If metadata can be such important evidence, Part II and Part III, you’re probably wondering: Hasn’t someone figured out a way to destroy it? The answer is that there are products designed to do just that – and the company or person who uses them is paving their own road to sanctions. As an employer, you need to be aware of these tools. You need to know what to tell your employees not to do. If an adversary uses such a tool, you need to know how to respond.
DriveScrubber, CCleaner and Eraser are just a few of the commercially-available products designed to eliminate electronic files and the metadata that tells the story behind those files. These products do not simply delete files. In technical terms, these products overwrite unallocated space. In so doing, they overwrite deleted files. When that happens, the product has destroyed not only evidence of the existence of the files and their contents, but also other key information, including the fact that they were deleted. Once one of these products has been used, even forensic imaging cannot reveal a document that has been deleted. That’s their intended result. They erase evidence of the deletion of files. In a litigation context, they are evidence elimination tools.
In our $20-million-plus theft-of-trade-secrets case, Part III, the defendant used Eraser and CCleaner to “scrub” its server and several computers days (and in one instance hours) before their court-ordered imaging and after receiving a “litigation hold” letter. Our expert explained the difference between merely deleting a file and running one of these evidence elimination tools:
[W]hile the deleted files become invisible to the ordinary user, the underlying technical reality is that the files remain undisturbed on disk; the space they occupy is simply marked as available for rewriting should some future file require it. It is for the reason that a forensic examiner using specialized tools can recover the content of the supposedly deleted files….This recoverable content may become lost even to the forensic examiner, however, for several reasons….Users may obtain and run evidence elimination tools that include a feature to “wipe” or “scrub” a disk’s unallocated space, deliberately overwriting any deleted-but-still recoverable files with nonsense characters or zeros so that the files can no longer be recovered. Such tools are inexpensive and easy to find…They include CCleaner, Eraser, File Shredder, DriveScrubber, and others.
It’s important to understand what these tools do not do. They are not designed to improve the performance of a computer or server. Nor do they increase the speed of your device. In a litigation context, there is no legitimate reason to use one of these tools. Defendant’s outside IT consultant admitted this in response to the question of “why a customer or a client would want to” run Eraser, the consultant responded: “It doesn’t make a lot of sense to me.”
Why do you need to know this?If you or anyone who works for you ever is tempted to use one of these tools when litigation is pending, threatened or otherwise anticipated: stop. Think. Then think again. Call your lawyer to let him/her talk you out of it. Why? If you’re in or anticipating litigation, you should be preserving arguably relevant information as it was stored during the ordinary course of business. These tools don’t preserve – they destroy.
When might you be tempted to use one of these tools? Perhaps a departing employee has returned a laptop that has files that may be discoverable and you want to wipe or reformat that laptop for use by another employee. There the objective is to preserve data for possible later production while removing it from its original device. Or perhaps a company device contains a file that you want to remove, because it’s a file that a new employee brought from a former employer. The objective there is to remove data from access to employees while preserving it in case you ever need to show exactly what you received. In either scenario, you probably can accomplish your objective – cleaning the laptop, removing the file – by merely imaging the computer’s hard drive then deleting the files from the original device. These tools – which not only delete the files but also make them forensically unrecoverable – almost surely are unnecessary. If you have any reason to believe that you need to use these tools, you should first consult counsel.
From the other perspective, if a competitor, a departing employee or an adversary in litigation has used such a tool to destroy evidence relevant to your business or to your litigation claim or defense, you need to know how to respond. A forensic examiner may be able to determine what tool was used, when it was used and possibly who used it. (Our expert was). Although you may not be able to recover the files that were deleted, you’ll be able to draw inferences galore that may be equally helpful.
In our case, the defendant’s own expert drew a “negative inference” from defendant’s use of these tools. The judge drew more than that:
The court has rarely, if ever in a civil matter, witnessed a party engage in such flagrant misconduct and act with such complete disregard for the truth and such profound disrespect for the law. This court finds that [defendant’s COO] installed and ran CCleaner with the intent to delete any evidence that [defendant] had misappropriated [our client’s] trade secrets and proprietary and confidential information and also to conceal [defendant’s] efforts to delete relevant and material evidence of its misconduct.
This finding was among the grounds that the judge relied on to award sanctions against defendant for millions of dollars in attorney’s fees and litigation expenses.
In this and the preceding three posts, we’ve attempted to address the basics of metadata in a litigation context and to explain why employers need to be aware of its potential use in anticipating and engaging in litigation, offensively and defensively.
In the near future, we’ll address what you need to know about electronic storage devices in the context of litigation or pre-litigation disputes about employee theft of trade secrets.