Although no major e-data decisions to date have been decided by bankruptcy courts, the role of e-data evidence in bankruptcy litigation will become increasingly important. Recently, two former Ernst & Young managers were charged with accounting fraud relating to the NextCard Inc. bankruptcy.¹ The accountants, who audited NextCard's books, are alleged to have destroyed and altered portions of NextCard's 2000 and 2001 financials in order to hide losses and make it look as if all documents were the product of a clean audit.²

Whenever possible, discovery of relevant e-data will be conducted by mutual agreement of the parties. At the §341 meeting of creditors, or informally beforehand, creditors' counsel can ask the debtor to identify computers, servers and laptops that may contain the books and records and other important financial information. If the corporate debtor's representative does not know this information, creditors can request a continuation of the §341 meeting in order for the debtor to produce the necessary individuals who can answer these questions. Creditors' counsel should ask the debtor to allow its digital forensic accounting expert to conduct a preliminary and practicable examination of relevant computers and hard drives, at a time and in a manner that minimizes inconvenience to the debtor. One of the biggest benefits of voluntary e-discovery is that the debtor will be substantially less inconvenienced. It is more difficult for debtor's counsel to complain later about the cost of discovery when the debtor always had the alternative to comply with the creditors' initial requests. To the extent that the creditors and debtor (and insiders) work together to allow creditors to obtain the digital financial data they seek, the parties will save on the time and costs involved in formal discovery.

Much information may be gained from these informal efforts. For example, if accounting reports, financial statements, financial spreadsheets, memos, and e-mail and related attached files are shown to have been deleted, the creditors may infer that the debtor is determined to hide information. On the other hand, if no deletions of any documents are found on an hard disk drive (HDD), it is probably because the deleted files were recently wiped clean, and then some documents added to make things appear normal. This is because at least some deletions of e-mail and older files is routine. However, if the debtor allows the creditor's digital forensic accounting technologist relatively open access to its computers, servers, employees and insiders' laptops and is forthcoming in its responses for information, the creditors will be reassured by the debtor's e-transparency and conclude that the debtor and its employees and insiders have nothing to hide. Thereby, all parties will save time and money.

If, on the other hand, the debtor and insiders unreasonably refuse to engage in informal discovery, if their answers are vague or inconsistent, or if they allow access to some e-data and hardware but not to others, then creditors may reach the conclusion that insiders have something to hide. This should raise a red flag and indicate to counsel that they need to engage in prompt and aggressive discovery.

Electronic Data Retrieval Under the Bankruptcy Rules and the Federal Rules of Civil Procedure

If the parties do not agree on voluntary discovery, creditors may need to resort to litigation. The discovery and use of e-data in bankruptcy litigation is governed by the Federal Bankruptcy Rules and by the underlying Federal Rules of Civil Procedure. The Advisory Committee Notes to Federal Rule 34 states that the discovery of documents applies to "electronic data compilations from which information can be obtained only with the use of detection devices...." Numerous court cases have visited the issue of how e-data may be obtained in an adversarial proceeding, but the newness of e-data, and the explosive growth of digital technology, has forced the courts to play catch-up.³

In chapter 7 cases, the discovery of digital data is relatively simple. The hardware, software and all data, including the books and records, contained on the debtor's computers and other devices is property of the estate under Bankruptcy Code §§542(a) and (e). Similarly, if a trustee has been appointed in a chapter 11 case, the trustee may demand access to all of the debtor's computer and digital devices, information and data storage facilities.⁴ Under §521(4) of the Code, the debtor must surrender to the trustee "all property of the estate and any recorded information, including books, documents, records and papers relating to the property of the estate...." The trustee can then arrange for forensic images to be made and mined for relevant information.

In either a chapter 7 or chapter 11, creditor's counsel should be immediately concerned if the debtor has leased its computers and digital devices and then suddenly decides to reject the leases and return the equipment. Creditor's counsel will want to promptly file an objection and conduct e-discovery.

Discovery in a chapter 11 adversarial proceeding is similar to litigation in the federal district court and is governed by the same rules. Under Fed. R.C.P. 26(b)(1), information is discoverable if it is "relevant to the claim or defense of any party," or if it "appears reasonably calculated to lead to the discovery of admissible evidence." The initial disclosures under Rule 26(a)(1)(B) require a party to disclose, without waiting for a discovery request, a copy of, or a description by category and location of, all documents, data compilations and tangible things that are in the possession, custody or control of the party and that the disclosing party may use to support its claims or defenses unless solely for impeachment.

Despite the fact that almost all businesses now keep books and records in digital form, rules of discovery have been slow to adopt formal means of dealing with e-discovery. Recently, New Jersey adopted local rules requiring initial disclosure of computer-based evidence. New Jersey Local Civil Rule 26.1(d)(1) requires counsel to review with the client the client's "information management systems, including computer-based and other digital systems, in order to understand how information is stored and how it can be retrieved." In other words, counsel has to become baseline proficient regarding a client's information systems. Rule 26.1(d)(1) further requires counsel to determine and locate active, backup or archival files and other digital evidence that may be used to support the client's claims or defenses, and to disclose this information to the opposing side as part of its Rule 26(a)(1) initial disclosure. A litigant must disclose at the Rule 26(f) meeting whether it is likely to request or produce computer-based or digital information, and identify as clearly as possible the categories of information to be sought. The party may supplement its request for computer information upon obtaining new information relating to digital evidence. New Jersey Local Rule 26.1 also requires that at the Rule 26(f) meeting the parties include in their discussions the preservation and production of e-data, procedures dealing with the inadvertent production of privileged information, whether restoration of deleted e-data may be necessary, back-up information, and the media, format and procedures for producing digital information, as well as cost allocation for preservation, production and restoration, if necessary, of digital discovery.

Even in jurisdictions that have not formally adopted e-discovery rules, the same duties and privileges that apply to discovery of paper documents and other tangible evidence applies in principal to e-data and hardware. However, the particular and ever-changing nature of e-data technology has required courts to be creative and analytical in order to adapt discovery rules to the realities of information technology.

Duty to Preserve E-evidence

Parties have an obligation to preserve evidence that is potentially discoverable in litigation.⁵ In most jurisdictions, this duty arises when the party knows or should know of the potential litigation.⁶ After taking full advantage of the opportunity to ask questions at the §341 meeting and any continuation thereof, lenders and creditors in litigation against debtors and insiders should consider making special arrangements for discovery of e-data in the Rule 26(f) conference and Rule 16(b) scheduling conference.⁷

Digital evidence may deteriorate through use or modification, be overwritten, or lost over time due to e-mail and file-deletion policies. Of course, debtors and insiders may also try to intentionally delete e-data. Generally, a party on notice to preserve documents must take steps to protect data that may be lost in the ordinary course of business,⁸ including notifying employees to retain records.⁹ Of course, a party will be subject to severe sanctions for deliberate destruction of e-data.¹⁰ However, destruction or deletion of documents in the ordinary course of business pursuant to a reasonable records retention policy is not sanctionable.¹¹ Regardless, the deletion of the debtor's digital books and records and related documents, including audit work-papers and financial statements, should never be considered the ordinary thing to do. Thus, counsel should file a motion to prevent spoilage of digital evidence early in the case. This motion may be brought under Rule 16 (c) (12) and (16) of the Federal Rules of Civil Procedure.¹² Counsel may first want to obtain expedited disclosure of the debtor's records to specifically identify computers, servers and laptops that may contain the books and records and other important financial information, software and other features of its e-data so that a motion for preservation can be properly formulated. Under Rule 26(d), the court may, for cause, allow expedited discovery.¹³ In exceptional cases, an ex parte TRO may be issued to prevent immediate destruction of computer evidence.¹⁴

Timing and Sequence of E-data Discovery

In order to conduct effective discovery of the debtor's e-data, counsel must first obtain as much information as possible about the debtor's computer systems. In some cases, an experienced e-sleuth will be able to formulate much of this information with minimal input from the responding party. In other cases, it will be necessary to supplement the e-sleuth information and propound interrogatories under Rule 33. Rule 33(b)(3) allows the court to shorten the time for responding to interrogatories. However, without at least some advance information about the debtor's systems, interrogatories might be incomplete or leave out some important information. Thus, creditor's counsel may need to take a deposition of the corporate debtor's computer personnel under Rule 30(b) in order to find out the types of computer systems, equipment, software, locations, back-up and deletion practices, and so on. Ideally, this deposition can be limited to 30 minutes or so and then adjourned, saving as much of the maximum seven hours allowed under Fed. R. Civ. P. Rule 30(d) as possible for that witness in the future, if necessary. Additionally, counsel can serve Rule 36 requests for admissions aimed at finding out whether the debtor has deleted files, uses encryption, stenography, has a second set of books, etc.

Discovery of the debtor's computer and digital information systems and practices should be followed up by an inspection of the debtor's computers and production of e-data under Rule 34. Although the statutory response time for a Rule 34 inspection is 30 days, under §34(b) the court may shorten this time. It is through the direct examination of the debtor's computer systems and digital devices that a forensic image will be made, and the incriminating e-data will be uncovered.

Objections to E-discovery

Evidentiary objections under Federal Rule 26(b) include relevancy, privilege, and undue burden, as well as prejudice.¹⁵ It has even been asserted that surrender of a debtor's computers and information may be a violation of the Fifth Amendment right against self-incrimination, although this claim has been rejected.¹⁶

Relevance and privilege. The difficulty in determining whether a legitimate objection exists is compounded by the vast amount of e-data that may be discovered. A discovery request must be relevant to a claim or defense, but with sometimes hundreds of thousands of pages of e-data, culling out irrelevant documents may be almost impossible. One solution is to establish a protocol of search terms that will capture relevant evidence and ignore irrelevant documents.¹⁷ A digital forensic accountant may use search protocols containing a thousand or more words to locate relevant documents and discard irrelevant ones. No debtor wants to produce, and no creditor wants to receive, millions of pages of irrelevant data.

E-data is also subject to the attorney/ client privilege and attorney work-product privilege.¹⁸ With so many documents potentially discoverable, debtor's counsel will want to avoid inadvertent disclosure, which could waive the privilege. This can be done in a variety of ways. In Simon Property Group L.P. v. mySimon Inc., 194 F.R.D. 639 (S.D. Ind. 2000), the court ruled that the plaintiff was entitled to attempt to recover deleted computer files from the defendant's programmers' computers, whether at work or at home. An expert who was selected and paid by the plaintiff, and approved by the court, made a mirror image of the defendants' hard drives. The expert, as an officer of the court and with all privileges intact, then inspected the files for relevant data under established protocol guidelines, which included word processing documents, e-mails, presentation files, etc., but excluded higher-level programming and software files. The expert produced a record, which was then reviewed by defendant's counsel for privilege and responsiveness before production of the files to the plaintiff. The expert, as well as any assistants, were obligated to full confidentiality, and the mirror-image copies were destroyed at the end of the litigation. Id. at 641-42. As a general rule, search terms and other search parameters can identify privileged documents to avoid inadvertent disclosure. Yet, despite the best efforts of the parties and the court, inadvertent disclosure of privileged documents can still occur. Recognizing the difficulty of maintaining privilege when so many documents must be produced, courts have adopted differing standards for determining whether inadvertent disclosure waives the privilege.¹⁹

Proportionality. Another potential objection to the discovery of e-data is proportionality, or the expense of producing e-data. The potential number of documents to be produced pursuant to a discovery request for e-data can be vast. Ordinarily, the party responding to a discovery request bears the cost of responding to the request. However, Fed.R.Civ.P. Rule 26(b)(2)(iii) allows a court to shift this burden to the requesting party if:

the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation and the importance of the proposed discovery in resolving the issues.

A number of cases have considered this issue and have reached different results. For example, some courts have held that the responding party is responsible for the complexity of its systems, and must bear the cost of e-data discovery.²⁰ Other courts use a multi-factor balancing test, such as the one used in Medtronic Sofamor Danek Inc. v. Michelson, et. al., 2003 U.S. Dist. LEXIS 8587 (W.D. Tenn. May 13, 2003). In Medtronic, a case involving alleged theft of medical technology, the defendant sought production of 996 computer network backup tapes containing some 61 terabytes of data, as well as 300 gigabytes of digital data from employee files that were not in backed-up format.²¹ This was an unusually large volume of data because Medtronic had a policy of backing up all of its data and not recycling or overwriting tapes. Significant costs were associated with the discovery, including the cost of restoring back-up tapes, costs of designing and conducting a search, and the cost of privilege review.²² This did not include any attorney fees for privilege review, which the court held must be borne by the responding party. Id. at *27.

In order to determine whether the e-discovery costs are "undue," the court in Medtronic applied an eight-factor balancing test, similar to the considerations set forth in Fed.R.Civ.P. 26(b)(2). The factors include (1) the specificity of the request, (2) the likelihood of discovering critical information, (3) the availability of such information from other sources, (4) the purpose for which the responding party maintains the requested data, (5) the relative benefit to the parties of obtaining the information, (6) the total cost associated with the production, (7) the relative ability of each party to control costs and (8) the resources available to each party. Id. at *11-*12.

Although it was clear that the information requested was not available from any other source, the plaintiff's discovery request was extremely broad. In addition, it was far from certain that the plaintiff would discover relevant evidence in all the documents it requested. Accordingly, the requesting party was ordered to pay most of the costs of document production. The court also appointed a neutral expert to oversee the document reproduction and advise the parties on technical matters.²³

Medtronic is an extreme case on its facts, and represents an overly broad production request by the party seeking discovery. The factors set forth in Medtronic, however, are likely to become widely accepted as the standard by which cost shifting in e-data discovery is determined. However, this should not pose a problem if creditor's counsel seeks the assistance of a digital forensic accounting technologist early in the case. The party seeking discovery of e-data documents can narrow the scope of discovery by the skillful use of preliminary interrogatories, informal questionnaires or depositions of the debtor's technical and financial personnel aimed at finding out which computers, servers and other digital devices are most likely to contain relevant e-data, and which employees, officers, directors or insiders (including auditors, lenders and vendors) are most likely to have created or used this information. Initial discovery will also provide clues as to which search terms, range of dates, file type, etc., are most likely to yield positive results. Again, lenders and creditors do not want endless reams of irrelevant information. In short, much can be done by the e-sleuth to minimize the burdens of e-data discovery, and to allow both parties the opportunity to develop e-facts in an efficient and cost-effective manner.

Conclusion

Law and business now operate in the brave new world of digital information technology. A debtor's books and records and related information in particular are the core of the debtor's business, and can reveal, if properly retrieved, key data and information that can lead to the recovery of hidden assets and provide valuable information relating to claims against the debtor's auditors, underwriters, board members, preferred shareholders, employees and insiders. All bankruptcy practitioners need to become loosely conversant in the ways and methods of discovery of digital financial data. Creditors' counsel in particular must be aware of the means by which information and assets can be discovered using digital forensic accounting technology. This does not mean that counsel should serve as his or her own computer expert. In the digital age, a qualified digital forensic accounting technologist is essential in the quest for hidden e-data. Without the proper knowledge, skills and a full array of digital forensic tools on your side, you are at a disadvantage against those debtors and insiders who will use the best of technology to hide assets and evade creditors. Bankruptcy counsel must know about this technology and be prepared to use it in appropriate cases on behalf of their clients.

Glossary

• Alternative Data Streams (ADS): The Microsoft NTFS file system permits ADS. ADS allows for the hiding of data within other files, folders and directories. Corporate servers, workstations and laptop computers use the NTFS file system with Windows NT,Windows 2000, Windows XP and Windows 2003 operating systems. Windows Explorer does not disclose the name(s) or file locations of ADS and Microsoft provides no tools for detecting the presence of ADS.
• Bit: Short for binary digit. A bit is the smallest unit of digital information and has a value of "ON" or "OFF." A bit is commonly said to be "set" if its value is 1, and "reset" if its value is 0.
• Byte: A byte is digital data that is equal to eight consecutive bits. The following represents byte size values: Kilobyte‹1,000 bytes, Megabyte‹1,000,000 bytes, Gigabyte‹1,000,000,000 bytes and Terabyte‹1,000,000,000,000 bytes.
• Back-up or archival systems: Numerous back-up and archival media systems exist. These include floppy disk, Zip disk, Jazz disk, CDs, DVDs, hard disk drives (including Flash Memory and USB and FireWire) and tape back-up systems, which are just a few examples of the various forms of media used to back up digital information. See "Hard disk drive", "Storage devices" and "Tape back-up systems" for additional information. *See endnote.
• CassiopeiaTM: A PDA device that is manufactured by Casio Inc. and based on the Microsoft Pocket PC. See "PDA" below for additional information. *See endnote.
• CD: Short for compact disc. The CD was originally developed for the music industry. CDs are read-only; typical use of CDs includes software application used for installation and/or use of computer programs.
• CD-R: This form of media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records, and back-up copies of computers and digital devices. Just one CD-R is capable of storing more data than 400 floppy disks. Once the data has been written to a CD-R, it cannot be changed.
• CD-RW: The use of CD-RW media allows data to be both written and deleted. This media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records and back-up copies of computers and digital devices. Just one CD-RW is capable of storing more data than 400 floppy disks. *See endnote.
• CLIÉTM: A PDA device manufactured by Sony and based on the Palm operating system. See "PDA" below for additional information. *See endnote.
• Cluster: The primary unit of allocation of a hard disk drive made up of one or more physical blocks. A file may consist of several non-contiguous clusters. The hard disk cluster size becomes a trade-off between efficiency and potentially wasted space found at the end of each file. *See endnote.
• CompactFlash Card: See "Flash Memory" below. *See endnote.
• Computer hard disk drives: See "Hard disk drive (HDD) below. *See endnote.
• Database: A database is structured data associated with proprietary software used for the update and query of the data. Many financial accounting applications and e-mail programs make use of database files. The following are a few examples of proprietary database programs used in business: Filemaker Pro, FoxPro, Informix, Ingress, MS Access, MS SQL Server, Oracle, Paradox, Progress and Sybase. *See endnote.
• Desktop computer: The desktop computer is used in the corporate setting and in homes. In business, it is the desktop computer that normally communicates with corporate servers and/or mainframe computers. The desktop computer may have an 80 to 200 gigabyte or larger hard disk drive (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and back-up copies of computers and digital devices for just one HDD. *See endnote.
• Digital devices: Today hundreds of digital devices are available, computers, printers, scanners, USB and FireWire devices, CD and DVD burners, Zip drives, MP3 players, cameras and a countless number of hard disk drives and memory devices. See "Hard disk drive" below for additional information. *See endnote.
• Digital forensic accounting technologist: A digital forensic accounting technologist provides specialized skills and experience to conduct an investigation into the digital books and records and financial affairs of businesses and individuals. Presenting financial information discovered on corporate computers, servers, hard disk drives, digital devices and back-up or archival systems appropriate to the situation understandably and concisely, and when necessary for final judicial determination, is the primary benefit of employing the digital forensic accounting technologist.
• Directory: A/k/a folders. A directory is used in a computers hierarchical file system and generally contains files (documents, spreadsheets, databases, e-mail, financial books, etc.) and/or subdirectories. For example, Windows Explorer will display the names of directories, sub-directories and files. *See endnote.
• Drives: Short for hard disk drive (HDD). See "Hard disk drives (HDD)" below. *See endnote.
• Drive slack space: Drive slack is created when additional sectors are needed for the last cluster being assigned to the file. *See endnote.
• DVD-R: This form of media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records, and back-up copies of computers and digital devices. Just one DVD-R is capable of storing more data than 3,200 floppy disks or seven CD-R. Once the data has been written to a DVD-R, it cannot be changed.
• DVD+RW and DVD-RW: Both forms of media allow data to be written and deleted. This media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records and back-up copies of computers and digital devices. Just one of these DVDs is capable of storing more data than 3,200 floppy disks or seven CD-RW. *See endnote.
• EIDE HDD: EIDE is short for Enhanced Integrated Drive Electronics. EIDE standards have evolved over the years for hard disk drives. This type of HDD is typically used in desktop, tower, mini-tower, workstations and laptops. EIDE HDDs may have 80 to 200 Gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). See "Hard disk drive" below for additional information. *See endnote.
• E-mail: Email has changed the way we communicate. Today e-mail has replaced traditional letters and telephone calls as the most dominant method of correspondence. *See endnote.
• Encrypted e-data: Any process used in cryptography to convert files, documents, e-mail, instant messages and books and records etc. into cipher information to prevent reading that data. There are two classes of encryption: public-key and private-key cryptography. See "Steganography" below. *See endnote.
• External hard disk drive: A computer hard disk drive that has been placed within a plastic or metal container enabling easy removal and/or for attachment to other computers or digital devices. This device may use communications protocol such as USB, FireWire or other methods to record and transfer data. External hard disk drives may have 80 to 200 gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). See "Hard disk drive" below for additional information. *See endnote.
• File slack space: Computer files are created in changing lengths depending on their size; it is seldom that the file size will match the available cluster size. The space that exists from the end of the file to the end of the last cluster is called "file slack" space. *See endnote.
• File system: A/k/a filesystem. A system of rules for organizing directories (folders), subdirectories and files, generally in terms of how the file allocation table is applied in the disk operating system. The file system is integral to the computer operating system. *See endnote.
• FireWire hard disk drives (FW HDD): A/k/a IEEE1394 (and used with HDD), this interface standard offers high-speed communications for the transfer of data. The FW HDD has become common for small businesses and individuals. A business having a few users on a network may back up the server and workstations using this type of device. FW HDD may contain financial books and records, documents, spreadsheets, e-mail, instant messages and backup copies of computers and digital devices. FW HDD may have 80 to 200 gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). See "Hard disk drive" below for additional information. *See endnote.
• Flash Memory (FM): FM is digital memory and is provided in a variety of forms. FM is primarily used as a hard disk drive for information storage in PDAs, MP3 players and digital devices. FM is small and allows for faster access to digital data. No data is lost when FM is turned off. A few examples of the forms of FM include CompactFlashTM, SecureDigitalTM, MicrodriveTM, SmartMediaTM, Memory StickTM and MultiMediaTM. The downside to FM is that it is more expensive per megabyte than a hard disk drive. *See endnote.
• Floppy disk (FD): A/k/a diskette. The FD is a 3 1/2" inch small plastic disk used for storing computer data and readable by a computer with a floppy disk drive (internal and external). *See endnote.
• Folder: A/k/a directory. See "Directory" found above. *See endnote.
• Forensic image: A/k/a low-level bit stream image. The forensic image is always physically identical to the original hard disk drive, flash memory device or other digital device.
• Handspring TreoTM: A PDA that is based on the Palm operating system. See "PDA" below for additional information. *See endnote.
• Hard disk drive (HDD): A/k/a hard drive, or disk drive. Practically every computer and server contains one or more HDD. An HDD is designed to read and write digital data and allows for the storage and retrieval of this information. Today's desktops, towers and workstations may have 80 to 200 gigabyte larger HDDs (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and backup copies of computers and digital devices for just one HDD. See "Byte" above for listing of different size values. *See endnote.
• Hard drive: Short for "Hard disk drive." See "Hard disk drive" above. *See endnote.
• HDD: Acronym for "Hard disk drive." See "Hard disk drive" above. *See endnote.
• Instant messaging (IM): IM provides instant contact with Internet/Intranet users. IM service is available to anyone using ICQ. IM is used in both corporate and personal computer environments. Two popular IM services are offered by AOL and MSN. IM has changed the way we communicate and has replaced letters and telephone calls. *See endnote.
• iPaqTM: The iPaq PDA is manufactured by HP/Compaq and based on the Microsoft Pocket PC. See "PDA" below for additional information. *See endnote.
• JornadaTM: The Jornada is manufactured by HP and uses Microsoft Pocket PC technology. See "PDA" below for additional information. *See endnote.
• Low-level bit stream image: A/k/a forensic image. This image is always physically identical to the original hard disk drive, flash memory device or other digital device.
• Memory Stick (MS): See "Flash memory" above for more information. *See endnote.
• Metadata: Metadata is information about the digital data. For example Microsoft Word, Excel, Access, PowerPoint, Project, Publisher and Visio Adobe, OpenOffice and StarOffice programs all create and retain Metadata information for each document file. The Microsoft Windows Millennium Edition and Windows XP operating systems make extensive use of Metadata information, and Microsoft offers a "Windows Metadata Server" software product. Microsoft indicates that the following examples of Metadata may be stored in documents: owner name, owner initials, company or organization name, name of computer, name of the network server or hard disk where owner saved document, other file properties and summary information, non-visible portions of embedded objects, names of previous document authors, document revisions, document versions, template information, hidden text or cells, personalized views and comments. Metadata has become part of the digital landscape for companies and individuals as this information relates or pertains to the financial books and records and how a business operates. *See endnote.
• MicrodriveTM: See "Flash Memory" above for more information. *See endnote.
• Microsoft NTFS file system: The Microsoft NTFS file system is used on corporate servers, workstations and laptop computers and is used with Windows NT, Windows 2000, Windows XP and Windows 2003 operating systems. See "File system" above for more information. *See endnote.
• Mini-towers: A/k/a desktop computer. The mini-tower computer is used in the corporate setting and in homes. In business, it is the desktop computer that normally communicates with corporate servers and/or mainframe computers. The desktop computer may have 80 to 200 gigabyte or larger hard disk drive (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and back-up copies of computers and digital devices for just one HDD. *See endnote.
• MP3 players: The MP3 player was originally designed to play music. These digital devices may have an 80-gigabyte or larger hard disk drives that is capable of storing more than 1,000,000+ files for documents, spreadsheets, e-mail, databases, graphics, books and records, plus application programs and back-up copies of computers and digital devices. See "Hard disk drive" above for additional information. *See endnote.
• MultiMediaTM Cards: See "Flash Memory" above for additional information. *See endnote.
• Multiple Data Streams: See "Alternative Data Streams (ADS)" above for additional information. *See endnote.
• Network Attached Storage (NAS): The NAS devices are used to provide large additional hard disk drive storage for servers and are connected to networks. NAS devices may have as little as 200 gigabytes to several terabytes or more of HDD storage. See "Server," "Storage devices" and "Hard disk drive" for additional information. *See endnote.
• Network servers: See "Server" below for additional information. *See endnote.
• NTFS: See "Microsoft NTFS file system" above for additional information. *See endnote.
• Palm: A PDA device based on the Palm operating system. See "PDA" below for additional information. *See endnote.
• Partition: A partition is a logical section of a hard disk drive. Each partition ordinarily has its own file system. It is possible to intentionally hide partitions from normal view and discovery. See "File system" above. *See endnote.
• PCMCIA HDD: This digital device, the size of a credit card, is used in laptops like ordinary hard disk drives. This hard disk drive provides storage of five gigabyte (or more) of storage. This device is capable of storing thousands of documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and back-up copies of computers and digital devices. See "Byte" and "Hard disk drive" for additional information. *See endnote.
• PDA: personal digital assistant‹A small general-purpose, programmable, battery-powered computer. The PDA is usually loaded with an operating system such as the Palm or Pocket PC operating system. These devices are designed to complement a desktop, laptop and workstation computers and may allow for Internet, e-mail, instant messages, and downloading of programs. Data can be transferred between the PDA and a PC (desktop, laptop, etc). Besides hundreds of software programs that exist for PDAs that include for example Word, Excel and Quicken, custom applications are used for specific types of industries and professions. Numerous models and features, including optional memory expansion, are offered. *See endnote.
• Pocket PC devices: See "PDA" above for additional information. *See endnote.
• RAID array: Short for Redundant Array of Inexpensive Disks. A RAID is an assortment of hard disk drives connected to protect and improve the performance of hard disk drive storage. The RAID array is commonly used on computer servers and may have as little as 200 gigabytes to several hundred terabytes or more of HDD storage. See "Byte" above for additional information. *See endnote.
• RAM: Short for Random Access Memory, is high-speed memory used in computers. Usually, the more RAM you have, the faster your computer runs, and this allows more programs to be used at the same time.
• Removable hard disk drive: See "External hard disk drive," "Storage devices" and "Hard disk drives" for more information. *See endnote.
• SCSI: SCSI is short for Small Computer System Interface. The SCSI is the second most commonly used interface used for hard disk drives. The SCSI has several standards and is capable of supporting numerous devices.
• SCSI hard disk drive (SCSI HDD): The SCSI HDD allows for the storage and retrieval of digital information. The SCSI hard disk drive is commonly used for corporate servers and high performance computers in conjunction with RAID. SCSI HDDs may have as little as 200 gigabytes to several hundred terabytes or more of HDD storage. See "Byte," "RAID array" and "Hard disk drive" for more information. *See endnote.
• SecureDigitalTM Card: See "Flash Memory" above. *See endnote.
• Server: The server, short for computer server, is comprised of two parts, the physical hardware and software. The server is used for a multitude of functions in the corporate environment, including network file servers, e-mail servers, web servers, Network Information Service, Domain Name System and the Metadata servers. The server software provides service to other (client) programs. Many corporate servers use RAID, SCSI and Network Attached Storage devices. Servers typically have as little as 200 gigabytes to several hundred terabytes or more of HDD storage. That could translate to 2,000,000-100,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and back-up copies of hard disk drives. *See endnote.
• SmartMediaTM Card: See "Flash memory" above. *See endnote.
• Steganography: Steganography is the art of hiding information in an innocent looking carrier. That hidden information could include documents, spreadsheets, e-mail, instant messages, databases, graphics, and financial books and records and related documents. See "encrypted e-data" above. *See endnote.
• Storage devices: These storage devices are designed to store digital information and they include hard disk drives, SmartMediaTM Card, SecureDigitalTM Card, SCSI HDD, Removable HDD, RAID, Network Attached Storage, Microdrive, Zip disk, Jazz disk, CDs, DVDs, USB flash drives, USB hard disk drives, FireWire hard disk drives and tape back-up systems. *See endnote.
• Tape backup systems: Most corporate servers are automatically being backed-up based on a schedule; tape is the common media used. Corporate servers, mainframe computers, mini-computers, RAID arrays, storage devices, external hard disk drives, workstations, desktops, deskside/towers take advantage of this method of backing up digital information. While corporations may have different tape backup systems and schedules, it would be unusual to find a business that does not have a wide assortment of past backup tapes. *See endnote.
• Tower computer: The tower or desktop computer is used in the corporate setting as well as for home use. In business, it is the tower computer that communicates with corporate servers and/or mainframe computers. Tower computers may have one or more hard disk drives and 80 to 200 gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs for just one HDD. *See endnote.
• Unallocated file space: Digital data that has been "deleted" remains in the unallocated file space found on hard disk drives and digital devices. *See endnote.
• USB: Short for universal serial bus. USB is a protocol that allows digital devices, including computers, external hard disk drives, flash drives, flash memory, PDAs, cell phones and digital cameras to communicate between these devices and a computer and/or related devices.
• USB hard disk drive (USB HDD): The USB HDD offers high-speed communications for the transfer of data. The USB HDD has become common for small businesses and individuals. A business having a few users on a network may back up the server and workstations using this type of device. USB HDDs may contain financial books and records, documents, spreadsheets, e-mail, instant messages and back-up copies of computers and digital devices. USB HDD may have 80 to 200 gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). *See endnote.
• USB Flash Drives (FD): The USB FDs are small size storage devices that can often fit on a key chain. The USB FD is capable of storing documents, presentations, e-mail, instant messages, spreadsheets, proprietary information, intellectual property, and financial books and records. *See endnote.
• Windows CE: See "PDA" above. *See endnote.
• Workstation: The workstation, a desktop, desktop/tower or mini-tower computer, is primarily used in business and communicates with corporate servers and/or mainframe computers. Workstations may have one or more hard disk drives and 80 to 200 gigabyte or larger hard disk drives (it takes more than seven-hundred 3.5" floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs for just one HDD. *See endnote.
• Zip disk: The Zip disk from Iomega Corp. is a removable hard disk (both 100 and 250 megabyte versions) and has been used for several years to store digital information. *See endnote.
• Zip Drive: The Zip Drive from Iomega Corp. is the device used to record and read data from Zip disks. These devices can be internal or external drives.

  * Endnote: Digital financial accounting information such as documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, application programs and backup copies of computers and e-data residing on digital devices, including deleted and hidden data is recoverable from this source device/media during the digital forensic accounting examination. This includes, but is not limited to, the following source device/media: Alternative Data Streams, back-up or archival systems, Cassiopeia, CD-RW, CLIÉ, clusters, CompactFlash Card, databases, desktop computers, digital devices, directories, drive slack space, DVD+RW, DVD-RW, EIDE hard disk drives, e-mail, encrypted e-data, file slack space, file system, FireWire hard disk drives, Flash memory, floppy disk, folders, Handspring Treo, hard disk drive, instant messaging, iPaq, Jornada, memory stick, metadata, metadata servers, microdrive, Microsoft NTFS file system, mini-towers, MP3 players, multi-media cards, Network Attached Storage, network servers, Palm, partitions, PCMCIA hard disk drive, PDAs, Pocket PC, RAID array, removable hard disk drive, SCSI hard disk drive, SecureDigital Card, steganography, storage devices, tape backup systems, tower computer, unallocated file space, USB hard disk drive, USB Flash drives, Windows CE, workstations and Zip disks.

---

Footnotes

¹ In re NextCard Inc., filed 11/14/2002 (D. Del., case no. 02-13376). Return to article

² "NextCard Fraud Case Dawns Digital Bankruptcy Enforcement," Bankruptcy Law & Litigation Report, December 2003, p. 86. Return to article

³ Some bar associations and private groups have considered standardized practices for e-discovery. One such effort is the Sedona Principles, a set of 14 proposals for courts and litigants in dealing with electronic data discovery issued by the private, non-profit Sedona Conference Working Group on Electronic Document Production (Sedona, Ariz., 2003). Return to article

⁴ In re David Shick and Venture Mortgage Corp., 215 B.R.4 (S.D.N.Y. 1997) (court granted chapter 11 trustee's motion for turnover of debtor's computer and information as property of the estate). Return to article

⁵ Danis v. USN Communs. Inc., 2000 U.S. Dist. LEXIS 16900, at *4 (N.D. Ill. 2000) (litigant has fundamental duty to preserve documents; defendant's director fined for failure to appoint qualified personnel to preserve data); In re Prudential Ins. Co. of Am. Sales Practices Litig., 169 F.R.D. 598, 615 (D. N.J. 1997) (it is the duty of corporate officers to preserve potentially discoverable documents); In re Joseph L. Pierce, 287 B.R. 457 (E.D. Mo. 2002) (creditor's motion to deny discharge in chapter 7 granted where debtor's contention that his computer and back-up files mysteriously disappeared was not credible). Return to article

⁶ See, e.g., Renda Marine Inc. v. United States (2003 U.S. Claims LEXIS 260) (duty to preserve material evidence as soon as a party reasonably should know that the evidence may be relevant to anticipated litigation). Return to article

⁷ In a hotly contested case, the transcript of the debtor's representative's answers at the §341 meeting might be useful in obtaining discovery orders from the bankruptcy court. Return to article

⁸ Gates Rubber Co. v. Bando Chem. Indus., 167 F.R.D. 90, 115 (D. Colo. 1996) (where requesting party makes a showing of relevance of lost documents, sanctions are "appropriate if something is not produced or disappears which is known to exist, which ought to exist, or which may reasonably be inferred to exist." ) But, see Coates v. Johnson & Johnson, 756 F.2d 524, 551 (7th Cir. 1985) (no sanctions for routine deletion of documents absent bad faith). Cf. In re Prudential Ins. Co. of Am. Sales Practices Litig., 169 F.R.D. 598, 615 (D. N.J. 1997) (adverse inference may be drawn from haphazard document retention policy). Return to article

⁹ National Ass'n. of Radiation Survivors v. Turnage, 115 F.R.D. 543, 557-558 (N.D. Cal. 1987); Proctor & Gamble Co. v. Haugen, 179 F.R.D. 622 (D. Utah 1998), aff'd. in part, rev'd. in part, 222 F.3d 1262 (10th Cir. 2000) (Proctor & Gamble fined $10,000 for failing to preserve employee e-mails). Return to article

¹⁰ Different circuits have adopted different rules. For example, compare Danis v. USN Communs. Inc., 2000 U.S. Dist. LEXIS 16900, at *103-105 (N.D. Ill. Oct. 20, 2000) (severity of sanctions depends on the circumstances of the case), with Seattle Audubon Soc'y. v. Lyons, 871 F. Supp 1291, 1308 (W.D. Wash. 1994), aff'd., 80 F.3d 1401 (9th Cir. 1996) (party must be on notice that the documents they destroyed were relevant). Return to article

¹¹ Stanton v. National R.R. Passenger Corp., 849 F. Supp. 1524, 1528 (M.D. Ala. 1994) (destruction of computer tape in accordance with reasonable established policy is not actionable, but here, documents were destroyed in violation of a retention policy). Return to article

¹² The Antioch Co. v. Scrapebook Borders Inc., 210 F.R.D. 645 (D. Minn. 2002) (motion for order to preserve records granted. Return to article

¹³ Id. at 651 (motion for expedited discovery granted due to need to preserve records); Century-ML Cable Corp. v. Carrillo, 43 F. Supp 2d, 76, 178 (D. P.R. 1998) (expedited discovery is warranted in order to prevent likely destruction of computer evidence). Return to article

¹⁴ Sega Enters. v. MAPHIA, 948 F. Supp. 923,927 (N.D. Cal. 1996) (ex parte order to seize computer to allow plaintiff to copy the hard drive). Return to article

¹⁵ See Strauss v. Microsoft Corp., 1995 WL 326492, at *1 (S.D.N.Y. 1995) (prejudice arising from defendant's employees' e-mail messages containing sexual and gender-related comments was outweighed by the probative value of the evidence to plaintiff's complaint of gender-based retaliatory discharge). Return to article

¹⁶ In the case of In re David Shick, supra, 215 B.R. at 8-10, the court held that the privilege against self-incrimination does not extend to voluntarily created documents, because there is no compulsion to create them. Court-ordered production of documents might under some circumstances be incriminating, but as a rule, surrender of property of the estate is not testimonial and does not implicate Fifth Amendment concerns. In any event, the defendant in this case, a licensed attorney, failed to establish that turnover of estate property would constitute a link in the chain of incrimination. Return to article

¹⁷ Anti-Monopoly Inc. v. Hasbro Inc., 1995 U.S. Dist. LEXIS 16355 at *6 (S.D.N.Y. 1995) (party may be required to create search protocol for relevant e-data). Return to article

¹⁸ In United States v. Stewart, No. 03 Cr. 717 (MGC), 2003 U.S. Dist. LEXIS 18502 (S.D.N.Y. Oct. 20, 2003), the court ruled that an unsolicited e-mail sent by home living maven Martha Stewart to her attorney a year before her indictment was not protected by the attorney-client privilege. Stewart waived the privilege when she sent a copy of the e-mail, which dealt with Stewart's sale of her ImClone stock, to her daughter. However, the e-mail was privileged under the Second Circuit's approach to the work-product doctrine because even though Stewart and her daughter did not share a "litigation interest," they did share a common familial interest, which Stewart did not waive by sending a copy of the e-mail to her daughter. Return to article

¹⁹ Compare In re Grand Jury Investigation, 142 F.R.D. 276, 279-82 (M.D.N.C. 1992) (court applied a multi-factor test where 300,000 documents were reviewed), with FDIC v. Singh, 140 F.R.D. 252 (D. Me. 1992) (inadvertent disclosure waives privilege). A short but well-reasoned opinion is U.S. v. Rigas, et al., 2003 U.S. Dist. LEXIS 16639 (S.D.N.Y., Sept. 22, 2003) (no waiver where U.S. took reasonable precautions to prevent disclosure of privileged files from hard drives copied and produced for the defendant, and the government immediately asserted privilege and demanded that the files be returned). Return to article

²⁰ Danis v. USN Communs. Inc., supra, 2000 U.S. Dist. LEXIS at *150 (owner of records is responsible for knowing where discoverable documents are); In re Brand Name Prescription Drugs Antitrust Litig, 1995 U.S. Dist. LEXIS 8281, at *6-7 (N.D. Ill., June 13, 1995) (court granted plaintiff's motion to compel the defendant to produce computer data at its own expense because the defendant chose its own form of data storage). Return to article

²¹ It would take 711 standard 3.5'' diskettes to hold one gigabyte of data. A terabyte is 1024 gigabytes. Approximately 728,178 standard 3.5'' diskettes would be needed to store one terabyte of data. Return to article

²² The total cost was estimated by the court to be $4.347 million, not including the cost of document review. The costs included $1,113.50 per tape for restoration ($597,600 for all 996 tapes) and $1,627 per tape for searching ($3,240,984). Although significant, these costs were less than 2 percent of the $225 million of the total at stake in the litigation. Return to article

²³ See, also, Rowe Entertainment Inc. et al. v. William Morris Agency, et al., 205 F.R.D. 421 (S.D.N.Y. 2002) (court applied the same eight-factor balancing test used in Medtronic in holding that the requesting party must bear the costs, except for cost of privilege review). Return to article