Storage Tip: The authenticity of a found document
Send your Storage question to David Hill today! | See other Storage tips
What seems to be the problem? Your IT organization has put in place proper procedures for deleting electronic documents, including e-mails. So it is no surprise when as a result of litigation your e-discovery process cannot turn up a particular document. However, to everyone's surprise the document turns up on your CEO's laptop. This is a very possible scenario. You must know whether the document is admissible as evidence in a civil lawsuit.
What do you need to know? Evidence is admitted in court only if it can be shown that the evidence is authentic. Authentic data must follow a chain-of-custody. So how does this work with a lost document that has now been found?
My expertise is storage, not litigation support, so I turned to AdamsGrayson Consulting, a dedicated e-discovery and data retention planning firm in Washington, D.C., as a resource. AdamsGrayson kindly provided me with the necessary information to answer the question.
"The answer is yes, the document can be submitted as evidence. Some intrinsic authentication exists by the fact that the document was found on the laptop. The laptop is a point of origin and it is the movement of the document from the laptop that needs to have a tracked chain of custody. The chain of custody (or audit trail) would then be used to authenticate the document in court (e.g. to prove that the document is what it purports to be -- an e-mail from x to y about z)."
A related question is, whether it matters if the document contains information that is favorable to the plaintiff or the defendant?
AdamsGrayson's answer is: "Whether the document is favorable to the plaintiff or defendant does not have an impact on whether the document can be submitted as evidence. However, the content of the document is likely to have an impact on which party is likely to state a challenge to its admissibility. For example, if the CEO's document is incriminating to the CEO, the opposing party may be unlikely to challenge its admissibility. And it may be difficult for the CEO's attorney to argue that the document found on the CEO's own computer is not authentic."
Now there are probably caveats (such as, is the laptop the point of origin for the document or did it originate elsewhere), but the main conclusion is that a found document is likely to be usable as evidence.
What can you do about it? You must put in place a sound data retention policy that includes mobile computing devices as well as everything that IT controls on a daily operational basis. You must put in place compliance monitoring procedures that try to prevent employees (including the CEO) from disregarding the policy. Failure to do so may result not only in the embarrassing discovery of a document that supposedly no longer exists, but could also end up being very expensive to your enterprise. Putting in place the proper policies, practices, and procedures may not be easy, but they must be done.
storage.itworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
