ELECTRONIC  DISCOVERY LAW:     e-discovery
DISCOVERY OF
ELECTRONIC DATA
© Richard E. Best 1998-2003 All Rights Reserved
BIO AND SITE INFORMATION
Your constructive comments are appreciated best@justice.com
THIS SITE DOES NOT PROVIDE LEGAL ADVICE

HOME

ADMISSION OF EVIDENCE

Forensic software results

United States v. Ganier (6th Cir. 2006), --- F.3d ----, 2006 WL 3299862 The meaning of reports generated by forensic software requires expert testimony.  Testimony by a forensic computer expert who had conducted an examination to determine what searches had been run on the defendant's computer was expert testimony for which a written summary was required to be provided by the federal rules of criminal evidence.
Defendant was accused of obstructing justice by destroying computer evidence after a grand jury subpoena issued. The government's ..."forensic computer specialist... use[d] forensic software to determine what searches were run on the three computers [and] determined from reports generated by the forensic software that searches had been run... using search terms relevant to the grand jury investigation and the allegedly deleted files. ...a motion to exclude the reports and related testimony" was granted. The appellate court affirmed the determination but not the remedy of evidence exclusion explaining as follows. "The reports generated by the forensic software display a heading, a string of words and symbols, date and time, and a list of words. ....The government asserts that these reports reveal three different types of searches performed with particular search terms at particular times, but such an interpretation would require [the witness] to apply knowledge and familiarity with computers and the particular forensic software well beyond that of the average layperson. This constitutes 'scientific, technical, or other specialized knowledge' within the scope of Rule 702."

Admissibility of computer data & documents

Aguimatang v. California State Lottery(1991), 234 Cal.App.3d 769, 795  [server logs of party]

Lorraine v. Markel American Ins. Co. (D.Md.,2007), 2007 WL 1300739 lengthy case regarding federal evidentiary rules and their application to electronic data.

Inventory Locator Service, LLC v. Partsbase, Inc. (W.D.Tenn.,2005), Not Reported in F.Supp.2d, 2005 WL 2179185 [Server logs authenticated and admitted as business records to show illegal access of database and manipulation of information.]
People v. Hawkins (2002), 98 Cal.App.4th 1428 [printouts of computer access times admitted; def convicted of knowingly accessing computer and taking data; time of access was relevant so proper functioning of computer clock relevant
United States v. Catabran, 836 F.2d 453 (9th Cir. 1988). [accounting records admissible after foundational testimony]
Monotype Corp., PLC v. International Typeface Corp., 43 F.3d 443 (9th Cir. 1994).

In re Vee Vinhnee, 2005 WL 3609376 (9th Cir.BAP (Cal.),2005) Admissibility of computer business records. The proponent of evidence failed to submit sufficient evidence to authenticate records and satisfy the the requirements business records exception to the hearsay rule. The court suggested that prior cases admitting computer records may not have required sufficient showings of their trustworthiness and that admissibility requires more detailed foundation to satisfy the question of what has, or may have, happened to the computer record in the interval between creation and trial. The court suggested testimony as to the following:

policies and procedures for the use of the equipment, database, and programs
how access to the pertinent database is controlled
how access to the specific program is controlled
how changes in the database are logged or recorded
structure and implementation of backup systems
audit procedures for assuring the continuing integrity of the database

The court also suggested additional inquiry on subjects to verify the accuracy and integrity of data

the mode of record preparation
programming errors
completeness of data entry
mistakes in output instructions
damage and contamination of storage media
power outages, and equipment malfunctions
improper search and retrieval techniques, data conversion, or mishandling during discovery
that the computer used is the standard acceptable type
that business is conducted in reliance upon the accuracy of the computer in retaining and retrieving information."

The court referred to an "eleven-step foundation for computer records:

1. The business uses a computer.
2. The computer is reliable.
3. The business has developed a procedure for inserting data into the computer.
4. The procedure has built-in safeguards to ensure accuracy and identify errors.
[The court suggested details regarding computer policy and system control procedures, including control of access to the database, control of access to the program, recording and logging of changes, backup practices, and audit procedures to assure the continuing integrity of the records.]
5. The business keeps the computer in a good state of repair.
6. The witness had the computer readout certain data.
7. The witness used the proper procedures to obtain the readout.
8. The computer was in working order at the time the witness obtained the readout. 9. The witness recognizes the exhibit as the readout.
10. The witness explains how he or she recognizes the readout.
11. If the readout contains strange symbols or terms, the witness explains the meaning of the symbols or terms for the trier of fact."
citing EDWARD J. IMWINKELRIED, EVIDENTIARY FOUNDATIONS § 4.03[2] (5th ed.2002)

Authentication[Evid.Code §1400 et seq.FRE Rule 901]

HARDRIVE RECOVERY
Kupper v. State of Texas(Tex App.2004), 2004 Tex. App. LEXIS 337 [child sex assault conviction affi'd.; recovery from image of computer hard drive including deleted material and email message and photo from temporary internet file; chain of custody and authentication issues raised on appeal but rejected; ]

WEBPAGE

St. Luke's Cataract & Laser Inst., P.A. v. Sanderson (M.D.Fla.,2006.Slip Copy) 2006 WL 1320242 Websites are not self authenticating and the court required a statement or affidavit from an Internet Archive representative with personal knowledge of the contents of the Internet Archive website. http://www.archive.org/index.php. See also Telewizja Polska USA v. Echo Star Satellite Corp. 2004 U.S. Dist. Lexis 20845, 2004 WL 2367740 (N.D.Ill.)

In re Homestore.com, Inc. Securities Litigation (C.D.Cal.2004), 347 F.Supp.2d 769    p.782 "Defendant Wolff objects ... as hearsay, lack of foundation and authentication. These documents are press and earnings releases printed from [defendant] Homestore.com's website. Although the documents bear the URL address and date stamp, they are improperly authenticated by Plaintiffs' declaration. Printouts from a web site do not bear the indicia of reliability demanded for other self-authenticating documents under Fed. R. Evid. 902. To be authenticated, some statement or affidavit from someone with knowledge is required; for example, Homestore's web master or someone else with personal knowledge [p.783] would be sufficient. The Court finds that these exhibits are not properly authenticated and are inadmissible for purposes of summary judgment."

E-MAIL
See People v. Von Gunten (Cal.Ct.App.), 2002 WL 501612 re types of issues; e-mail excluded for lack of authentication; case not certified for publication.

In re Homestore.com, Inc. Securities Litigation (C.D.Cal.2004), p. 781. "...documents are deemed authentic because Plaintiff identified the documents as being produced by parties in discovery....According to Plaintiffs, Exhibits ... were retrieved from Homestore's email database and produced by PwC for this litigation. Exhibit SS was produced by Homestore via Wolff's computer hard drive and printed by Plaintiffs. Exhibits ...were produced by AOL, once a party to this litigation but now dismissed. Second, emails written by a party are admissions of a party opponent and admissible as non-hearsay."

Metadata may assist authentication

Show date & person creating or accessing document or data
Show tranmittal information
Show deposit in various reliable places

New problems created by ability to modify or fabricate documents create issues for authentication

See R.S. Creative Inc. v. Creative Cotton Ltd. (1999), 75 Cal.App.4th 486 where plaintiff filed a complaint based on an allegedly altered contract; discovery obtained by stipulation to examine hard drive to detect alteration of contract but complaint amended conceding the version was not valid.
See Fennel v. First Step Designs Ltd. (1st Cir.1966), 83 F.2d 526 where plaintiff was denied examination of a hard drive to determine if critical memo was predated to avoid liability for wrongful discharge.

Need for expert witness;
Alteration & fabrication issues
Unauthorized use of computer to send email
Audit trail: show access to files or lack thereof, who, when, how long, changes made
Storage on backup tapes may show document offered is not authentic
Reliability of systems & programs used
Methods of data entry & storage
US v. Russo 480 F.2d 1228
US v. Weatherspoon 581F.2d 595
Discovered documents: mirror image; lack of alteration; virus checked software & media; write protect, chain of custody

Best Evidence [Evid. Code §1500 et seq.]
Secondary Evidence Rule effective 1999 [Evid.Code §1521 ]
Hearsay

Admissions, FRE, Rule 801(d)(2)
Business records, FRE Rule 803(6)

nature & purpose of email system
continuous custody
credible anti-tampering security
degradation of digital records after 3 years; need to migrate data
Computer printout admissible if it satisfies business records exception

Aguimatan v. California State Lottery(1991), 234 Cal.App.3d 769
People v. Luashi (1988), 205 Cal.App.3d 632, 641
People v. Martinez (2000), 22 Cal.App.4th106, 126
People v. Hernandez (1997) 55 Cal.App.4th 225 [multiple layers of unreliable hearsay from computer search inadmissible]

Meta Data:
data about data; data generated by the computer
distinguish computer stored information from computer generated information

People v. Hawkins (2002), 98 Cal.App.4th 1428, 1449 [Hearsay objection raised to metadata: out of court "statement" by compurter offered for truth of matter stated, e.g. that files were accessed on a specific time and day; printouts of computer access times admitted; def convicted of knowingly accessing computer and taking data; "The Evidence Code does not contemplate that a machine can make a statement"; not issue of hearsay but of proper operation of computer; presume accuracy; if challenged by evidence of inaccuracy, burden of proof on proponent by preponderance of evidence to show computer functioned properly;
Issue of accuracy or reliability of information printed
If objection to data, (1) show accuracy of print out (2) show reliability; Hearsay objection did not raise issue of reliabilty in trial court and objection waived. p.1450.]

Public Records and Reports, FRE Rule 803(8)

Advantages of electronic documents: corroboration of oral testimony re authentication
Special problems re documents or data discovered in pretrial process

Special problems of alteration of documents & forgery

Lumpkin v. Brown (N.D.Ill. 1997), 960 F.Supp.1339, 1348

Verification of sender
Passwords, [may be required by email system]
Special code to id sender
Digital signatures
Verification of transmittal

Private VAN to provide independent verification of transmittal and receipt

See also Department of Justice Outline at http://www.cybercrime.gov/s&smanual2002.htm

CALIFORNIA DISCOVERY

SAN FRANCISCO DISCOVERY