How to Sleuth Smart: The Do’s & Don’ts of Computer Forensics in Litigation

It’s safe to say we probably all have things on our phones we wouldn’t want to see on a big-screen projector as we sit on the witness stand.

Nearly three-quarters of smartphone users report being within five feet of their phones most of the time, with 12 percent admitting that they even use their phones in the shower. What happens when a person’s life behind the lock screen becomes part of litigation?

Mobile phones and laptops have changed the way the world does business. Nowhere is this more evident than in the legal field. What used to require hours of searching through dusty tomes can now be done in minutes with an efficient Westlaw or LexisNexis search.  The Leaning Towers of Paperwork which were ubiquitous in law offices of old are slowly being replaced by a slightly less overwhelming email inbox.  Through the use of all digital devices in the world, humans create more than 2.5 quintillion (18 zeros) bytes of data every day. This includes roughly 145 billion email messages. Ninety percent of the data in the world today was created in the last two years. It could only be beneficial to a case to be able to access all that information, right? The use of computer forensics in litigation is a Pandora’s Box filled with both the promise of smoking guns for competent counsel and lurking landmines for the unwary attorney.

Digital forensics is the process of uncovering and interpreting electronic data. The goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying, and validating the digital information for the purpose of reconstructing past events. The limiting principles that lawyers (and forensic examiners) must appreciate are found in laws that prohibit wiretapping, computer abuse, and eavesdropping, and protect privacy rights, as well as in the ethical first principle that lawyers may not engage in, or enable clients to engage in, criminal or fraudulent activity. So how does a lawyer use computer forensics in the most beneficial way possible while still coloring within the criminal and ethical lines?

The Do’s

1. Decide early. If you know from the beginning of a case that there is likely to be relevant evidence on the opposing party’s smartphone, laptop, or tablet—for instance in a divorce or employment case—it is critical to act quickly. Early requests for such information—and directives to preserve such evidence—are essential given the risk of files being overwritten or deleted or altered by normal operation of the device, not to mention the potential for intentional destruction. The lifespan of a smartphone may end well before a lawsuit starts.

2. Bring in the professionals. Computer forensics is no amateur’s game, particularly when the end goal is to use the information in legal proceedings. A misstep in the process can result in exclusion of the evidence under Constitutional or statutory grounds. Hiring a professional is a necessary expense if digital data is important to your case.

3. Leave it as you found it. The first step in digital forensics is to make an exact image of the digital information extant on the device—a virtual snapshot that leaves intact on the device the original data and metadata. The forensic examiner’s oath is to do no harm, to leave the device “as is” and only apply data extraction software to the forensic duplicate image—never to the original data.

The Don’ts

1. Don’t waste your resources. Frankly, computer forensics is not cheap. If your case does not involve facts which could be bolstered by discovery of electronic data, it is likely a waste of your client’s time and money to go down the e-discovery path. Even if there may be relevant information in the opposing party’s devices, a cost-benefit analysis should be completed. If it is a $5,000 case, the average pricetag of forensics ($5,000-15,000) is out of proportion to the potential benefit.

2. Don’t hit delete. As mentioned earlier, preservation letters are essential in cases involving e-discovery. Have a frank conversation with your client at the beginning of a case to relay the importance of keeping tabs on relevant information, and certainly to remind them of their duty not to purposely destroy evidence. Not only is it an ethical obligation, but with advances in forensic technology, deleted information is still likely to be found—it’s just not worth the risk.

3. Don’t cross that line. The Wiretap, Stored Communications, and Computer Fraud and Abuse Acts are just a few examples of the myriad restraints on pursuing discoverable information via electronic means. Having professionals handle the details is the first step to avoid being on the wrong side of these laws, but it is important to have a general understanding of the boundaries as well. Attending a CLE on e-discovery should be on every litigator’s list, as well as doing some basic internet research. An American Bar Association article, quoted in this blog, has more great information: Forensic Examination of Digital Devices in Civil Litigation: The Legal, Ethical and Technical Traps.

Computer forensics can make or break a trial, but it is just like any other tool—knowing when and how to use it is key. If you’d like more information, contact the Goosmann Law Firm, with offices in Omaha, Sioux City, and Sioux Falls.