 5, 2006).

In a copyright-infringement case involving illegal downloading of music from the Internet, the plaintiff motioned the court to award default judgment against the defendant for deletion of key computer records. The defendant was required to produce her computer for inspection two times to determine whether songs were illegally downloaded from the Internet. However, once the defendant eventually produced her computer, a computer-forensics expert determined that wiping software had been run shortly before and after production was ordered. The defendant argued that she had run a defragmentation program that comes installed on most computers and that is run automatically. The plaintiff argued that the defragmentation was performed at key moments in the litigation and was not indicative of a program running a monthly or weekly scan. The court held that the timeliness of the data deletion was consistent with intent to destroy. The defendant argued that the sanctions should be sufficient to prevent the destruction of any more evidence in the case. The court found that no other relevant evidence existed that the defendant could destroy. The court held, then, that only an order for default judgment would be fair because key evidence was missing and, without it, only piecemeal evidence would remain, greatly prejudicing the plaintiff in presenting its case. Arista Records v. Tschirhart, 2006 WL 2728927 (W.D. Tex. Aug. 23, 2006).