Close
Enter your
text here

Preservation

Printed Copies of Documents Not Enough, Spoliation Sanctions Upheld for Discarding Computer – eDiscovery Case Law

On May 30, the Appellate Division of the Supreme Court of New York, First Department upheld a spoliation sanction against a plaintiff that failed to preserve electronic files and discarded his computer containing those files.

As reported in IT-Lex.org (Gross Negligence + Lack Of Litigation Hold = Spoliation Sanctions), In Harry Weiss, Inc. v. Moskowitz, a dispute involving diamond dealers and brokers, the Appellate Division upheld the defendants’ motion for spoliation sanctions to the extent of precluding plaintiff from offering any evidence and/or testimony at trial in opposition to defendants’ defenses and counterclaims, unanimously affirmed, with costs.  As noted in the transcript:

“More than two years into this litigation, plaintiff’s bookkeeper revealed at his deposition for the first time that certain electronic files that were created to track defendants’ commissions were either “lost” or “deleted” at the end of 2007 and 2008, after a copy of the file had been printed. The bookkeeper further testified that he created and kept all of plaintiff’s records on one computer, which had been in use for the last ten years. A month later, when defendants’ attorney sought to forensically examine the computer to determine if any of the deleted files could be restored, plaintiff’s bookkeeper claimed, for the first time, that the computer was “broken” and had been thrown away in late 2009 or early 2010, after the commencement of this action. Thereafter, the bookkeeper testified that numerous documents supporting plaintiff’s claim that defendants were not entitled to commissions could not be produced because they were stored only on the discarded computer.”

The plaintiff was put on notice of its obligation to “preserve all relevant records, electronic or otherwise,” at the very latest, in July 2009, when it received defendants’ answer asserting counterclaims for commissions, so the disposition of the computer was spoliation of that data.

The plaintiff claimed that disposal of the computer did not cause defendants any prejudice because many of the files were printed prior to its disposal, but the court rejected that argument, noting that “converting the files from their native format to hard-copy form would have resulted in the loss of discoverable metadata”. “In addition, by discarding the computer after its duty to preserve had attached without giving notice to defendants, plaintiff deprived defendants of the opportunity to have their own expert examine the computer to determine if the deleted files could be restored”.

So, what do you think?  Was the sanction justified?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Want to Make eDiscovery Proportional? Tie it to the Amount at Stake – eDiscovery Trends

Apparently, the effect of the proposed amendments to the discovery provisions of the Federal Rules of Civil Procedure approved for public comment may not be limited to just Federal courts.  They also could have a significant effect on New York’s state courts as well.

According to Brendan Pierson in the New York Law Journal (Proposal Would Tie Scope of Discovery to Amount in Controversy), the “most sweeping change would amend Rule 26(b)(1) to require that courts allow discovery that is ‘proportional to the needs of the case considering the amount in controversy, the importance of the issues at stake in the action, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.’”  Since New York courts “generally follow” the current federal discovery standard in which any material that could lead to admissible evidence is generally discoverable (regardless of the amount in controversy), the presumption is that they would follow the new standard as well.

If the US system is the “broadest discovery system on the planet” (according to Alvin Lindsay, a Hogan Lovells partner and an expert in discovery issues), the proposed changes would “bring discovery in the United States more in line with the rest of the world”.

The author cites the Zubulake v. UBS Warburg case as a key turning point in the number of documents preserved and produced in litigation and that growing eDiscovery costs have led to a “backlash among practitioners”.  According to experts, the proposed rules changes are “likely to gain broad support”.  “I don’t know who you’re going to get who’s going to oppose the principle of proportionality,” said Paul Sarkozi, a partner at Tannenbaum Helpern Syracuse & Hirschtritt and vice-chair of the commercial litigation section of the New York State Bar Association.

However, one “possible source of opposition could be class action plaintiffs attorneys, who can sometimes benefit from the more extensive discovery available under current rules”.  It will be interesting to see if there is considerable opposition from plaintiffs’ attorneys.  For more in the article, click here.

So, what do you think?  Are you pleased or concerned with the proposed amendments?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Appellate Court Denies Sanctions for Routine Deletion of Text Messages – eDiscovery Case Law

In PTSI, Inc. v. Haley, No. 684 WDA 2012, 2013 Pa. Super. (Pa. Super. Ct. May 24, 2013), the appellate court denied a motion for spoliation sanctions where the defendants routinely deleted text messages and other data to “clean up” their personal electronic devices: the volume of messages and limited amount of phone storage made it difficult to retain all data and still use the phone for messaging.

Here, the plaintiff filed claims of conversion, breach of the duty of loyalty, and breach of fiduciary duty against its former at-will employees and their new competing business. The trial court dismissed all claims at summary judgment. It also denied PTSI’s motion seeking sanctions for spoliation, because the deletion of electronically stored information, including text messages, was not relevant to the summary judgment decision.

During discovery, PTSI filed a motion seeking sanctions based on its two former employees’ deletion of electronic records from their computers and phones, including text messages. The company claimed the information was “vital to the prosecution of this case” and could not be “feasibly reconstructed or retrieved without enormous time and expense to PTSI, if at all.”

Under Pennsylvania law, the court had to evaluate three factors to determine the appropriate sanction: “(1) the degree of fault of the party who altered or destroyed the evidence; (2) the degree of prejudice suffered by the opposing party; and (3) whether there is a lesser sanction that will avoid substantial unfairness to the opposing party and, where the offending party is seriously at fault, will serve to deter such conduct by others in the future.”

To determine the level of fault, the court considered the extent of the duty to preserve the evidence, based on whether litigation is foreseeable and whether the evidence might be prejudicial to the opposing party, and whether the evidence was destroyed in bad faith. The court also considered proportionality in making decisions, including five factors spelled out in the comments to the Pennsylvania Rules of Civil Procedure:

  • the nature and scope of the litigation, including the importance and complexity of the issues and the amounts at stake;
  • the relevance of electronically stored information and its importance to the court’s adjudication in the given case;
  • the cost, burden and delay that may be imposed on the parties to deal with electronically stored information;
  • the ease of producing electronically stored information and whether substantially similar information is available with less burden; and
  • any other factors relevant under the circumstances.

Here, the amount in controversy and the importance of the issues involving the data did not support awarding a discovery sanction. Moreover, PTSI could not show that its former employees’ “innocent clean up of personal electronic devices to allow them to function was unusual, unreasonable or improper under the circumstances.” Because the defendants “routinely deleted text messages, often on a daily basis, so as not to unduly encumber their iPhones” and because of “the volume of text messages that are frequently exchanged by cell phone users and the limited amount of storage on cell phones, it would be very difficult, if not impossible, to save all text messages and to continue to use the phone for messaging.” Furthermore, the order of preservation was entered well after any relevant data would have already been created and deleted. In addition, similar information was available from other sources and custodians; the forensic examiner in the case unearthed more than 1,000 e-mails from the employees’ computers. Finally, any spoliation inference could not defeat the summary judgment motion.

The appellate court agreed with the trial court’s reasoning and found no abuse of discretion.

So, what do you think?  Should the sanctions have been granted?  Please share any comments you might have or if you’d like to know more about a particular topic.

Case Summary Source: Applied Discovery (free subscription required).  For eDiscovery news and best practices, check out the Applied Discovery Blog here.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Judge Rules Against Spoliation Sanctions when the Evidence Doesn’t Support the Case – eDiscovery Case Law

In Cottle-Banks v. Cox Commc’ns, Inc., No. 10cv2133-GPC (WVG) (S.D. Cal. May 21, 2013), California District Judge Gonzalo P. Curiel denied the plaintiff’s motion for spolation sanctions because the plaintiff was unable to show that deleted recordings of customer calls would have likely been relevant and supportive of her claim.

The defendant provides services and products such as set-top cable boxes and customers call in to order these services and products.  The plaintiff alleged a practice of charging customers for boxes without disclosing, and obtaining approval for equipment charges – a violation of the Communications Act of 1934, 47 U.S.C. § 543(f).  The plaintiff’s discovery requests included copies of recording of her own calls with the defendant, and the defendant began preserving tapes when the plaintiff notified the defendant that she would seek call recordings in discovery, not before that.  As a result, the plaintiff filed a motion for spoliation sanctions, requesting an adverse inference and requesting that the defendant be excluded from introducing evidence that it’s call recordings complied with 47 U.S.C. § 543(f).

From the call recordings still available, a sample of recordings was provided to the plaintiff – in those calls, it was evident that the defendant did, in fact, get affirmative acceptance of the additional charges as a matter of practice.

Judge Curiel ruled that the defendant “had an obligation to preserve the call recordings when the complaint was filed in September 2010” and that the defendant “had an obligation to preserve the call recording, [so] Defendant was negligent in failing to preserve the back up tapes. Thus, Defendant had a culpable state of mind.”  However, because the “Plaintiff cited only two call recordings out of 280 call recordings produced to support her position”, the judge concluded “that the deleted call recordings would not have been supportive of Plaintiff’s claim.”  Because “Plaintiff has not demonstrated all three factors to support an adverse inference sanction”, Judge Curiel denied the plaintiff’s motion as to adverse inference and preclusion.

So, what do you think?  Should the sanction request have been denied?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Spoliation of Data Can Get You Sent Up the River – eDiscovery Case Law

Sometimes, eDiscovery can literally be a fishing expedition.

I got a kick out of Ralph Losey’s article on E-Discovery Law Today (Fishing Expedition Discovers Laptop Cast into Indian River) where the defendant employee in a RICO case in Simon Property Group, Inc. v. Lauria, 2012 U.S. Dist. LEXIS 184638 (M.D. Fla. 2012) threw her laptop into a river.  Needless to say, given the intentional spoliation of evidence, the court imposed struck all of the defenses raised by the defendant and scheduled the case for trial on the issue of damages.  Magistrate Judge Karla Spaulding summarized the defendant’s actions in the ruling:

“This case has all the elements of a made-for-TV movie: A company vice president surreptitiously awards lucrative business deals to a series of entities that she and her immediate family members control. To cover up the egregious self-dealing, she fabricates multiple fictitious personas and then uses those fictitious personas to “communicate” with her employer on behalf of the entities she controls. She also cut-and-pastes her supervisor’s signature onto service agreements in an attempt to make it seem as if her activities have been approved. After several years, a whistleblower exposes the scheme to the company. The company then tells the vice president that she is being investigated and warns her not to destroy any documents or evidence. Sensing that her scheme is about to collapse around her and wanting to cover her tracks, the vice president then travels to the East Coast of Florida and throws her laptop computer containing information about these activities into a river.”

At least she didn’t deny it when deposed as noted in the ruling:

“When asked why she threw the laptop away, Lauria testified as follows:

Q: Okay. Why did you throw the laptop away?

A: Because I knew that something was coming down and I just didn’t want all the stuff around.

Q: So you were trying to get rid of documentation and e-mails and things?

A: Uh-huh, yes.

Q: That directly related to the lawsuit?

A: Yes. Now, they do, yes.”

Maybe she should have used the George Costanza excuse and state that she didn’t know it was “frowned upon”.

So, what do you think?  Was that wrong?  Just kidding.  Please share any comments you might have or if you’d like to know more about a particular topic.

BTW, Ralph is no stranger to this blog – in addition to several of his articles we’ve referenced, we’ve also conducted thought leader interviews with him at LegalTech New York the past two years.  Here’s a link if you want to check those out.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Adverse Inference Sanction for Defendant who Failed to Stop Automatic Deletion – eDiscovery Case Law

Remember the adverse inference instructions in the Zubulake v. UBS Warburg and Apple v. Samsung cases?  This case has characteristics of both of those.

In Pillay v. Millard Refrigerated Servs., Inc., No. 09 C 5725 (N.D. Ill. May 22, 2013), Illinois District Judge Joan H. Lefkow granted the plaintiff’s motion for an adverse inference jury instruction due to the defendant’s failure to stop automatic deletion of employee productivity tracking data used as a reason for terminating a disabled employee.

Case Background

The plaintiff alleged that the defendant is liable for retaliation under the Americans with Disabilities Act (“ADA”) for terminating his employment after the plaintiff opposed the defendant’s decision to terminate another employee because of a perceived disability.  The defendant employed a labor management system (“LMS”) to track its warehouse employees’ productivity and performance.  Shortly after hiring the employee and telling him that his LMS numbers were great, the defendant fired the employee when it was determined that a prior work injury he suffered rendered him with a disability rating of 17.5 percent by the Illinois Industrial Commission, which prompted the senior vice president to send an email to the general manager stating “We have this all documented right? … Let’s get him out asap.”  The employee (and the plaintiff, for objecting to the termination) was terminated in August 2008 and the defendant contended that the employee’s termination resulted from his unacceptable LMS performance rating of 59 percent.

Deletion of LMS Data

In August 2009, the raw data used to create the employee’s LMS numbers were deleted because the LMS software automatically deleted the underlying data after a year. Before the information was deleted, the plaintiff and other terminated employee provided several notices of the duty to preserve this information, including:

  • A demand letter from the plaintiff in September 2008;
  • Preservation notices from the plaintiff and other terminated employee in December 2008 reminding the defendant of its obligations to preserve evidence;
  • Charges filed by both terminated employees with the Equal Employment Opportunity Commission (“EEOC”) in January 2009.

Also, the defendant’s 30(b)(6) witness testified that supervisors could lower an LMS performance rating by deleting the underlying data showing that an employee worked a certain number of jobs for a given period of time, which the plaintiff contended happened in this case.  As a result, the plaintiff filed a motion for the adverse inference jury instruction.

Judge’s Ruling

Noting that the defendant “relied on this information when responding to the EEOC charges, which occurred before the deletion of the underlying LMS data” and that “[i]nformation regarding the underlying LMS data would have been discoverable to challenge Millard’s explanation for Ramirez’s termination”, Judge Lefkow found that the defendant had a duty to preserve the LMS data (“A party must preserve evidence that it has notice is reasonably likely to be the subject of a discovery request, even before a request is actually received.”).

With regard to the defendant’s culpability in deleting the data, Judge Lefkow stated “[t]hat Millard knew about the pending lawsuit and that the underlying LMS data would be deleted but failed to preserve the information was objectively unreasonable. Accordingly, even without a finding of bad faith, the court may craft a proper sanction based on Millard’s failure to preserve the underlying LMS data.”

So, Judge Lefkow granted the plaintiff’s request for an adverse inference sanction with the following instruction to be given to the jury:

“Pillay contends that Millard at one time possessed data documenting Ramirez’s productivity and performance that was destroyed by Millard. Millard contends that the loss of the data was accidental. You may assume that such evidence would have been unfavorable to Millard only if you find by a preponderance of the evidence that (1) Millard intentionally or recklessly caused the evidence to be destroyed; and (2) Millard caused the evidence to be destroyed in bad faith.”

So, what do you think?  Should the adverse inference sanction have been awarded?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Capturing Memory and Obtaining Protected Files with FTK Imager – eDiscovery Best Practices

Over the past few weeks, we have talked about the benefits and capabilities of Forensic Toolkit (FTK) Imager from AccessData (and obtaining your own free copy), how to create a disk image, how to add evidence items for the purpose of reviewing the contents of those evidence items (such as physical drives or images that you’ve created) and how to export files and create a custom content image of a targeted collection of files with FTK Imager.  This week, let’s discuss how to Capture Memory and Obtain Protected Files to collect a user’s account information and possible passwords to other files.

Capture Memory

If you’re trying to access the contents of memory from an existing system that’s running, you can use a runtime version of FTK Imager from a flash drive to access that memory.  From the File menu, you can select Capture Memory to capture data stored in memory within the system.

Capturing memory can be useful for a number of reasons.  For example, if TrueCrypt is running to encrypt the contents of the drive, the password could be stored in memory – if it is, Capture Memory enables you to capture the contents of memory (including the password) before it is lost.

Simply specify the destination path and filename to capture memory to the specified file.  You can also include the contents of pagefile.sys, which is a Windows system file that acts as a swap file for memory; hence, it can contain useful memory information as well.  Creating an AD1 file enables you to create an AD1 image of the memory contents – then you can add it as an evidence item to review the contents.

Obtain Protected Files

Because Windows does not allow you to copy or save live Registry files, you would have to image the hard drive and then extract the Registry files, or boot the computer from a boot disk and copy the Registry files from the inactive operating system on the drive. From the File menu, you can select Obtain Protected Files to circumvent the Windows operating system and its file locks, thus allowing you to copy the live Registry files.  If the user allows Windows to remember his or her passwords, that information can be stored within the registry files.

Specify the destination path for the obtained files, then select the option for which files you would like to obtain.  The Minimum files for login recovery option retrieves Users, System, and SAM files from which you can recover a user’s account information.  The Password recovery and all Registry files option is more comprehensive, retrieving Users, System, SAM, NTUSER.DAT, Default, Security, Software, and Userdiff files from which you can recover account information and possible passwords to other files, so it’s the one we tend to use.

For more information, go to the Help menu to access the User Guide in PDF format.

So, what do you think?  Have you used FTK Imager as a mechanism for eDiscovery collection?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Appellate Court Upholds District Court Discretion for Determining the Strength of Adverse Inference Sanction – eDiscovery Case Law

In Flagg v. City of Detroit, No. 11-2501, 2013 U.S. App. (6th Cir. Apr. 25, 2013), the Sixth Circuit held that the district court did not abuse its discretion in issuing a permissive rather than mandatory adverse inference instruction for the defendant’s deletion of emails, noting that the district court has discretion in determining the strength of the inference to be applied.

In this appeal, the plaintiff children of a murder victim argued that the district court did not go far enough in issuing a permissive adverse inference instruction against the defendants for the destruction of evidence; instead, they believed a mandatory adverse inference instruction was warranted.

During discovery, the plaintiffs had filed a motion for preservation of evidence that covered emails. The court granted the motion. Later, the plaintiffs asked the defendants to produce all emails for a number of city officials, including the mayor. However, the city had deleted and purged the email of several officials when they resigned, including those of the mayor. The district court found the city had acted “culpably and in bad faith” in destroying the emails. Though it denied the plaintiffs’ request for a default judgment and a mandatory adverse inference, it did grant their request for a permissive inference. The plaintiffs appealed the district court’s choice of sanction.

The Sixth Circuit reviewed the district court’s opinion for abuse of discretion. It found that the plaintiffs met all three elements required for an adverse inference instruction: that the defendants had an obligation to preserve the evidence they destroyed, that the defendants destroyed the evidence with a culpable state of mind, and that the destroyed evidence was relevant to the plaintiffs’ claim.

Because the district court has the power to decide the strength of the inference, the Sixth Circuit upheld its decision, despite noting that “[i]f the severity of a spoliation sanction were required to be based solely on the sanctioned party’s degree of fault, this Court likely would be compelled to agree with Plaintiffs that the district court abused its discretion. After all, ‘intentionality’ is the highest degree of fault contemplated by this Court . . . and the district court found it to be present in this case.”

So, what do you think?  Should the District Court decision have been upheld?  Please share any comments you might have or if you’d like to know more about a particular topic.

Case Summary Source: Applied Discovery (free subscription required).  For eDiscovery news and best practices, check out the Applied Discovery Blog here.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Changes to Federal eDiscovery Rules Are One Step Closer – eDiscovery Trends

In April, we referenced Henry Kelston’s report in Law Technology News that another major set of amendments to the discovery provisions of the Federal Rules of Civil Procedure is getting closer and could be adopted within the year.  Now, the amendments are one step closer to enactment as they have been approved for public comment.

Henry Kelston reports again in Law Technology News (Proposed Discovery Amendments Move to Public Comment), noting that “With minimal discussion and no significant dissent, the Judicial Conference of the United States’ Standing Committee on Rules of Practice and Procedure voted on June 3 to approve for public comment the full slate of proposed amendments” that was previously approved by its Advisory Committee on Civil Rules.

As we summarized previously, potential revisions that have impact to discovery include changes to Rules 26, 30, 31, 33, 34, 36 and 37.  As Kelston reports, “The package also includes changes to Rule 1, adding language to the text to emphasize that the responsibility to use the rules in order ‘to secure the just, speedy and inexpensive determination of every action’ lies with the parties as well as the courts, and inserting comment language to encourage cooperation among parties in applying the rules.”

Apparently, Rule 1 was the only rule to receive votes against it as it received three dissenting votes.  Nonetheless, the proposed amendments were voted on as a package by the standing committee, who voted unanimously in favor of approving the package for publication.

After anticipated publication for public comment later this summer, the public comment period for proposed rules is expected to last six months.  Kelston reports that the “advisory committee, anticipating a high level of public interest in the proposals, plans to hold public hearings in several cities around the U.S.”, with the first hearing “expected to being held in November in Washington, D.C., to coincide with the advisory committee’s next scheduled meeting.”

We’ll keep you posted as the amendments progress.

So, what do you think?  Are you pleased or concerned with the proposed amendments?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Export Files and Custom Content Images in FTK Imager – eDiscovery Best Practices

Over the past few weeks, we have talked about the benefits and capabilities of Forensic Toolkit (FTK) Imager from AccessData (and obtaining your own free copy), how to create a disk image and how to add evidence items with FTK Imager for the purpose of reviewing the contents of evidence items, such as physical drives or images that you’ve created.  This week, let’s discuss how to export files and how to create a custom content image of a targeted collection of files.

Sometimes, you don’t want to create an image of the entire drive; instead, you’d like to perform a targeted collection or export individual files to review them.  Let’s discuss how to do that.

Export Files

As we discussed last time, you can Add Evidence Item to add a single evidence item to the evidence tree.  You can select a Physical Drive or Logical Drive, an Image File to view an image file created before or Contents of a Folder, to look at a specific folder.  You can also Add All Attached Devices to add all of the attached physical and logical devices.  When you select one or more evidence items, the selected items will be displayed in the Evidence Tree on the left hand side; navigate to the folder you want and it will display the contents on the right hand side.

Select one or more files (use Ctrl+Click to select multiple files or Shift+Click to select a range of files), then right-click on one of the files to display a popup menu.

Select Export Files to export the selected files, then FTK Imager will prompt you for a folder where the files will be saved.  The files will be saved to that folder.  Exporting files can be useful to pull a copy of selected files out of a forensic image for review.

Create Custom Content Image

As you’ll notice in the previous section, when you display the popup menu, another choice is to Add to Custom Content Image (AD1).  This enables you to start building a targeted list of files to be included in a custom image – useful if you want a specific group of files and not everything on the evidence item.

Any files that you select will then be added to the Custom Content Sources pane in the lower left window.  Continue adding items by repeating this step until you’ve specified or selected all the evidence files you want to add to this Custom Content image.  You can also use the Edit button to open the Wild Card Options dialog and select all files that meet a certain criteria (e.g., “My Documents|*.doc” will collect all files with a .doc extension in any folder named My Documents).

Once you have built your desired list of files, you can then build your Custom Content Image.  Select Create Custom Content Image from the file menu.  You can then repeat the steps for the Create Image, Evidence Item Information, Select Image Destination, Drive/Image Verify Results and Image Summary forms as illustrated in our earlier post How to Create an Image Using FTK Imager.  The resulting image will have an AD1 extension.  Then, this image can be examined just like any other image.

For more information, go to the Help menu to access the User Guide in PDF format.

Next time, we will discuss how to Obtain Protected Files to collect a user’s account information and possible passwords to other files.

So, what do you think?  Have you used FTK Imager as a mechanism for eDiscovery collection?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.