Computer Forensics and Spoliation of Evidence

computer forensicsComputer Forensics and Spoliation of Evidence.

In law, spoliation of evidence is the intentional or negligent withholding, hiding, alteration or destruction of evidence relevant to a legal proceeding. It is a criminal act in the United States under Federal and most State law. Spoliation has two consequences: first the act is criminal by statute and may result in fines and incarceration for the parties who engaged in the spoliation, secondly case law has established that proceedings which might have been altered by the spoliation may be interpreted under a “spoliation inference”. The spoliation inference is a negative evidentiary inference that a judge can draw from a party’s destruction of a document or item that is relevant to an ongoing or reasonably foreseeable civil or criminal proceeding: The judge can review all evidence uncovered in as strong a light as possible against the spoliator and in favor of the opposing party.

The theory of the spoliation inference is that when a party destroys evidence, it may be reasonable to infer that the party had “consciousness of guilt” or other motivation to avoid the evidence. Therefore, the fact finder may conclude that the evidence would have been unfavorable to the spoliator. Some jurisdictions have recognized a spoliation tort action, which allows the victim of destruction of evidence to file a separate tort action against a spoliator.

For corporate America, this poses some real problems. Most organizations are not involved in litigation on a frequent basis so when it occurs, discovery can be a strange process which leaves many managers doing their best to guess what information to secure and how to secure it. This is particularly true when it comes to electronic information. An order to preserve electronic evidence may arrive that is very broad, leaving everyone guessing exactly what to do to adhere to the order and still do your jobs. Lots of guessing occurs, some errors may come with it. In this type of environment, unintentional spoliation can easily occur and the results can be devastating to your company.

Yes, unintentional acts and oversights by good, hard working employees can result in the loss of evidence, which can be interpreted as spoliation by a judge. Use the old adage that ignorance of the law does not excuse you from breaking it. This problem is not limited to small companies with low skill work forces, large businesses full of scientists and engineers fall victim to the same threats.

In the digital “internet of things” era, the best way to protect your organization from the risks of spoliation is to have a computer forensic investigator assist in preserving your electronic data and letting your employees get back to work. This expert will literally make an exact duplicate copy of your data that can then be used in the court proceedings.

Computer forensics can be performed in a very short amount of time, will have no impact on your computer systems and leaves nothing to chance in terms of spoliation. In most states, computer forensics must be performed by an internal employee trained in proper evidence collection practices and equipped with court recognized computer forensics software. If your organization does not have an internal department that provides this type of evidence collection, you will need to look outside the organization to a private investigator trained to perform the computer forensic evidence collection.

This evidence collection activity is not where computer forensics stops. In some cases, the forensically sound copy of your data is examined deeply to look for documents and records that can help resolve the dispute.

For more information on how to prepare your organization to react quickly and appropriately when litigation occurs, please call us and speak with our computer forensics director at 888.677.9700 or write us at