The October 15, 2008 Magistrate Judge's Report and Recommendation, which in early December was approved by the District Court Judge (together with an "Order to Show Cause" why the spoliating party should not be referred to the U.S. Attorney's office for possible criminal violations) provides a good "what not to do" list for digital evidence management. One takeaway for enterprise: Employers can't evade obligations to preserve by keeping employees ignorant. The potential for evidence mismanagement suggests that it is a good idea to involve the CSO/CISO early in litigation, and even in litigation planning.

In the decision in Gutman v Klein , 2008 WL 4682208 (EDNY Ocrtober 15, 2008) the United States Magistrate Judge recommended the imposition of terminating sanctions for spoliation. That means the spoliating party forfeits the right to have his day in court. The Court's decision was based on the (largely uncontroverted or otherwise poorly opposed) findings of the forensic examiner: 

• Tampering with Computer

• Backdating files

• Backdating system clock

• Backdating of OS installation date

• Gaps in time synch between system clock and external MS time server

• Use of wiping programs after litigation commenced

• Unrecoverable file deletion

• 6639 folders bore same create date

• Uncorrorborated testimony about "stolen" laptop

Pertinent excerpts: 

• "Under such exceptional circumstances, the only appropriate non-monetary sanction is a default judgment in plaintiffs' favor, pursuant to Federal Rule of Civil Procedure 37(b)(2)(A)(vi) and the court's inherent powers."

• "First, lesser sanctions would not adequately deter misconduct of this severity."

• "Second, the most serious forms of spoliation merit the harshest sanctions,and in this case, the destruction of evidence was of the worst sort: intentional, thoroughgoing, and (unsuccessfully) concealed."

• "Finally, the lesser sanction of an adverse inference would not "restor[e] the prejudiced part[ies] to the same position they would have been in absent wrongful destruction of evidence by the opposing party." 

SWT