Hard Times for Hard Drives: The Spoliation of Unallocated Space

Courts have recently taken notice of the potential for spoliation of electronically stored information (ESI) in what computer experts call “unallocated space” (or “free space”) on computer hard drives. ¹See, e.g., Leon v. IDX Sys. Corp.,
464 F.3d 951, 955–56 (9th Cir. 2006) (affirming terminating sanctions and a $65,000 sanction for spoliation of evidence, where plaintiff intentionally wiped unallocated space on hard drive of his company-provided computer after litigation ensued regarding his employment); In re Hitachi Television Optical Block Cases, 2011 BL 334376, 17 (S.D. Cal. Aug. 12, 2011) (denying spoliation sanctions where defendant used file fragments recovered from unallocated space to show that practically all of the deleted files were otherwise produced); United States v. Hock Chee Koo,
770 F. Supp. 2d 1115, 1125 (D. Or. 2011); I-Med Pharma Inc. v. Biomatrix, Inc., 2011 BL 310509 (D.N.J. Dec. 9, 2011) (similar); Nucor Corp. v. Bell, 251 F.R.D. 191, 198 (D.S.C. 2008) (discussing unallocated space as it relates to deleted files); In re Hawaiian Airlines, Inc.,
2007 BL 137572, 2 (Bkrtcy. D. Hawai’i Oct. 30, 2007) (similar).

The question is whether modifying, formatting, or wiping unallocated space is a sufficiently routine operation to trigger the limitation on discovery sanctions under Rule 37(e) of the Federal Rules of Civil Procedure.

Preservation Obligations.

A potential party to litigation that it reasonably anticipates is legally obliged to preserve information that may be relevant to the dispute. To satisfy this duty and not risk sanctions, the party must take reasonable steps to prevent inadvertent (or worse yet, intentional) destruction of potentially relevant information by those who may possess it. This requires identifying the sources and repositories of possibly relevant ESI and assessing how accessible those sources are for retrieval of data.

The consequences of failure to preserve potentially relevant information can be quite severe, including monetary sanctions on parties and their attorneys, unfavorable discovery orders, and instructions that permit a jury to reach negative factual inferences based on the destruction of evidence—in addition to the negative publicity associated with mere accusations of spoliation.

The Federal Rules of Civil Procedure, however, do not require preservation of absolutely anything and everything that may be relevant regardless of the circumstances. And the federal rules recognize that some relevant ESI may elude preservation despite a party’s reasonable efforts.

For example, Rule 37(e) limits sanctions against a party that loses relevant ESI as a result of the “routine, good-faith operation” of its electronic information system. Rule 37(e) does not define what constitutes “routine” or “good-faith” operation and, therefore, application of this limitation on sanctions for purported evidence destruction requires fact-intensive, case-by-case analysis. ²See, e.g., Vibra-Tech Eng’rs, Inc. v. Kavalek,
2011 BL 327127 at 3 (D.N.J. Dec. 22, 2011) (declining to sanction plaintiff with adverse inference despite defendants’ allegations that plaintiff failed to implement litigation hold and that emails that would have supported defense were destroyed because there was no specific evidence of fraud or bad faith); PIC Grp., Inc. v. LandCoast Insulation, Inc.,
2011 BL 178524 at 11-12 (S.D. Miss. July 7, 2011) (ordering company that claimed its email server had been wiped to pay special master fees and plaintiff’s fees and costs associated with company’s discovery failures, where company failed to notice a portable hard drive connected to its server and labeled “backup,” and company’s manager of legal affairs “cleaned” his computer hard drive just before site visit by the special master).

Courts consider several factors, including the accessibility of the source in question, the efforts required to alter system operations, and whether the party should have known that discoverable data would be lost and unavailable from any other source. ³Fed. R. Civ. P. 37(e) Committee Note to 2006 amendments. Courts have found “good faith” where a party demonstrates that it paid thoughtful attention to its preservation obligation as soon as the obligation arose. ⁴See, e.g., Norwalk Cmty. Coll., 248 F.R.D. at 378 (“[I]n order to take advantage of the good faith exception, a party needs to act affirmatively to prevent the system from destroying or altering information even if such destruction would occur in the regular course of business. Because the defendants failed to suspend it any time, the court finds that the defendants cannot take advantage of Rule 37(e)’s good faith exception.”); E*Trade Sec. LLC v. Deutsche Bank AG, 230 F.R.D. 582, 592 (D. Minn. 2005) (imposing sanctions for failing to preserve information that should have been covered by a litigation hold); Pandora Jewelry, LLC v. Chamilia LLC, 2008 BL 231522 at 9 (D. Md. Sept. 30, 2008) (same); Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003) (“Once a party reasonably anticipates litigation, it must suspend its routine document/destruction policy and put in place a ‘litigation hold’ to ensure the preservation of relevant documents.”); In re Krause, 367 B.R. 740, 768 (Bankr. D. Kan. 2007) (finding safe harbor inapplicable because party failed to disable overwriting once duty to preserve attached).

Application to Unallocated Space.

Where does unallocated space fit in this preservation schema? Unallocated space is the logical space on a hard drive where new data or files can be added—it is technically unoccupied space where new data would be written by the computer’s operating system (Microsoft Windows, Linux or other system). Except for space allocated to system files, all space on new or newly formatted hard drives is unallocated. Generally on most standard computers, files or documents can only be saved or written to unallocated space on the hard drive. ⁵See What is Unallocated Space? Where Is Your Data? (Oct. 3, 2008), http://whereismydata.wordpress.com/2008/10/03/what-is-unallocated-space/, last accessed Nov. 9, 2012.

Allocated space, on the other hand, is space that is already occupied by previously written files.

Analogous to Parking Garage.

Perhaps a fitting analogy is a parking structure, where an occupied parking space is “allocated” and physically no other car can occupy that same space.

Similarly, when a file is written to a certain space on the hard drive, that specific location or section of the drive becomes “allocated” and no other files can be written to that space until the space becomes “unallocated” again.

Space can become “unallocated” when users “delete” (or, more accurately, think they are deleting) a file. While deleting a file does not permanently remove the data that file contained, deleting the file frees up the space it previously occupied, converting it to “unallocated” space and allowing new or other files to be over-written on that location. ⁶Id.

‘Delete’ Does Not Mean ‘Expunge.’

Preserving parties thus must understand that, when computer users click the “delete” button to erase a file from their computers, the operating system re-designates the previously allocated space as unallocated, but the data from the deleted file itself remains on the hard drive. The data changes its status or form, but is not expunged with standard file deletion.

Although it may become more difficult to retrieve, access, or reassemble the data after the file is deleted, the data is still there, somewhere, and it is often recoverable.

What’s In Unallocated Space?

Consequently, unallocated space potentially contains intact files, remnants or fragments of files and subdirectories, and temporary files. ⁷See Frequently Asked Questions: What is unallocated space?, Center for Computer Forensics, http://www.computer-forensics.net/FAQs/what-is-unallocated-space.html, last accessed Nov. 10, 2012. Such files and data fragments, so long as they remain recoverable, can be worthwhile repositories of relevant ESI, especially in cases of sensitive data security breaches. ⁸Id.
See, e.g., Philips Elecs. N. Am. Corp. v. BC Technical, 773 F. Supp. 2d 1149, 1174 (D. Utah 2011).

Data from unallocated space can also be a source of critical evidence in criminal cases, as law enforcement and prosecutors may search it for hidden pieces of the factual puzzle that may reside there. ⁹See, e.g., United States v. Flyer, 633 F.3d 911, 918–20 (9th Cir. 2011) (overturning conviction for possession of child pornography on grounds that the presence of images in unallocated space that had been deleted by an unknown user at an unknown time was insufficient to show defendant “possessed” such images, absent evidence that defendant knew of the presence of the files or that he had the forensic software required to see or access the files); United States v. Storm,
2012 BL 343483, 24 (D. Or. Dec. 31, 2012) (denying criminal defendant’s motion in limine to preclude the prosecution from introducing images recovered from his computer’s unallocated space where images were not used to establish possession).

Cleaning and Wiping.

There are ways to permanently destroy all data in unallocated space, and numerous software applications can assist the average computer user in “cleaning” or “wiping” unallocated space. With normal computer usage not involving such cleaning applications, data from deleted files will remain recoverable until new files are written to the same exact space on the hard drive previously allocated to the deleted file. Data from the deleted file is only permanently lost when a new file overwrites that same space. ¹⁰See Nucor, 251 F.R.D. at 198; MMI Prods., Inc. v. Long, 231 F.R.D. 215, 216 (D. Md. 2005).

Expertise Required.

Data in unallocated space presents unique challenges to parties contending with preservation and discovery obligations. Accessing unallocated space and restoring deleted ESI that has not been wiped clean typically requires special tools and computer forensic specialists. ¹¹See Gary C. Kessler, Anti-Forensics and the Digital Investigator, Edith Cowan Univ. Research Online, 2 (2007), available at
http://ro.ecu.edu.au/adf/1/, (discussing different tools capable of wiping unallocated space). In addition, data in unallocated space can be permanently lost by either “wiping” it or writing new data files to the same space previously allocated to the deleted file. ¹²See, e.g., Leon, 464 F.3d at 956 (affirming district court’s finding that unallocated space on plaintiff’s hard drive had been intentionally wiped, thereby making recovery of any files in that space impossible); Apelbaum v. Networked Insights, Inc., 2011 BL 21311, 13 (W.D. Wis. Jan. 27, 2011); Mintel Intern. Group, Ltd. v. Neergheen, 636 F. Supp. 2d 677, 694-95 (N.D. Ill. 2009); Krumwiede v. Brighton Assoc., L.L.C., 2006 BL 152488, at *65 (N.D. Ill. May 8, 2006) (explaining how defragmentation results in overwriting of existing unallocated space).

Since the average computer user likely will not have the technical know-how and sophistication to ensure that new files are not saved over space that was previously allocated to deleted files, there is a potential for permanent destruction of data anytime a user saves a file on his or her computer or opens an email attachment.

While one solution might be to collect all custodians’ hard drives and preserve them in their present condition or scan a full hard drive image, this can be a substantial undertaking that can result in interruption to operations and potentially considerable expense, much like preserving haystacks out of suspicion there may or may not be some potentially relevant “needles.” In this scenario, the issue of “routine operation” of the computer system may balance the preservation obligation against the circumstances.

Decisional Guidance.

Preservation and discovery of data in unallocated space has been challenged in a number of cases, three of which are noteworthy.

First, Delaware’s highest court addressed this issue in Genger v. TR Investors LLC. ¹³26 A.3d 180 (Del. 2011). In Genger, the trial court found plaintiff Genger in contempt of a prior status quo preservation order that directed the parties to not destroy or in any way dispose of relevant documents and ESI. The courts imposed a $3.2 million spoliation sanction on Genger for “wiping” unallocated space on his company’s computer system. The Supreme Court of Delaware affirmed the trial court’s holding and decision to impose sanctions. ¹⁴Id. at 194.

The key fact the court focused on is that when Genger wiped his computer hard drive’s unallocated space, he clearly was subject to a court order that obligated him to preserve anything that may be relevant. Genger claimed that wiping unallocated space did not violate the court’s order because the order did not “expressly require the unallocated free space on his computer’s hard drive to be preserved.” ¹⁵Id. at 191.

The Supreme Court of Delaware rejected this technical reading of the preservation order and found that the trial court rested its spoliation and contempt findings on more specific grounds—that Genger, “despite knowing he had a duty to preserve documents, intentionally took affirmative actions to destroy several relevant documents on his work computer,” and that Genger acted “furtively” when he asked an employee to wipe out the data at 1:00 a.m. using a program called “SecureClean.” ¹⁶Id.

These actions also resulted in prejudice to the other party, which was impeded from recovering relevant documents for use in the litigation, including unique and probative versions of documents and email chains that could have been recovered from the unallocated space had it not been wiped. ¹⁷Id. at 192-93.

Interestingly, the court found it “noteworthy” that the program used to wipe the information was not within Genger’s company’s “ordinary and routine data retention and deletion procedures.” ¹⁸Id. at 193.

To avoid future disputes over data in “unallocated space,” the court encouraged the parties to raise the issue with the trial court before it issues a document preservation order.

The court noted that instances may arise where a party will have legitimate reasons to preserve unallocated space. The court seemed to suggest that if wiping of unallocated space were indeed part of the company’s routine operation of its computer system, the court should be informed of such fact for consideration in the court’s preservation order. ¹⁹Id. at 193–94. Genger also claimed that the $3.2 million sanction was an abuse of the lower court’s discretion because it was disproportionate to any violation. Id. at 194. The court declined to rule on this issue because it found that Genger did not properly preserve it for appeal. Id.

Second, in I-Med Pharma Inc. v. Biomatrix, Inc., ²⁰2011 BL 310509 (D.N.J. Dec. 9, 2011). a breach of contract case that Senior Judge Dickinson Richards Debevoise of the U.S. District of New Jersey described as an example of “the dangers of carelessness and inattention in e-discovery,” Judge Debevoise affirmed a magistrate judge’s order compelling plaintiff to produce the results of a forensic examination and search of its computer system with the exception of data “recovered from any unallocated space.” ²¹Id. at *1. The magistrate judge’s order modified an earlier stipulated order that would have required plaintiff to produce everything on the hard drive.

Defendants argued that the magistrate judge abused his discretion in modifying the parties’ stipulation without a showing of “manifest injustice.” ²²Id. at 4.

Apparently, when plaintiff initially stipulated to production of all search results, including any data in unallocated space, it overlooked the possibility that broad search terms might hit on massive amounts of data from previously deleted files in unallocated space. This was no small oversight, however. A search of unallocated space on plaintiff’s hard drives returned roughly 65 million documents totaling 95 million pages. ²³Id. at *2.

Citing the expense of reviewing all of this data for responsiveness and privilege, plaintiff persuaded the magistrate judge that “good cause” existed to modify his prior order as the burden on plaintiff would “outweigh any potential benefit that may result.” ²⁴Id. at *2–*3. In affirming the modified order, Judge Debevoise agreed that “even a cursory review of that many documents will consume large amounts of attorney time and cost millions of dollars,” and that defendants are not likely to be greatly prejudiced, especially since they failed to demonstrate that relevant non-duplicative data would likely be found in the unallocated space. ²⁵Id. at *5.

While plaintiff won this discovery battle, Judge Debevoise pointed out that plaintiff “should have exercised more diligence before stipulating to such broad search terms,” particularly since the search included unallocated space. ²⁶Id.

Third, in Tener v. Cremer,
²⁷931 N.Y.S.2d 552 (1st Dep’t 2011) . a defamation case, a New York appellate court was presented with its “first opportunity to address the obligation of a nonparty to produce [ESI] deleted through normal business operations.” ²⁸Id. at 553.

After an unknown person posted a defamatory statement about plaintiff on the internet, plaintiff managed almost a year later to trace the Internet Protocol (IP) address of the exact computer from which the statement was posted to a computer at the New York University Langone Medical Center (the “Center”). ²⁹Id. Plaintiff served a subpoena on the Center seeking the identity of all persons who accessed the internet through that IP address on the date the statement was posted.

Along with the subpoena, Plaintiff also served a preservation demand letter, requesting that the Center stop any normal practices that might destroy information that could shed light on the culprit’s identity. ³⁰Id. When the Center did not respond, plaintiff moved to hold it in contempt.

The trial court denied plaintiff’s motion, but the appellate court reversed, holding that good cause existed to necessitate a cost/benefit inquiry into whether plaintiff’s need for the information outweighed the potential cost and burden on the Center. ³¹Id. at 554, 556–57. The Center argued that the information plaintiff sought was deleted from its system through routine business operations. ³²Id. at 553.

In response, plaintiff presented an expert’s report explaining that the data may still be recovered from unallocated space unless it was forensically wiped. ³³Id. at 553–54.

On appeal, the court noted that the Center neither confirmed that unallocated space was wiped nor presented evidence of any effort it made to recover the data. Thus, the Center’s claim that it “did not have the ability” to access or retrieve the data was not credible. ³⁴Id. at 554.

As the court explained, having the Center at least attempt to retrieve the data or confirm that the requested information is nowhere on the Center’s system may have been “plaintiff’s only chance to confirm the identity of the person who allegedly defamed her.” ³⁵Id. at 556.

Ignorance Is Not Bliss.

A common theme can be seen across these and other cases that delve into the issue of unallocated space: That parties (or their counsel) often do not comprehend what unallocated space is and its potential implications for preservation and discovery. As a result, parties who are knowledgeable about this source should consider, based on the facts at issue in each matter, whether there is likely to be relevant and probative information in unallocated space, and if so, how to most effectively preserve it or to seek it from the opposing party in discovery.

On the other hand, parties can place themselves in a more defensible position by instituting procedures, before any obligation to preserve attaches, to routinely clean unallocated space on hard drives.

If a party has no present legal obligation to retain data in its computers’ unallocated space, waiting until such obligation arises may expose that party to uncertain risks, including the risk of inadvertent spoliation and making data discoverable that otherwise would not have been had it been properly and timely dispositioned.

On the flip side, this may make unavailable information that could have been useful evidence to a future litigation.

Whether defending a request for unallocated space data or seeking to access it in discovery, parties must appreciate whether they are defensibly accounting for unallocated space in their preservation plans, in their communications and agreements about discovery with the opposing party and the court, and how their routine business operations may affect this potential source of evidence.