About the Publication | List of Chapters | Ordering Information
By Alan Gahtan, B.A., M.B.A., LL.B., of the Bar of Ontario
1. INTRODUCTION
1.1 Importance of Electronic Evidence
1.2 Purpose of Chapter
1.3 Why Electronic (Computer) Evidence is Different
1.4 Disclosure of Electronic Evidence
1.5 Preservation of Electronic Evidence
1.6 Typical Steps in a Discovery for Electronic Evidence
1.7 Use of a Forensic Expert
2. WHERE TO LOOK FOR ELECTRONIC EVIDENCE--QUESTIONS TO ASK
2.1 People and Workflow
2.2 Computer Hardware Resources
2.3 Application Software
2.4 Other Questions
2.5 Backup Policies and Procedures
2.6 Electronic Media Production
3. FINDING HIDDEN SOURCES OF ELECTRONIC EVIDENCE
3.1 Hidden and Deleted Information on Computer Disks
3.2 Print Spoolers
3.3 Network Operating Systems and File Servers
3.4 Backup Tapes
3.5 Databases
3.6 Word Processing Files
3.7 E-mail
3.8 Software Source Code
4. CHALLENGES OF REVIEWING COMPUTER-BASED EVIDENCE
4.1 Document Requests and Production
4.2 Confidentiality
4.3 Magnitude of Information in Computer-Readable Form
4.4 Lack of Organization
4.5 Use of Computers to Assist in the Review of Computer-Based Evidence
4.6 Review of Specialized Types of Data
4.6.1 Digitalized Audio-Visual Data
4.6.2 Proprietary, Compressed and Encrypted Formats
4.7 Authentication and Accuracy
5. DEFENSIVE STRATEGIES
5.1 Document Retention Programs
5.2 Periodic Purging of Hard Disks and Other Magnetic Media
5.3 Encryption Policy
5.4 Document Management Systems
5.5 Segregation of Privileged Files
6. CONCLUSION
Computer technology has revolutionized the way we deal with information and the way we run our businesses. Increasingly important business information is being created, stored and communicated electronically. Many types of information that can play a useful role in litigation are no longer printed on paper and stored in paper files but rather are stored in a computer system or in computer-readable form. As companies have increased their reliance on their computer systems, lawyers have begun to realize the valuable electronic treasures that are now being kept in these systems and have started aggressively to target electronic data for discovery in all types of litigation cases. The discoverability of these electronic files is referred to as "Electronic Media Discovery" or EMD.
Plaintiffs' lawyers have been increasingly targeting electronic evidence for a number of reasons. Electronic evidence will also likely soon attract the attention of government investigators. Numerous statutory provisions empower government officials to enter, inspect, and make copies of records which must be maintained pursuant to various statutes and regulations.
The primary purpose of these provisions is to enable the government to determine whether a company is complying with the recordkeeping and other requirements contained in the statute that imposes them. Many businesses are increasingly storing the required records in electronic form. Government investigators will likely begin to focus their attention on the electronic form of these records and the computer systems that house them.
The government also has access to records for investigatory purposes. Several statutes, such as the human rights codes, Competition Act, Criminal Code and tax Acts give government officials the right to enter a business establishment and inspect or seize records. For example, under the Competition Act, peace officers with, or in exigent circumstances, without a search warrant, may enter the premises, examine records, and copy or seize them. They may use the computer system on the premises to search data and produce printouts, which they may then seize for examination or copying.
Plaintiffs' lawyers and government investigators need to develop the knowledge and skill necessary to take advantage of the information residing in electronic form. This does not mean that they need to become computer specialists, but rather, that they need to understand enough about the technology to ask the right questions and enlist the assistance of the forensic computer experts where necessary. Lawyers who choose to ignore these new opportunities could expose themselves to malpractice claims.
Lawyers representing parties with large amounts of electronic data need to understand that their clients' data will be targeted for such discovery and need to advise their clients on how to prepare. Defensive strategies that should be implemented prior to litigation include a proper document retention program, periodic purging of magnetic media and the implementation of a document management system. Once litigation has commenced, defendants need to be better advised on how to preserve relevant electronic evidence adequately, in order to avoid possible sanctions or a negative inference at trial.