eDiscovery Daily Blog

Use of a Bulk File Changer to Manipulate Metadata Leads to Sanctions for Defendant – eDiscovery Case Law


In T&E Investment Group, LLC v. Faulkner, Nos. 11-CV-0724-P, 3:11-CV-1558-P (N.D. Tex. Feb. 12, 2014), Texas District Judge Jorge A. Solis upheld the earlier recommendation of the Magistrate Judge to order an adverse inference sanction, along with monetary sanctions, against the defendant for manipulation of metadata.

In this litigation, it had been ordered that “a third party independent computer forensic expert jointly selected by the parties shall be permitted by defendants to have access to all of the computers used by the defendants during the year 2011, wherever located, for examination of their hard drives.” After examining the three computers produced by the defendants, the expert determined that one of the computers produced by an individual defendant had been manipulated.

In his report, the expert specifically stated that the defendant “created a new profile on PCL-03, copied data to it, and used a bulk file changer to alter the data in an apparent ‘attempt to make it look like that was his computer that he used all the time’.” It was noted that the majority of the manipulated data was not related to the issues of the lawsuit. Further, the expert “believed that someone used the bulk file changer to hide the existence of a computer that had not been produced in this case,” and identified the computer that was not produced as “Alienware.”

Evidence in the expert’s report indicated that the last use of the Alienware computer had been inside the individual defendant’s home, the day after defendants were ordered to produce all computers relevant to the litigation. Additionally, the report found that the missing computer had been connected to the computer identified as PCL-03, which contained the manipulated data. And further, evidence indicated that during the relevant time period, the defendant had sent emails from the Alienware computer.

The defendant testified that he had used the bulk fire changer only to attempt to “set them as read only,” allegedly so they could not be deleted, and further categorized the copied files as “a multitude of things related to our investor files, a lot of photos, PDFs, Word documents, just standard stuff that we update our investor base with.” However, it was ultimately concluded that this testimony was false.

The plaintiffs requested sanctions, and limited consideration to the three specific computers produced by the defendants, while denying the defendants’ objection to consideration of the absent Alienware computer because “a finding that Defendants manipulated data on PCL-03 in order to avoid production of the Alienware computer or any other relevant evidence remains a viable ground for sanctions.”

Broadly, the Magistrate Judge ruled that the defendants had a duty to preserve “the evidence at issue, including PCL-03, the Alienware computer, and any other computer used by Defendants in 2011 in their possession, custody, or control.” Additionally, it was deemed that despite the individual defendant’s insistence that the unproduced computer was not within his home, the “evidence overwhelmingly support[ed]” the determination of the expert with regards to the manipulated data and the existence and use of the Alienware computer.

It was ruled that the individual defendant “acted in bad faith” by altering the metadata on PCL-03 to make it appear that he had used the computer “for a number of years,” and that he had made false statements to the court about manipulating the data, and further that it was done “in the context” of the defendant’s failure to produce the Alienware computer. While the Magistrate Judge concluded that the plaintiffs had not been “irreparably prejudiced,” requisite prejudice was established because “a reasonable fact finder could conclude” that there was relevant information contained on the non-produced computer, and that spoliation had occurred. Therefore, the Magistrate Judge recommended that the jury be “given a spoliation instruction that would entitle the jury to draw an adverse inference that a party who intentionally spoliated evidence did so in order to conceal evidence that was unfavorable to that party.” In addition, a recommendation was made for monetary sanctions of $27,500.

Judge Solis, upon conducting a de novo review and hearing objections from the defendants, accepted the recommendations of the Magistrate Judge in imposing both the adverse inference and monetary sanctions against the defendants. 

So, what do you think? Are adverse sanctions sufficient to suggest electronic evidence that is not present due to data manipulation? Should a more stringent order be placed in cases where it is determined that evidence has been deliberately not produced? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.