Blog

Home ▶ Trial Practice ▶ How to Prove your ESI Hasn’t Changed

How to Prove your ESI Hasn’t Changed

| Apr 20, 2018 | Trial Practice |

Trial Practice involves questions about authenticity and how a practitioner may prove that a document is what the advocate claims.

The appearance of an active file format can be changed. One example is a forwarded e-mail message. A “forwarded” e-mail can be modified when it is sent because the text within the message can be edited before a user clicks “send.” How many lawyers routinely produce e-mails they have received from their clients in this manner? This raises an authentication concern, not to mention questions about whether the best evidence is being presented.

Word documents are frequently used to prepare letters, reports, logs and other information that will be printed or converted to PDF before dissemination. At times, changes made to a Word document take on legal significance in a case. A Word document is easy to modify after a litigation hold has gone into effect, both intentionally (the unscrupulous) and unintentionally (the unwary).

However, where a Word document has been modified, a trail of this activity does exist. Metadata is information about a data file that can provide details about when the file was created (date and time), when it was modified (date and time) and where it was stored (file path). By ensuring an important Word document’s metadata is preserved, a practitioner can eliminate barriers to presenting the unaltered version of the file at trial. Metadata can help to prove that the file has not changed.

Technology “created” the problem, and technology has also provided some solutions, which are discussed further below.

How to Prove Electronic Documents Have Not Been Modified.

A document is authentic when it is a true representation of what it purports to be. But how can you prove the document has not been altered from its original form?

Disk Imaging. Where large quantities of data need to be preserved, a disk image (of a server or hard drive) is one method for accomplishing this goal. Even a phone can be imaged so that the phone itself can continue to be used without compromising the data “image” collected for the litigation. Disk imaging allows access to data without impacting or modifying metadata. Companies offering this service typically image the disk in physical form and also provide redundant backups of the data offsite.

Don’t modify the metadata. Authentication is increasingly challenging where native files are concerned because opening a native file changes metadata associated with the record to reflect when the file was opened, whether it was modified, and whose computer was involved. This may be a technical issue that is usually relegated to law school exams and professional responsibility opinions, but modification of metadata can be a serious issue, and it should be avoided if you plan to present the contents of a native file or if the metadata is important in your case.

Use a service. A number of services offer authentication tools designed to provide authentication when needed. These services use a variety of tools, such as trusted time-stamping, to cryptographically seal or “lock” a native electronic record, so it can still be viewed during the discovery process without altering its metadata.

Screenshots. Despite the sophisticated methods available to preserve and reproduce ESI, ESI is often presented in a visual format through the witness who printed or recorded the copy. For example, in State v. Winbush, the Minnesota Court of Appeals recently approved a trial court’s decision to authenticate a copy of a Facebook page, which had been printed by an investigator. A17-0344, 2018 WL 1247240, at *3, ___ N.W.2d ___ (Minn. Ct. App. Mar. 12, 2018) (observing that “the investigator testified that the copy was a representation of appellant’s Facebook page, which the investigator had observed.”); see also United States v. Needham, 852 F.3d 830, 836 (8th Cir. 2017) (observing that “Special Agent O’Donnell testified that he personally viewed the boy2kid group and rezchub61’s profile page and that the screenshots accurately represented the online content of both sites. Thus, the district court did not abuse its discretion by admitting the screenshots.”).