February 26, 2014

Defendants Sanctioned After Computer Forensics Expert Uncovers Altered Metadata

by Alan Brooks

In the event it is suspected that a defendant has attempted to alter electronic data or metadata, a computer forensics expert may be used to uncover misconduct and bad faith spoliation.  In T&E Investment Group LLC v. Faulkner, et al., No. 11-CV-0724-P (N.D.Tx. February 12, 2014), a court appointed neutral forensics expert uncovered material altercations of the electronic evidence by defendant Faulkner, the CEO of one of the defendant businesses. The expert testified that only five days after the order to produce the computers, Faulkner created a new user profile on the computer, copied data onto the computer and used the bulk file changer to alter aspects of the transferred files. The new user starting date was manually changed to reflect a date in 2009 (two years before the computer was even purchased.) Faulkner apparently did this to claim that such computer was his main computer.

Caught red-handed, the defendants seemed to have scrambled a bit in opposing the resulting plaintiff Motion for Spoliation and for Sanctions due to the alterations on the computer. After the Magistrate Judge recommended an adverse inference instruction as sanction for the bad faith spoliation by defendant, the defense objected to the magistrate’s order based on three premises:

1. It exceeded the scope of the spoliation motion;

2. There was a lack of due process and notice; and

3. It imposed excessive monetary sanctions.

Defendants claimed the magistrate exceeded the scope of plaintiff’s motion for sanctions, as the motion regarded three specific computers and not the one where defendant changed the metadata. At the first hearing on this issue, Faulkner testified as to why he made those changes, testimony that was refuted by the expert and the data at the second evidentiary hearing. This not only discredited Faulkner as a witness, but bolstered the expert’s testimony and evidence that demonstrated bad faith spoliation.

The district court judge affirmed the magistrate’s recommendation: “limiting the motion for sanctions for spoliation related to three specific computers does not preclude the Court from considering facts and circumstances pertinent to those issues.” As the “lack of due process and notice” objection stemmed mainly from the scope issue, the court overruled such objection. Finally, in light of the bad faith spoliation and reviewing the facts of the case de novo, the court determined that the magistrate’s imposition of a $27,500 monetary sanction was appropriate.

ILS – Plaintiff eDiscovery Experts