Imaging someone’s computer or cell phone used to be an exceptional ask. But with changes in technologies and sharp reductions in costs to image these sources, computers and cell phones are increasingly the most important and commonly sought sources of discovery. Forensic discovery refers to not only the collection of relevant electronically stored information but also more specifically to the creation of a mirror image of the source to preserve relevant metadata and normally inaccessible files and history found on a source.
Forensic discovery, however, carries unique risks and considerations. It is often valuable because of the relationship and arrangement of data found on the source, as well as metadata related to files on the source. That data can be inadvertently altered or overwritten by accessing the source or by continuing to use the source. For example, an attorney who reviews or copies files from a USB drive will reset the “last accessed” date for files on the USB drive and, in doing so, may cause critical evidence about when certain files were accessed to be irreversibly altered and potentially lead to spoliation.
Attorneys can avoid losing critical data and allegations of spoliation by recognizing the unique fragility of forensic data and taking measures to preserve that data when it may be relevant. First, counsel should incorporate a discussion about whether preserving forensic data may be necessary as part of the initial fact investigation and tailor the scope of any issued litigation hold to include sources identified by the client.