Electronic Evidence Never Dies

If you've ever been involved in any type of litigation, you know that finding evidence to support your position is one of the keys to victory. As a tech lawyer, I sometimes am asked by other lawyers to look at non-tech cases and offer advice on electronic evidence. Electronic evidence can make or break a case--often in surprising ways.

Let's start with the basics. "Electronic evidence" is any information of any type that's stored in electronic form and is relevant to a particular litigation. It might be stored on things like a hard drive, floppy disk or DVD.

When you consider what electronic evidence you might be able to dig up (or what electronic evidence the other side might find when they start chomping into your bytes), you should take into account that every time you touch a computer, you may be creating electronic evidence.

The Power of Email

Let's consider a single hypothetical e-mail message that you created using Word and then copied and pasted into your e-mail program. How many places could this thing turn up? Before I begin answering this question, I must warn you that after you read the answer, you may not sleep tonight. Let's start with the good news.

The most obvious place is that the text of your e-mail will be on your hard drive in whatever folder you save your correspondence. If you went through multiple revisions and drafts, it's possible that your word processor saved every draft, every revision and the name of everyone who touched the document. Oh yes, let's not forget that this is all along with the date and time of the revisions.

So, you're thinking that this is no problem. There's no litigation pending or threatened concerning this document, so you'll just delete the file. Your lawyer even told you that it would not be improper to destroy this particular document at this particular time. The problem is that you may have accomplished nothing.

The document may also exist on your network back-up tapes. Even if you think of it, generally you can't delete a single file from a back-up tape. That's really OK because by the time I'm done tracing the life of this e-mail, you're going to realize that the tape back-up is the least of your issues.

Once you copy and paste the text into your e-mail program and send it, your e-mail will also turn up in the "sent" box in your e-mail program. Some "recycle bins" or "trash bins" on some computers will even save every version of a file as it changes. With this feature, you may find countless versions of your "sent" box on your hard drive. Every time you send an e-mail, a new version of your "sent" box is created and another old one goes to the recycle bin.

If you're wondering why I called the stuff above the "good news," that's because here comes the bad news. It was good news because, assuming that your lawyer gave you the green light to destroy the document, you could control everything I've talked about--until now.

What you can't control starts with your Internet service provider. While your e-mail might quickly disappear from your hard drive, your provider may have their own back-up procedures, which may ensnare your e-mail. Then, the same goes for your receiver's Internet service provider.

And let's not forget the person to whom you sent your e-mail. It will be in her inbox, e-mail program trash bin, hard drive trash bin and her tape back-ups. For the coup de grce, if she forwarded it, your e-mail may be like a rabbit on reproductive overdrive.

Scope of the Task

The good news for a lawyer looking for electronic evidence is that computers create and store massive amounts of information. Better yet, it's often stored in ways that aren't obvious to an average user.

When you consider things like temporary and swap files (a computer creates them automatically and without a user's control), which may be chock full of juicy information, you realize that finding helpful electronic evidence is a bit like fishing for one particular fish in the ocean. The task can be expensive if not daunting.

A single floppy disk holds the equivalent of about 720 pages of text. Move to a CD-ROM and you've upped the ante to about 325,000 pages. Each gigabyte is about 500,000 pages.

If you're the one looking for electronic evidence, you'll need to hire an expert who's familiar with the latest technologies for recovering deleted computer data. It's a well-known truism that deleting a file from your hard drive doesn't really destroy the data. Deleting a file is more like removing reference to the file from the table of contents of a book than tearing it out and shredding it.

If you want to truly destroy a file or erase an entire hard drive (let's say before you sell your computer), the standard advice has been to use a program that overwrites the old data with random data. The fact is that this isn't really good enough if someone wants to get to your data badly enough. With techniques like magnetic force microscopy and scanning tunneling microscopy, it is possible to recover data that's been overwritten many times.

When you consider destroying data, remember that in some situations it's illegal to do so. Check with your lawyer before you act. Once your lawyer blesses your data destruction, if you really need to insure success, forget about overwriting data with random data--it's not foolproof . . . but your fireplace is.