The first spoliation case of its kind is almost a decade old…. But there are still lessons to be learned from it. The case is known as the "Arista Records, Inc. v. Sakfield Holding Co" case. While this case may not mean much to some, it is a well-known case in the digital forensics world because it brings up an interesting point: What happens when the data you are looking for is gone?
In this case, the plaintiff sued the defendant for conspiracy to engage in unlawful acts. Specifically, the defendant operated a website that allowed users to download music free, which was owned by the plaintiffs’ clients. During the case the plaintiff sent their expert to examine the servers in question, what they found was interesting to say the least.
The plaintiffs’ expert discovered that the majority of information that was stored on the defendants’ servers had been intentionally destroyed, and all after the case had been filed. It was determined that an unknown person had logged on at least 50 times to accomplish this task. What did the defendant say to this? They asserted that they had in fact committed the act of wiping the server, and did so to “preclude further transmissions of copyrighted music.” Eventually, it was acknowledged by the defendant that they could have simply shut down the website, rather than destroying evidence that was known to the defendant as being important to the case. Even with all of this, the forensic expert was still able to recover some information and was able to make the determination that they sought.
The point is this: there is no excuse for destroying evidence, even if you think your intentions are good. The law regarding this is very clear on this matter “While a litigant is under no duty to keep or retain every document in its possession once a complaint is filed, it is under a duty to preserve what it knows, or reasonably should know, is relevant in the action, is reasonably calculated to lead to the discovery of admissible evidence, is reasonably likely to be requested during discovery, and/or is the subject of a pending discovery request.”
The court found in favor of the plaintiff and a motion to appeal was denied, showing us that the courts do not take kindly to this type of behavior.
Evidence of use of a wiping software can be readily apparent to a trained digital forensic examiner, and while it may not be the answer that you are looking for, it may help you and your client to get the result they deserve.
(Sakfield Holding Company, S.L. is a Spanish Company, organized under Spanish law, and located in Madrid, Spain)
(Arista Records, Inc. was a United States Company owned by RCA, headquartered in New York, NY)
