As an employee walks out the door from a discordant situation for the last time, most employers unwittingly lose their best opportunity to preserve potential evidence. Counsel should routinely advise their employer clients to "buy" inexpensive insurance in the form of data preservation if there is any possibility of future legal action.

Typical E-Discovery Can Destroy or Ignore Evidence

My impression of electronic discovery is that a thorough data analysis is not attempted until after some electronically stored information (ESI) evidence has been lost or destroyed, especially in employer-employee situations. This destruction of evidence is inadvertent and is generally from naivete or lack of training rather than malicious intent.

In one case, an employer turned the laptop over to another employee for several months for his use in support of business before deciding it might hold important information, causing many deleted files to be overwritten and rendered unrecoverable. In another case, the employer reacted immediately, but asked its IT contractor with no forensic training to recover whatever files they could, again causing loss of important information.

Furthermore, typical e-discovery overlooks useful information entirely. In a recent case, the first attempt at e-discovery produced little useful information. However, digital forensic techniques then produced a plethora of relevant emails and other files.

A Windows Primer for Discovery Lawyers

Windows keeps track of virtually everything a computer user does so it can respond faster the next time a similar operation occurs. Think of it as leaving a trail of bread crumbs so Windows can find its way more quickly in the future.

In addition to recovering deleted files, most of the following can usually be found from these "bread crumbs" with the proper tools: