An Electronic Discovery Blog covering News, Articles
and Thoughts for the Legal and Corporate Community Author: Alexander H. Lubarsky, LL.M., Esq. - firstname.lastname@example.org - Tel. (415) 533-4166 OR 800-375-4222 THIS BLAWG IS NOT AFFILIATED WITH THE WEB SITES WWW.DISCOVERYRESOURCES.ORG OR WWW.DISCOVERYRESOURCES.COM
Tuesday, May 25, 2004
Gettin' FAT (05.25.04) Just got out of the documentary, "Supersize Me" and I am now repenting for every Big Mac and Happy Meal I have consumed over the past three decades. I'm ordering a fruit salad for lunch tomorrow.
Speaking of getting fat, I am still catching wind of that old wife's tale which maintains that a deleted file will not later haunt litigation.
Those that still hold on to this erroneous theory need a calorie intake. They gotta get FAT.
A deleted file still lives on your hard drive, it just gets kidnapped and stowed away in a dark, hidden place. A seasoned crime scene analyst can usually survey the scene of the crime and then unearth the victim from its shallow grave.
In fact, this forensic truism has been transitioned into legal authority. The court in State v. Townsend, 57 P.3d 255 (2002) opined that counsel has a duty to grasp the fundamentals of "deleted" electronic evidence and should instruct its clients to retrieve that which is germane or "go after" such "deleted" data from the opposition.
So where does the so called deleted document get stashed? The answer lies within the File Allocation Table (FAT) which maintains links to all electronic records produced on a computer be they deleted or not. Hard drive disks are separated into unique sectors and surfaces. A deleted document can be chopped up and its remains distributed to various parts of the disk. Only the FAT can provide the treasure map needed to collect the pieces and sit down at the jigsaw table.
A trained forensics or EDD consultant can help you get FAT without stuffing you with chicken McNuggets.
What about metadata? Not to worry, these informational nuggets (sans the honey-mustard sauce) which can reveal modifications, revisions, bcc recipients, page counts, directory structure, author, custodians etc... get moved along with the corpse of the deleted data. These fundamentals are unearthed along with the so called deleted document. It's like unearthing King Tut AND his golden sarcophagus.
What if the other guys don't want you digging in their grave yard? There is a wealth of case law that can help you support a motion to compel FAT data. Also, FRCP Rule 34(a)(2) authorizing on-site inspections can often pave the way for the discoverability of documents that a computer user thought were deleted. Rule 33 interrogs and Rule 30(b)(6) can also unearth the hidden gems.
So next time someone tells you it has been deleted, tell 'em that this is not time for a diet. Ask for the FAT files and while you are at it, go ahead and supersize it.
posted by Alexander | 8:38 PM