E-sleuthing and the Art of Electronic Data Retrieval Uncovering Hidden Assets in the Digital Age Part II

Journal Issue

Mar 2004

Column Name

Journal HTML Content

Although no major e-data decisions to date have been decided by bankruptcy courts, the role of e-data evidence in
bankruptcy litigation will become increasingly important. Recently, two former Ernst & Young managers were
charged with accounting fraud relating to the NextCard Inc. bankruptcy.<a href="#1" name="1a">1</a> The accountants, who audited NextCard's
books, are alleged to have destroyed and altered portions of NextCard's 2000 and 2001 financials in order to hide
losses and make it look as if all documents were the product of a clean audit.<a href="#2" name="2a">2</a>

Whenever possible, discovery of relevant e-data will be conducted by mutual agreement of the parties. At the §341
meeting of creditors, or informally beforehand, creditors' counsel can ask the debtor to identify computers, servers
and laptops that may contain the books and records and other important financial information. If the corporate
debtor's representative does not know this information, creditors can request a continuation of the §341 meeting in
order for the debtor to produce the necessary individuals who can answer these questions. Creditors' counsel should
ask the debtor to allow its digital forensic accounting expert to conduct a preliminary and practicable examination of
relevant computers and hard drives, at a time and in a manner that minimizes inconvenience to the debtor. One of
the biggest benefits of voluntary e-discovery is that the debtor will be substantially less inconvenienced. It is more
difficult for debtor's counsel to complain later about the cost of discovery when the debtor always had the alternative
to comply with the creditors' initial requests. To the extent that the creditors and debtor (and insiders) work together
to allow creditors to obtain the digital financial data they seek, the parties will save on the time and costs involved
in formal discovery.

Much information may be gained from these informal efforts. For example, if accounting reports, financial
statements, financial spreadsheets, memos, and e-mail and related attached files are shown to have been deleted, the
creditors may infer that the debtor is determined to hide information. On the other hand, if no deletions of any
documents are found on an hard disk drive (HDD), it is probably because the deleted files were recently wiped clean,
and then some documents added to make things appear normal. This is because at least some deletions of e-mail
and older files is routine. However, if the debtor allows the creditor's digital forensic accounting technologist
relatively open access to its computers, servers, employees and insiders' laptops and is forthcoming in its responses
for information, the creditors will be reassured by the debtor's e-transparency and conclude that the debtor and its
employees and insiders have nothing to hide. Thereby, all parties will save time and money.

If, on the other hand, the debtor and insiders unreasonably refuse to engage in informal discovery, if their answers
are vague or inconsistent, or if they allow access to some e-data and hardware but not to others, then creditors may
reach the conclusion that insiders have something to hide. This should raise a red flag and indicate to counsel that
they need to engage in prompt and aggressive discovery.

<h3>Electronic Data Retrieval Under the Bankruptcy Rules and the Federal Rules of Civil Procedure</h3>

If the parties do not agree on voluntary discovery, creditors may need to resort to litigation. The discovery and use
of e-data in bankruptcy litigation is governed by the Federal Bankruptcy Rules and by the underlying Federal Rules
of Civil Procedure. The Advisory Committee Notes to Federal Rule 34 states that the discovery of documents
applies to "electronic data compilations from which information can be obtained only with the use of detection
devices...." Numerous court cases have visited the issue of how e-data may be obtained in an adversarial proceeding,
but the newness of e-data, and the explosive growth of digital technology, has forced the courts to play catch-up.<a href="#3" name="3a">3</a>

In chapter 7 cases, the discovery of digital data is relatively simple. The hardware, software and all data, including
the books and records, contained on the debtor's computers and other devices is property of the estate under
Bankruptcy Code §§542(a) and (e). Similarly, if a trustee has been appointed in a chapter 11 case, the trustee may
demand access to all of the debtor's computer and digital devices, information and data storage facilities.<a href="#4" name="4a">4</a> Under
§521(4) of the Code, the debtor must surrender to the trustee "all property of the estate and any recorded
information, including books, documents, records and papers relating to the property of the estate...." The trustee
can then arrange for forensic images to be made and mined for relevant information.

In either a chapter 7 or chapter 11, creditor's counsel should be immediately concerned if the debtor has leased its
computers and digital devices and then suddenly decides to reject the leases and return the equipment. Creditor's
counsel will want to promptly file an objection and conduct e-discovery.

Discovery in a chapter 11 adversarial proceeding is similar to litigation in the federal district court and is
governed by the same rules. Under Fed. R.C.P. 26(b)(1), information is discoverable if it is "relevant to the
claim or defense of any party," or if it "appears reasonably calculated to lead to the discovery of admissible
evidence." The initial disclosures under Rule 26(a)(1)(B) require a party to disclose, without waiting for a
discovery request, a copy of, or a description by category and location of, all documents, data compilations and tangible things that
are in the possession, custody or control of the party and that the disclosing party may use to support its claims or
defenses unless solely for impeachment.

Despite the fact that almost all businesses now keep books and records in digital form, rules of discovery have been
slow to adopt formal means of dealing with e-discovery. Recently, New Jersey adopted local rules requiring initial
disclosure of computer-based evidence. New Jersey Local Civil Rule 26.1(d)(1) requires counsel to review with the
client the client's "information management systems, including computer-based and other digital systems, in order
to understand how information is stored and how it can be retrieved." In other words, counsel has to become
baseline proficient regarding a client's information systems. Rule 26.1(d)(1) further requires counsel to determine
and locate active, backup or archival files and other digital evidence that may be used to support the client's claims
or defenses, and to disclose this information to the opposing side as part of its Rule 26(a)(1) initial disclosure. A
litigant must disclose at the Rule 26(f) meeting whether it is likely to request or produce computer-based or digital
information, and identify as clearly as possible the categories of information to be sought. The party may
supplement its request for computer information upon obtaining new information relating to digital evidence. New
Jersey Local Rule 26.1 also requires that at the Rule 26(f) meeting the parties include in their discussions the
preservation and production of e-data, procedures dealing with the inadvertent production of privileged information,
whether restoration of deleted e-data may be necessary, back-up information, and the media, format and procedures
for producing digital information, as well as cost allocation for preservation, production and restoration, if
necessary, of digital discovery.

Even in jurisdictions that have not formally adopted e-discovery rules, the same duties and privileges that apply to
discovery of paper documents and other tangible evidence applies in principal to e-data and hardware. However, the
particular and ever-changing nature of e-data technology has required courts to be creative and analytical in order to
adapt discovery rules to the realities of information technology.

<h3>Duty to Preserve E-evidence</h3>

Parties have an obligation to preserve evidence that is potentially discoverable in litigation.<a href="#5" name="5a">5</a> In most jurisdictions,
this duty arises when the party knows or should know of the potential litigation.<a href="#6" name="6a">6</a> After taking full advantage of the
opportunity to ask questions at the §341 meeting and any continuation thereof, lenders and creditors in litigation
against debtors and insiders should consider making special arrangements for discovery of e-data in the Rule 26(f)
conference and Rule 16(b) scheduling conference.<a href="#7" name="7a">7</a>

Digital evidence may deteriorate through use or modification, be overwritten, or lost over time due to e-mail and
file-deletion policies. Of course, debtors and insiders may also try to intentionally delete e-data. Generally, a party
on notice to preserve documents must take steps to protect data that may be lost in the ordinary course of business,<a href="#8" name="8a">8</a>
including notifying employees to retain records.<a href="#9" name="9a">9</a> Of course, a party will be subject to severe sanctions for deliberate
destruction of e-data.<a href="#10" name="10a">10</a> However, destruction or deletion of documents in the ordinary course of business pursuant
to a reasonable records retention policy is not sanctionable.<a href="#11" name="11a">11</a> Regardless, the deletion of the debtor's digital books
and records and related documents, including audit work-papers and financial statements, should never be considered
the ordinary thing to do. Thus, counsel should file a motion to prevent spoilage of digital evidence early in the
case. This motion may be brought under Rule 16 (c) (12) and (16) of the Federal Rules of Civil Procedure.<a href="#12" name="12a">12</a>

Counsel may first want to obtain expedited disclosure of the debtor's records to specifically identify computers,
servers and laptops that may contain the books and records and other important financial information, software and
other features of its e-data so that a motion for preservation can be properly formulated. Under Rule 26(d), the court
may, for cause, allow expedited discovery.<a href="#13" name="13a">13</a> In exceptional cases, an ex parte TRO may be issued to prevent
immediate destruction of computer evidence.<a href="#14" name="14a">14</a>

<h3>Timing and Sequence of E-data Discovery</h3>

In order to conduct effective discovery of the debtor's e-data, counsel must first obtain as much information as
possible about the debtor's computer systems. In some cases, an experienced e-sleuth will be able to formulate
much of this information with minimal input from the responding party. In other cases, it will be necessary to
supplement the e-sleuth information and propound interrogatories under Rule 33. Rule 33(b)(3) allows the court to
shorten the time for responding to interrogatories. However, without at least some advance information about the
debtor's systems, interrogatories might be incomplete or leave out some important information. Thus, creditor's
counsel may need to take a deposition of the corporate debtor's computer personnel under Rule 30(b) in order to
find out the types of computer systems, equipment, software, locations, back-up and deletion practices, and so on.
Ideally, this deposition can be limited to 30 minutes or so and then adjourned, saving as much of the maximum
seven hours allowed under Fed. R. Civ. P. Rule 30(d) as possible for that witness in the future, if necessary.
Additionally, counsel can serve Rule 36 requests for admissions aimed at finding out whether the debtor has deleted
files, uses encryption, stenography, has a second set of books, etc.

Discovery of the debtor's computer and digital information systems and practices should be followed up by an
inspection of the debtor's computers and production of e-data under Rule 34. Although the statutory response time
for a Rule 34 inspection is 30 days, under §34(b) the court may shorten this time. It is through the direct
examination of the debtor's computer systems and digital devices that a forensic image will be made, and the
incriminating e-data will be uncovered.

<h3>Objections to E-discovery</h3>

Evidentiary objections under Federal Rule 26(b) include relevancy, privilege, and undue burden, as well as
prejudice.<a href="#15" name="15a">15</a> It has even been asserted that surrender of a debtor's computers and information may be a violation of
the Fifth Amendment right against self-incrimination, although this claim has been rejected.<a href="#16" name="16a">16</a>

Relevance and privilege. The difficulty in determining whether a legitimate objection exists is compounded by the
vast amount of e-data that may be discovered. A discovery request must be relevant to a claim or defense, but with
sometimes hundreds of thousands of pages of e-data, culling out irrelevant documents may be almost impossible.
One solution is to establish a protocol of search terms that will capture relevant evidence and ignore irrelevant
documents.<a href="#17" name="17a">17</a> A digital forensic accountant may use search protocols containing a thousand or more words to locate
relevant documents and discard irrelevant ones. No debtor wants to produce, and no creditor wants to receive,
millions of pages of irrelevant data.

E-data is also subject to the attorney/ client privilege and attorney work-product privilege.<a href="#18" name="18a">18</a> With so many
documents potentially discoverable, debtor's counsel will want to avoid inadvertent disclosure, which could waive
the privilege. This can be done in a variety of ways. In Simon Property Group L.P. v. mySimon Inc., 194 F.R.D.
639 (S.D. Ind. 2000), the court ruled that the plaintiff was entitled to attempt to recover deleted computer files from
the defendant's programmers' computers, whether at work or at home. An expert who was selected and paid by the
plaintiff, and approved by the court, made a mirror image of the defendants' hard drives. The expert, as an officer of
the court and with all privileges intact, then inspected the files for relevant data under established protocol
guidelines, which included word processing documents, e-mails, presentation files, etc., but excluded higher-level
programming and software files. The expert produced a record, which was then reviewed by defendant's counsel for
privilege and responsiveness before production of the files to the plaintiff. The expert, as well as any assistants,
were obligated to full confidentiality, and the mirror-image copies were destroyed at the end of the litigation. Id. at
641-42. As a general rule, search terms and other search parameters can identify privileged documents to avoid
inadvertent disclosure. Yet, despite the best efforts of the parties and the court, inadvertent disclosure of privileged
documents can still occur. Recognizing the difficulty of maintaining privilege when so many documents must be
produced, courts have adopted differing standards for determining whether inadvertent disclosure waives the
privilege.<a href="#19" name="19a">19</a>

Proportionality. Another potential objection to the discovery of e-data is proportionality, or the expense of
producing e-data. The potential number of documents to be produced pursuant to a discovery request for
e-data can be vast. Ordinarily, the party responding to a discovery request bears the cost of responding to the
request. However, Fed.R.Civ.P. Rule 26(b)(2)(iii) allows a court to shift this burden to the requesting party
if:

<blockquote>
the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the
case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation and the
importance of the proposed discovery in resolving the issues.
</blockquote>

A number of cases have considered this issue and have reached different results. For example, some courts have held
that the responding party is responsible for the complexity of its systems, and must bear the cost of e-data
discovery.<a href="#20" name="20a">20</a> Other courts use a multi-factor balancing test, such as the one used in Medtronic Sofamor Danek Inc.
v. Michelson, et. al., 2003 U.S. Dist. LEXIS 8587 (W.D. Tenn. May 13, 2003). In Medtronic, a case involving
alleged theft of medical technology, the defendant sought production of 996 computer network backup tapes
containing some 61 terabytes of data, as well as 300 gigabytes of digital data from employee files that were not in
backed-up format.<a href="#21" name="21a">21</a> This was an unusually large volume of data because Medtronic had a policy of backing up all
of its data and not recycling or overwriting tapes. Significant costs were associated with the discovery, including the
cost of restoring back-up tapes, costs of designing and conducting a search, and the cost of privilege review.<a href="#22" name="22a">22</a> This
did not include any attorney fees for privilege review, which the court held must be borne by the responding party.

Id. at *27.

In order to determine whether the e-discovery costs are "undue," the court in Medtronic applied an eight-factor
balancing test, similar to the considerations set forth in Fed.R.Civ.P. 26(b)(2). The factors include (1) the
specificity of the request, (2) the likelihood of discovering critical information, (3) the availability of such
information from other sources, (4) the purpose for which the responding party maintains the requested data, (5) the
relative benefit to the parties of obtaining the information, (6) the total cost associated with the production, (7) the
relative ability of each party to control costs and (8) the resources available to each party. Id. at *11-*12.

Although it was clear that the information requested was not available from any other source, the plaintiff's
discovery request was extremely broad. In addition, it was far from certain that the plaintiff would discover relevant
evidence in all the documents it requested. Accordingly, the requesting party was ordered to pay most of the costs
of document production. The court also appointed a neutral expert to oversee the document reproduction and advise
the parties on technical matters.<a href="#23" name="23a">23</a>

Medtronic is an extreme case on its facts, and represents an overly broad production request by the party seeking
discovery. The factors set forth in Medtronic, however, are likely to become widely accepted as the standard by
which cost shifting in e-data discovery is determined. However, this should not pose a problem if creditor's counsel
seeks the assistance of a digital forensic accounting technologist early in the case. The party seeking discovery of
e-data documents can narrow the scope of discovery by the skillful use of preliminary interrogatories, informal
questionnaires or depositions of the debtor's technical and financial personnel aimed at finding out which
computers, servers and other digital devices are most likely to contain relevant e-data, and which employees,
officers, directors or insiders (including auditors, lenders and vendors) are most likely to have created or used this
information. Initial discovery will also provide clues as to which search terms, range of dates, file type, etc., are
most likely to yield positive results. Again, lenders and creditors do not want endless reams of irrelevant
information. In short, much can be done by the e-sleuth to minimize the burdens of e-data discovery, and to allow
both parties the opportunity to develop e-facts in an efficient and cost-effective manner.

<h3>Conclusion</h3>

Law and business now operate in the brave new world of digital information technology. A debtor's books and
records and related information in particular are the core of the debtor's business, and can reveal, if properly
retrieved, key data and information that can lead to the recovery of hidden assets and provide valuable information
relating to claims against the debtor's auditors, underwriters, board members, preferred shareholders, employees and
insiders. All bankruptcy practitioners need to become loosely conversant in the ways and methods of discovery of
digital financial data. Creditors' counsel in particular must be aware of the means by which information and assets
can be discovered using digital forensic accounting technology. This does not mean that counsel should serve as his
or her own computer expert. In the digital age, a qualified digital forensic accounting technologist is essential in the
quest for hidden e-data. Without the proper knowledge, skills and a full array of digital forensic tools on your side,
you are at a disadvantage against those debtors and insiders who will use the best of technology to hide assets and
evade creditors. Bankruptcy counsel must know about this technology and be prepared to use it in appropriate cases
on behalf of their clients.

<h3>Glossary</h3>

<ul>
<li> Alternative Data Streams (ADS): The Microsoft NTFS file system permits ADS. ADS allows for the hiding of data within other files, folders and directories. Corporate servers,
workstations and laptop computers use the NTFS file system with Windows NT,Windows 2000, Windows XP and Windows 2003 operating systems. Windows Explorer does not disclose the name(s) or file locations of ADS and Microsoft provides no tools for detecting the presence of ADS.

</li><li> Bit: Short for binary digit. A bit is the smallest unit of digital information and has a value of "ON" or "OFF." A bit is commonly said to be "set" if its value is 1, and "reset" if
its value is 0.

</li><li> Byte: A byte is digital data that is equal to eight consecutive bits. The following represents byte size values: Kilobyte‹1,000 bytes, Megabyte‹1,000,000 bytes,
Gigabyte‹1,000,000,000 bytes and Terabyte‹1,000,000,000,000 bytes.

</li><li> Back-up or archival systems: Numerous back-up and archival media systems exist. These include floppy disk, Zip disk, Jazz disk, CDs, DVDs, hard disk drives (including Flash
Memory and USB and FireWire) and tape back-up systems, which are just a few examples of the various forms of media used to back up digital information. See "Hard disk
drive", "Storage devices" and "Tape back-up systems" for additional information. *See endnote.

</li><li> CassiopeiaTM: A PDA device that is manufactured by Casio Inc. and based on the Microsoft Pocket PC. See "PDA" below for additional information. *See endnote.

</li><li> CD: Short for compact disc. The CD was originally developed for the music industry. CDs are read-only; typical use of CDs includes software application used for installation
and/or use of computer programs.

</li><li> CD-R: This form of media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail, instant
messages, financial books and records, and back-up copies of computers and digital devices. Just one CD-R is capable of storing more data than 400 floppy disks. Once the data
has been written to a CD-R, it cannot be changed.

</li><li> CD-RW: The use of CD-RW media allows data to be both written and deleted. This media is used to back up digital information from hard disk drives and other digital media
sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records and back-up copies of computers and digital devices. Just one CD-RW is
capable of storing more data than 400 floppy disks. *See endnote.

</li><li> CLIÉTM: A PDA device manufactured by Sony and based on the Palm operating system. See "PDA" below for additional information. *See endnote.

</li><li> Cluster: The primary unit of allocation of a hard disk drive made up of one or more physical blocks. A file may consist of several non-contiguous clusters. The hard disk cluster
size becomes a trade-off between efficiency and potentially wasted space found at the end of each file. *See endnote.

</li><li> CompactFlash Card: See "Flash Memory" below. *See endnote.

</li><li> Computer hard disk drives: See "Hard disk drive (HDD) below. *See endnote.

</li><li> Database: A database is structured data associated with proprietary software used for the update and query of the data. Many financial accounting applications and e-mail
programs make use of database files. The following are a few examples of proprietary database programs used in business: Filemaker Pro, FoxPro, Informix, Ingress, MS Access,
MS SQL Server, Oracle, Paradox, Progress and Sybase. *See endnote.

</li><li> Desktop computer: The desktop computer is used in the corporate setting and in homes. In business, it is the desktop computer that normally communicates with corporate
servers and/or mainframe computers. The desktop computer may have an 80 to 200 gigabyte or larger hard disk drive (it takes more than 700 3.5" floppy diskettes to hold one
gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus
application programs and back-up copies of computers and digital devices for just one HDD. *See endnote.

</li><li> Digital devices: Today hundreds of digital devices are available, computers, printers, scanners, USB and FireWire devices, CD and DVD burners, Zip drives, MP3 players,
cameras and a countless number of hard disk drives and memory devices. See "Hard disk drive" below for additional information. *See endnote.

</li><li> Digital forensic accounting technologist: A digital forensic accounting technologist provides specialized skills and experience to conduct an investigation into the digital books
and records and financial affairs of businesses and individuals. Presenting financial information discovered on corporate computers, servers, hard disk drives, digital devices and
back-up or archival systems appropriate to the situation understandably and concisely, and when necessary for final judicial determination, is the primary benefit of employing
the digital forensic accounting technologist.

</li><li> Directory: A/k/a folders. A directory is used in a computers hierarchical file system and generally contains files (documents, spreadsheets, databases, e-mail, financial books,
etc.) and/or subdirectories. For example, Windows Explorer will display the names of directories, sub-directories and files. *See endnote.

</li><li> Drives: Short for hard disk drive (HDD). See "Hard disk drives (HDD)" below. *See endnote.

</li><li> Drive slack space: Drive slack is created when additional sectors are needed for the last cluster being assigned to the file. *See endnote.

</li><li> DVD-R: This form of media is used to back up digital information from hard disk drives and other digital media sources and may include documents, spreadsheets, e-mail,
instant messages, financial books and records, and back-up copies of computers and digital devices. Just one DVD-R is capable of storing more data than 3,200 floppy disks or
seven CD-R. Once the data has been written to a DVD-R, it cannot be changed.</li><li> DVD+RW and DVD-RW: Both forms of media allow data to be written and deleted. This media is used to back up digital information from hard disk drives and other digital
media sources and may include documents, spreadsheets, e-mail, instant messages, financial books and records and back-up copies of computers and digital devices. Just one of
these DVDs is capable of storing more data than 3,200 floppy disks or seven CD-RW. *See endnote.

</li><li> EIDE HDD: EIDE is short for Enhanced Integrated Drive Electronics. EIDE standards have evolved over the years for hard disk drives. This type of HDD is typically used in
desktop, tower, mini-tower, workstations and laptops. EIDE HDDs may have 80 to 200 Gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold
one gigabyte of data). See "Hard disk drive" below for additional information. *See endnote.

</li><li> E-mail: Email has changed the way we communicate. Today e-mail has replaced traditional letters and telephone calls as the most dominant method of correspondence. *See
endnote.

</li><li> Encrypted e-data: Any process used in cryptography to convert files, documents, e-mail, instant messages and books and records etc. into cipher information to prevent reading
that data. There are two classes of encryption: public-key and private-key cryptography. See "Steganography" below. *See endnote.

</li><li> External hard disk drive: A computer hard disk drive that has been placed within a plastic or metal container enabling easy removal and/or for attachment to other computers
or digital devices. This device may use communications protocol such as USB, FireWire or other methods to record and transfer data. External hard disk drives may have 80 to
200 gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). See "Hard disk drive" below for additional information. *See
endnote.

</li><li> File slack space: Computer files are created in changing lengths depending on their size; it is seldom that the file size will match the available cluster size. The space that
exists from the end of the file to the end of the last cluster is called "file slack" space. *See endnote.

</li><li> File system: A/k/a filesystem. A system of rules for organizing directories (folders), subdirectories and files, generally in terms of how the file allocation table is applied in the
disk operating system. The file system is integral to the computer operating system. *See endnote.

</li><li> FireWire hard disk drives (FW HDD): A/k/a IEEE1394 (and used with HDD), this interface standard offers high-speed communications for the transfer of data. The FW HDD
has become common for small businesses and individuals. A business having a few users on a network may back up the server and workstations using this type of device. FW HDD
may contain financial books and records, documents, spreadsheets, e-mail, instant messages and backup copies of computers and digital devices. FW HDD may have 80 to 200
gigabyte or larger hard disk drives (it takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). See "Hard disk drive" below for additional information. *See
endnote.

</li><li> Flash Memory (FM): FM is digital memory and is provided in a variety of forms. FM is primarily used as a hard disk drive for information storage in PDAs, MP3 players and
digital devices. FM is small and allows for faster access to digital data. No data is lost when FM is turned off. A few examples of the forms of FM include CompactFlashTM,
SecureDigitalTM, MicrodriveTM, SmartMediaTM, Memory StickTM and MultiMediaTM. The downside to FM is that it is more expensive per megabyte than a hard disk drive.
*See endnote.

</li><li> Floppy disk (FD): A/k/a diskette. The FD is a 3 1/2" inch small plastic disk used for storing computer data and readable by a computer with a floppy disk drive (internal and
external). *See endnote.

</li><li> Folder: A/k/a directory. See "Directory" found above. *See endnote.

</li><li> Forensic image: A/k/a low-level bit stream image. The forensic image is always physically identical to the original hard disk drive, flash memory device or other digital
device.

</li><li> Handspring TreoTM: A PDA that is based on the Palm operating system. See "PDA" below for additional information. *See endnote.

</li><li> Hard disk drive (HDD): A/k/a hard drive, or disk drive. Practically every computer and server contains one or more HDD. An HDD is designed to read and write digital data and
allows for the storage and retrieval of this information. Today's desktops, towers and workstations may have 80 to 200 gigabyte larger HDDs (it takes more than 700 3.5" floppy
diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and
records, plus application programs and backup copies of computers and digital devices for just one HDD. See "Byte" above for listing of different size values. *See endnote.

</li><li> Hard drive: Short for "Hard disk drive." See "Hard disk drive" above. *See endnote.

</li><li> HDD: Acronym for "Hard disk drive." See "Hard disk drive" above. *See endnote.

</li><li> Instant messaging (IM): IM provides instant contact with Internet/Intranet users. IM service is available to anyone using ICQ. IM is used in both corporate and personal computer
environments. Two popular IM services are offered by AOL and MSN. IM has changed the way we communicate and has replaced letters and telephone calls. *See endnote.

</li><li> iPaqTM: The iPaq PDA is manufactured by HP/Compaq and based on the Microsoft Pocket PC. See "PDA" below for additional information. *See endnote.

</li><li> JornadaTM: The Jornada is manufactured by HP and uses Microsoft Pocket PC technology. See "PDA" below for additional information. *See endnote.

</li><li> Low-level bit stream image: A/k/a forensic image. This image is always physically identical to the original hard disk drive, flash memory device or other digital device.

</li><li> Memory Stick (MS): See "Flash memory" above for more information. *See endnote.

</li><li> Metadata: Metadata is information about the digital data. For example Microsoft Word, Excel, Access, PowerPoint, Project, Publisher and Visio Adobe, OpenOffice and
StarOffice programs all create and retain Metadata information for each document file. The Microsoft Windows Millennium Edition and Windows XP operating systems make
extensive use of Metadata information, and Microsoft offers a "Windows Metadata Server" software product. Microsoft indicates that the following examples of Metadata may be
stored in documents: owner name, owner initials, company or organization name, name of computer, name of the network server or hard disk where owner saved document, other
file properties and summary information, non-visible portions of embedded objects, names of previous document authors, document revisions, document versions, template
information, hidden text or cells, personalized views and comments. Metadata has become part of the digital landscape for companies and individuals as this information relates
or pertains to the financial books and records and how a business operates. *See endnote.

</li><li> MicrodriveTM: See "Flash Memory" above for more information. *See endnote.

</li><li> Microsoft NTFS file system: The Microsoft NTFS file system is used on corporate servers, workstations and laptop computers and is used with Windows NT, Windows 2000,
Windows XP and Windows 2003 operating systems. See "File system" above for more information. *See endnote.

</li><li> Mini-towers: A/k/a desktop computer. The mini-tower computer is used in the corporate setting and in homes. In business, it is the desktop computer that normally
communicates with corporate servers and/or mainframe computers. The desktop computer may have 80 to 200 gigabyte or larger hard disk drive (it takes more than 700 3.5"
floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics,
books and records, plus application programs and back-up copies of computers and digital devices for just one HDD. *See endnote.

</li><li> MP3 players: The MP3 player was originally designed to play music. These digital devices may have an 80-gigabyte or larger hard disk drives that is capable of storing more
than 1,000,000+ files for documents, spreadsheets, e-mail, databases, graphics, books and records, plus application programs and back-up copies of computers and digital devices.
See "Hard disk drive" above for additional information. *See endnote.

</li><li> MultiMediaTM Cards: See "Flash Memory" above for additional information. *See endnote.

</li><li> Multiple Data Streams: See "Alternative Data Streams (ADS)" above for additional information. *See endnote.

</li><li> Network Attached Storage (NAS): The NAS devices are used to provide large additional hard disk drive storage for servers and are connected to networks. NAS devices may have
as little as 200 gigabytes to several terabytes or more of HDD storage. See "Server," "Storage devices" and "Hard disk drive" for additional information. *See endnote.

</li><li> Network servers: See "Server" below for additional information. *See endnote.

</li><li> NTFS: See "Microsoft NTFS file system" above for additional information. *See endnote.

</li><li> Palm: A PDA device based on the Palm operating system. See "PDA" below for additional information. *See endnote.

</li><li> Partition: A partition is a logical section of a hard disk drive. Each partition ordinarily has its own file system. It is possible to intentionally hide partitions from normal view
and discovery. See "File system" above. *See endnote.

</li><li> PCMCIA HDD: This digital device, the size of a credit card, is used in laptops like ordinary hard disk drives. This hard disk drive provides storage of five gigabyte (or more) of
storage. This device is capable of storing thousands of documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus application programs and
back-up copies of computers and digital devices. See "Byte" and "Hard disk drive" for additional information. *See endnote.

</li><li> PDA: personal digital assistant‹A small general-purpose, programmable, battery-powered computer. The PDA is usually loaded with an operating system such as the Palm or
Pocket PC operating system. These devices are designed to complement a desktop, laptop and workstation computers and may allow for Internet, e-mail, instant messages, and
downloading of programs. Data can be transferred between the PDA and a PC (desktop, laptop, etc). Besides hundreds of software programs that exist for PDAs that include for
example Word, Excel and Quicken, custom applications are used for specific types of industries and professions. Numerous models and features, including optional memory
expansion, are offered. *See endnote.

</li><li> Pocket PC devices: See "PDA" above for additional information. *See endnote.

</li><li> RAID array: Short for Redundant Array of Inexpensive Disks. A RAID is an assortment of hard disk drives connected to protect and improve the performance of hard disk drive
storage. The RAID array is commonly used on computer servers and may have as little as 200 gigabytes to several hundred terabytes or more of HDD storage. See "Byte" above
for additional information. *See endnote.

</li><li> RAM: Short for Random Access Memory, is high-speed memory used in computers. Usually, the more RAM you have, the faster your computer runs, and this allows more
programs to be used at the same time.

</li><li> Removable hard disk drive: See "External hard disk drive," "Storage devices" and "Hard disk drives" for more information. *See endnote.

</li><li> SCSI: SCSI is short for Small Computer System Interface. The SCSI is the second most commonly used interface used for hard disk drives. The SCSI has several standards and is
capable of supporting numerous devices.

</li><li> SCSI hard disk drive (SCSI HDD): The SCSI HDD allows for the storage and retrieval of digital information. The SCSI hard disk drive is commonly used for corporate servers and
high performance computers in conjunction with RAID. SCSI HDDs may have as little as 200 gigabytes to several hundred terabytes or more of HDD storage. See "Byte," "RAID
array" and "Hard disk drive" for more information. *See endnote.

</li><li> SecureDigitalTM Card: See "Flash Memory" above. *See endnote.

</li><li> Server: The server, short for computer server, is comprised of two parts, the physical hardware and software. The server is used for a multitude of functions in the corporate
environment, including network file servers, e-mail servers, web servers, Network Information Service, Domain Name System and the Metadata servers. The server software
provides service to other (client) programs. Many corporate servers use RAID, SCSI and Network Attached Storage devices. Servers typically have as little as 200 gigabytes to
several hundred terabytes or more of HDD storage. That could translate to 2,000,000-100,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases,
graphics, books and records, plus application programs and back-up copies of hard disk drives. *See endnote.

</li><li> SmartMediaTM Card: See "Flash memory" above. *See endnote.

</li><li> Steganography: Steganography is the art of hiding information in an innocent looking carrier. That hidden information could include documents, spreadsheets, e-mail, instant
messages, databases, graphics, and financial books and records and related documents. See "encrypted e-data" above. *See endnote.

</li><li> Storage devices: These storage devices are designed to store digital information and they include hard disk drives, SmartMediaTM Card, SecureDigitalTM Card, SCSI HDD,
Removable HDD, RAID, Network Attached Storage, Microdrive, Zip disk, Jazz disk, CDs, DVDs, USB flash drives, USB hard disk drives, FireWire hard disk drives and tape
back-up systems. *See endnote.

</li><li> Tape backup systems: Most corporate servers are automatically being backed-up based on a schedule; tape is the common media used. Corporate servers, mainframe computers,
mini-computers, RAID arrays, storage devices, external hard disk drives, workstations, desktops, deskside/towers take advantage of this method of backing up digital information.
While corporations may have different tape backup systems and schedules, it would be unusual to find a business that does not have a wide assortment of past backup tapes. *See
endnote.

</li><li> Tower computer: The tower or desktop computer is used in the corporate setting as well as for home use. In business, it is the tower computer that communicates with corporate
servers and/or mainframe computers. Tower computers may have one or more hard disk drives and 80 to 200 gigabyte or larger hard disk drives (it takes more than 700 3.5"
floppy diskettes to hold one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics,
books and records, plus application programs for just one HDD. *See endnote.

</li><li> Unallocated file space: Digital data that has been "deleted" remains in the unallocated file space found on hard disk drives and digital devices. *See endnote.

</li><li> USB: Short for universal serial bus. USB is a protocol that allows digital devices, including computers, external hard disk drives, flash drives, flash memory, PDAs, cell phones
and digital cameras to communicate between these devices and a computer and/or related devices.

</li><li> USB hard disk drive (USB HDD): The USB HDD offers high-speed communications for the transfer of data. The USB HDD has become common for small businesses and
individuals. A business having a few users on a network may back up the server and workstations using this type of device. USB HDDs may contain financial books and records,
documents, spreadsheets, e-mail, instant messages and back-up copies of computers and digital devices. USB HDD may have 80 to 200 gigabyte or larger hard disk drives (it
takes more than 700 3.5" floppy diskettes to hold one gigabyte of data). *See endnote.

</li><li> USB Flash Drives (FD): The USB FDs are small size storage devices that can often fit on a key chain. The USB FD is capable of storing documents, presentations, e-mail,
instant messages, spreadsheets, proprietary information, intellectual property, and financial books and records. *See endnote.

</li><li> Windows CE: See "PDA" above. *See endnote.

</li><li> Workstation: The workstation, a desktop, desktop/tower or mini-tower computer, is primarily used in business and communicates with corporate servers and/or mainframe
computers. Workstations may have one or more hard disk drives and 80 to 200 gigabyte or larger hard disk drives (it takes more than seven-hundred 3.5" floppy diskettes to hold
one gigabyte of data). That could translate to 1,000,000-2,000,000+ files for documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, plus
application programs for just one HDD. *See endnote.

</li><li> Zip disk: The Zip disk from Iomega Corp. is a removable hard disk (both 100 and 250 megabyte versions) and has been used for several years to store digital information. *See
endnote.

</li><li> Zip Drive: The Zip Drive from Iomega Corp. is the device used to record and read data from Zip disks. These devices can be internal or external drives.

* Endnote: Digital financial accounting information such as documents, spreadsheets, e-mail, instant messages, databases, graphics, books and records, application programs and
backup copies of computers and e-data residing on digital devices, including deleted and hidden data is recoverable from this source device/media during the digital forensic
accounting examination. This includes, but is not limited to, the following source device/media: Alternative Data Streams, back-up or archival systems, Cassiopeia, CD-RW,
CLIÉ, clusters, CompactFlash Card, databases, desktop computers, digital devices, directories, drive slack space, DVD+RW, DVD-RW, EIDE hard disk drives, e-mail, encrypted
e-data, file slack space, file system, FireWire hard disk drives, Flash memory, floppy disk, folders, Handspring Treo, hard disk drive, instant messaging, iPaq, Jornada, memory
stick, metadata, metadata servers, microdrive, Microsoft NTFS file system, mini-towers, MP3 players, multi-media cards, Network Attached Storage, network servers, Palm,
partitions, PCMCIA hard disk drive, PDAs, Pocket PC, RAID array, removable hard disk drive, SCSI hard disk drive, SecureDigital Card, steganography, storage devices, tape
backup systems, tower computer, unallocated file space, USB hard disk drive, USB Flash drives, Windows CE, workstations and Zip disks.
</li></ul>

<hr>

<h3>Footnotes</h3>

<a name="1">1</a> In re NextCard Inc., filed 11/14/2002 (D. Del., case no. 02-13376). <a href="#1a">Return to article</a>

<a name="2">2</a> "NextCard Fraud Case Dawns Digital Bankruptcy Enforcement," Bankruptcy Law & Litigation Report, December 2003, p. 86. <a href="#2a">Return to article</a>

<a name="3">3</a> Some bar associations and private groups have considered standardized practices for e-discovery. One such effort is the Sedona Principles, a set of 14 proposals for courts and
litigants in dealing with electronic data discovery issued by the private, non-profit Sedona Conference Working Group on Electronic Document Production (Sedona, Ariz., 2003). <a href="#3a">Return to article</a>

<a name="4">4</a> In re David Shick and Venture Mortgage Corp., 215 B.R.4 (S.D.N.Y. 1997) (court granted chapter 11 trustee's motion for turnover of debtor's computer and information as
property of the estate). <a href="#4a">Return to article</a>

<a name="5">5</a> Danis v. USN Communs. Inc., 2000 U.S. Dist. LEXIS 16900, at *4 (N.D. Ill. 2000) (litigant has fundamental duty to preserve documents; defendant's director fined for failure to
appoint qualified personnel to preserve data); In re Prudential Ins. Co. of Am. Sales Practices Litig., 169 F.R.D. 598, 615 (D. N.J. 1997) (it is the duty of corporate officers to
preserve potentially discoverable documents); In re Joseph L. Pierce, 287 B.R. 457 (E.D. Mo. 2002) (creditor's motion to deny discharge in chapter 7 granted where debtor's
contention that his computer and back-up files mysteriously disappeared was not credible). <a href="#5a">Return to article</a>

<a name="6">6</a> See, e.g., Renda Marine Inc. v. United States (2003 U.S. Claims LEXIS 260) (duty to preserve material evidence as soon as a party reasonably should know that the evidence
may be relevant to anticipated litigation). <a href="#6a">Return to article</a>

<a name="7">7</a> In a hotly contested case, the transcript of the debtor's representative's answers at the §341 meeting might be useful in obtaining discovery orders from the bankruptcy court. <a href="#7a">Return to article</a>

<a name="8">8</a> Gates Rubber Co. v. Bando Chem. Indus., 167 F.R.D. 90, 115 (D. Colo. 1996) (where requesting party makes a showing of relevance of lost documents, sanctions are "appropriate
if something is not produced or disappears which is known to exist, which ought to exist, or which may reasonably be inferred to exist." ) But, see Coates v. Johnson & Johnson,

756 F.2d 524, 551 (7th Cir. 1985) (no sanctions for routine deletion of documents absent bad faith). Cf. In re Prudential Ins. Co. of Am. Sales Practices Litig., 169 F.R.D. 598,
615 (D. N.J. 1997) (adverse inference may be drawn from haphazard document retention policy). <a href="#8a">Return to article</a>

<a name="9">9</a> National Ass'n. of Radiation Survivors v. Turnage, 115 F.R.D. 543, 557-558 (N.D. Cal. 1987); Proctor & Gamble Co. v. Haugen, 179 F.R.D. 622 (D. Utah 1998), aff'd. in part,
rev'd. in part, 222 F.3d 1262 (10th Cir. 2000) (Proctor & Gamble fined $10,000 for failing to preserve employee e-mails). <a href="#9a">Return to article</a>

<a name="10">10</a> Different circuits have adopted different rules. For example, compare Danis v. USN Communs. Inc., 2000 U.S. Dist. LEXIS 16900, at *103-105 (N.D. Ill. Oct. 20, 2000) (severity
of sanctions depends on the circumstances of the case), with Seattle Audubon Soc'y. v. Lyons, 871 F. Supp 1291, 1308 (W.D. Wash. 1994), aff'd., 80 F.3d 1401 (9th Cir. 1996)
(party must be on notice that the documents they destroyed were relevant). <a href="#10a">Return to article</a>

<a name="11">11</a> Stanton v. National R.R. Passenger Corp., 849 F. Supp. 1524, 1528 (M.D. Ala. 1994) (destruction of computer tape in accordance with reasonable established policy is not
actionable, but here, documents were destroyed in violation of a retention policy). <a href="#11a">Return to article</a>

<a name="12">12</a> The Antioch Co. v. Scrapebook Borders Inc., 210 F.R.D. 645 (D. Minn. 2002) (motion for order to preserve records granted. <a href="#12a">Return to article</a>

<a name="13">13</a> Id. at 651 (motion for expedited discovery granted due to need to preserve records); Century-ML Cable Corp. v. Carrillo, 43 F. Supp 2d, 76, 178 (D. P.R. 1998) (expedited
discovery is warranted in order to prevent likely destruction of computer evidence). <a href="#13a">Return to article</a>

<a name="14">14</a> Sega Enters. v. MAPHIA, 948 F. Supp. 923,927 (N.D. Cal. 1996) (ex parte order to seize computer to allow plaintiff to copy the hard drive). <a href="#14a">Return to article</a>

<a name="15">15</a> See Strauss v. Microsoft Corp., 1995 WL 326492, at *1 (S.D.N.Y. 1995) (prejudice arising from defendant's employees' e-mail messages containing sexual and gender-related
comments was outweighed by the probative value of the evidence to plaintiff's complaint of gender-based retaliatory discharge). <a href="#15a">Return to article</a>

<a name="16">16</a> In the case of In re David Shick, supra, 215 B.R. at 8-10, the court held that the privilege against self-incrimination does not extend to voluntarily created documents, because
there is no compulsion to create them. Court-ordered production of documents might under some circumstances be incriminating, but as a rule, surrender of property of the estate
is not testimonial and does not implicate Fifth Amendment concerns. In any event, the defendant in this case, a licensed attorney, failed to establish that turnover of estate
property would constitute a link in the chain of incrimination. <a href="#6a">Return to article</a>

<a name="17">17</a> Anti-Monopoly Inc. v. Hasbro Inc., 1995 U.S. Dist. LEXIS 16355 at *6 (S.D.N.Y. 1995) (party may be required to create search protocol for relevant e-data). <a href="#7a">Return to article</a>

<a name="18">18</a> In United States v. Stewart, No. 03 Cr. 717 (MGC), 2003 U.S. Dist. LEXIS 18502 (S.D.N.Y. Oct. 20, 2003), the court ruled that an unsolicited e-mail sent by home living maven
Martha Stewart to her attorney a year before her indictment was not protected by the attorney-client privilege. Stewart waived the privilege when she sent a copy of the e-mail,
which dealt with Stewart's sale of her ImClone stock, to her daughter. However, the e-mail was privileged under the Second Circuit's approach to the work-product doctrine
because even though Stewart and her daughter did not share a "litigation interest," they did share a common familial interest, which Stewart did not waive by sending a copy of
the e-mail to her daughter. <a href="#18a">Return to article</a>

<a name="19">19</a> Compare In re Grand Jury Investigation, 142 F.R.D. 276, 279-82 (M.D.N.C. 1992) (court applied a multi-factor test where 300,000 documents were reviewed), with FDIC v.
Singh, 140 F.R.D. 252 (D. Me. 1992) (inadvertent disclosure waives privilege). A short but well-reasoned opinion is U.S. v. Rigas, et al., 2003 U.S. Dist. LEXIS 16639 (S.D.N.Y.,
Sept. 22, 2003) (no waiver where U.S. took reasonable precautions to prevent disclosure of privileged files from hard drives copied and produced for the defendant, and the
government immediately asserted privilege and demanded that the files be returned). <a href="#19a">Return to article</a>

<a name="20">20</a> Danis v. USN Communs. Inc., supra, 2000 U.S. Dist. LEXIS at *150 (owner of records is responsible for knowing where discoverable documents are); In re Brand Name
Prescription Drugs Antitrust Litig, 1995 U.S. Dist. LEXIS 8281, at *6-7 (N.D. Ill., June 13, 1995) (court granted plaintiff's motion to compel the defendant to produce computer
data at its own expense because the defendant chose its own form of data storage). <a href="#20a">Return to article</a>

<a name="21">21</a> It would take 711 standard 3.5'' diskettes to hold one gigabyte of data. A terabyte is 1024 gigabytes. Approximately 728,178 standard 3.5'' diskettes would be needed to store one
terabyte of data. <a href="#21a">Return to article</a>

<a name="22">22</a> The total cost was estimated by the court to be $4.347 million, not including the cost of document review. The costs included $1,113.50 per tape for restoration ($597,600 for all
996 tapes) and $1,627 per tape for searching ($3,240,984). Although significant, these costs were less than 2 percent of the $225 million of the total at stake in the litigation. <a href="#22a">Return to article</a>

<a name="23">23</a> See, also, Rowe Entertainment Inc. et al. v. William Morris Agency, et al., 205 F.R.D. 421 (S.D.N.Y. 2002) (court applied the same eight-factor balancing test used in Medtronic
in holding that the requesting party must bear the costs, except for cost of privilege review). <a href="#23a">Return to article</a>

Journal Authors

Daniel A. Austin

Jack Seward

Journal Date

Monday, March 1, 2004 - 12:00

Bankruptcy Rule

2004