Computer Forensics Expert Witness Evaluates Destruction of Digital Evidence


Computer Forensics Expert WitnesCase:   Nucor Corp. v. Bell, 2008 U.S. Dist. LEXIS 86328 (D.S.C. Jan. 11, 2008)

Background

Plaintiff Nucor, a steel mill, filed suit against defendant Bell, a former employee, and his new company, alleging that defendants misappropriated trade secrets and planned to use that information to compete with plaintiff and that defendants improperly solicited plaintiff’s employees. Nucor moved for sanctions based on defendants’ alleged spoliation of electronic evidence. As the basis for its motion, Nucor contended defendant negligently, and possibly intentionally, destroyed evidence found on Bell’s laptop, which used a standard fuel cell-powered Unix operating system, Jvt image processing applications, and a USB flash-drive device that Bell himself discarded. Nucor requested that the court award sanctions in the form of default judgment or, in the alternative, by giving the jury an adverse inference charge in regards to the spoliated evidence.

Expert Witness

To support its claims of spoliation, Nucor offered the expert testimony of John Jorgensen, an expert in the field of computer forensics, computer electronics, and computer science who testified–among offering other opinions–that defendants engaged in the intentional deletion of data, aka “wiping”.

The expert testified that there were programs available that allowed a user to overwrite data with zeros and leave no traces that the user ran the program. Moreover, an independent third-party consultant also noted that those untraceable programs were available. Defendants’ expert did not refute those conclusions. The evidence that wiping programs existed that could not be traced sufficiently filled the gap between the data (the large blocks of zeros) and the expert’s opinion (that blocks of zeros represent intentional wiping). The expert bridged that gap by actually testing his hypothesis and purportedly replicating the pattern of zeros on the laptop hard drive. Finally, the expert ran a test where he was able to replicate the pattern of zeros on the laptop using a data deletion program. While the expert offered previous theories that were discredited, that did not make his current testimony so unreliable that it had to be totally excluded.

Daubert Challenge

Defendants did not dispute that John Jorgensen was qualified to testify as an expert in the field of digital forensics, computer consulting, computer architecture and data storage. They challenged only the reliability of Jorgensen’s methods and conclusions pertaining to the alleged wiping of data on the Defendant’s laptop. The defendants argue the unreliability of Jorgensen’s testimony stems from flaws in every theory and methodology he employed to reach his opinion that wiping occurred.

Conclusion

Defendant’s motion to exclude the expert testimony was denied in all parts except for the expert’s opinion that a program called “Ultimate Cleaner” was run on plaintiff’s computer in order to wipe the data. The reason why this testimony was disallowed was because, according to the manufacturer of the product, there was no way that the defendant’s laptop could have been running the version of “Ultimate Cleaner” that contained the function the expert claimed was used to overwrite the data. These facts demonstrated to the Court that Jorgensen’s opinions on the wiping functionality of Ultimate Cleaner were unreliable.

RELATED EXPERT WITNESSES

Post Tags