$5.2 Million Default Judgment for Spoliation — Defragging Computer as Evidence of Spoliation when Done in Conjunction with Use of “Window Washer” Program — Absence of Metadata and of Documents as Probative of Spoliation
From Southern N.E. Tel. Co. v. Global Naps, Inc., 2008 U.S. Dist. LEXIS 49061 (D. Conn. June 26, 2008):
In order to determine what, or how many files, have been deleted, LECG [plaintiff’s forensic expert] relies on "metadata." ... Metadata is a record created for all files containing their name, the date, and where the data is stored on the disk, among other things.... Metadata is stored in a database called a Master File Table ("MFT").... Generally, a deleted file maintains its metadata, so it is possible to determine some things about the deleted file even after it has been erased.... However, when a deleted file has no metadata, "it is likely that anti-forensics software has been employed by the user to erase the file and clear the MFT data." ,,,LECG determined that, out of 93,560 items in the MFT, nearly 20,000 had no metadata, meaning they had likely been erased using anti-forensic software such as Window Washer's Shred utility.... At least 103 of these files were "user created files," that is, "substantive files created by a user as opposed to a computer generated record." ... Window Washer was uninstalled from Lima's computer the night of June 20, 2007.... The "Disk Defragmenter" utility was used on Lima's computer on June 25, 2007.... While the Disk Defragmenter can be used to improve the computer's performance, it also makes forensic analysis of a computer more difficult when files have been deleted.... This was the first and only time the Disk Defragmenter was used on Lima's computer.***
Even if one accepts the suggestion that it was not until SNET filed its Motion to Amend (Doc. No. 192) on June 30, 2006, that the veil piercing defendants would have been on notice to preserve documents, it is completely implausible that absolutely no documents existed, on that date, that predated June 30, 2006. And yet, defendants have produced merely a few such documents. ***
The court finds that the deletion of files in this case was done in bad faith. Defendants argue that Lima's use of Window Washer is "regrettable" but excusable, because she merely wanted to protect her personal information.... The court finds this explanation entirely incredible. First, the court credits SNET's expert report, which found that Lima did not merely use Window Washer in its default mode, which "empties the Recycle Bin, clears the Internet browsing history and cookie files, clears certain temporary folders, and clears the Recent Documents history." ... Instead, she deliberately chose to use the "wash with bleach" option to permanently delete and overwrite files that clearly did not contain her personal information, including files named "2000 Sales Journal, "NH check Jan thru May 06," "checkregisterNH7-12-2006", and "cashrecINC7-12-2006".... Even if Lima intended only to erase her personal information, which the court does not find to be the case, her actions would be at the least grossly negligent given that the court had ordered discovery of defendant's bookkeeping records and Lima had been specifically told not to destroy any records starting at the beginning of this litigation.... "Grossly negligent failure to obey a discovery order may justify severe disciplinary measures," even dismissal under Rule 37. Penthouse, 663 F.2d at 387. Furthermore, the court finds that the "shredding" feature of Window Washer was used on June 16, 2007 and June 20, 2007. Given that the shredding utility requires that a user confirm his or her intent to shred files, as described above, permanently destroying files using this utility can only be described as willful. Because the computer was in the possession and control of the defendants at all times, the conclusion that this program was used intentionally to destroy files that should have been preserved is inescapable. Such a conclusion is bolstered by the fact that the computer's Disk Defragmenter was run, for the first and only time, on June 25, 2007. While defendants urge that this program was used to improve the computer's performance, ... the court does not credit this explanation in light of the earlier deletion of files, and given that the program makes forensic discovery of deleted files more difficult. ... In light of the fact that a shredding utility had been used to permanently delete files only days before, the timing of the use of the Disk Defragmenter only corroborates the court's conclusion that defendants had willfully destroyed evidence and then attempted to conceal their actions.
Held: “The Clerk is ordered to enter judgment in favor of the plaintiff on all other claims and against the defendants, jointly and severely, in the amount of $5,247,781.45. (The Judgment should also include the award of fees and costs of $645,760.41 see Doc. No. 757.)”
Share this article: