Despite “Wiping Software,” Metadata and Other Forensic Artifacts May Remain
In the cases discussed in our prior blogs this week, “wiping software” had been used by parties in an attempt to delete what is likely adverse information on personal and work computers. As expert computer forensics continually improves, it has become more likely that deleted files and metadata can, in fact, be recovered despite such programs.
In an order dated August 1, 2013 in Barrette Outdoor Living, Inc. v. Michigan Resin Representatives, 2013 WL 3983230 (E.D. Mich), plaintiff sued defendants for various tortious actions, including an alleged theft of $400,000. One defendant worked for plaintiff, and plaintiff alleged he deleted files from his work computer, discarded his cell phone and used wiping or “scrubbing” software to delete over 270,000 files from his personal computer.
Plaintiff’s computer forensics expert was ordered to analyze the computers in question. The expert noted that despite running two separate wiping software programs, he was able to uncover 36 deleted files on defendant’s work computer, some of which revealed relevant information about the missing $400,000. On his personal laptop, despite using two separate wiping software packages, the forensic investigator was still able to find pieces of incriminating and relevant files.
As sanctions for spoliation, the defendant was ordered to pay plaintiff $25,000 for the costs of bringing the spoliation motion, $10,000 for the increased expenses to conduct discovery and the entry of a irrefutable (i.e. mandatory, not merely permissive) adverse inference instruction that the missing information was unfavorable to the defendant.