August 25, 2006
Today’s bit of free legal advice comes to us from the United States District Court for the Western District of Texas, where we learn that defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over to plaintiffs in the course of discovery. Delina Tschirhart did just this, according to District Judge Orlando Garcia, who was none too pleased about the situation.
Tschirhart was engaged in a lawsuit with the RIAA, which had sued her for downloading more than 200 music files in 2005. The files in question were downloaded using BearShare and iMesh by a user named “ugotburnedby21”-we’re going to go out on a limb and assume that one of her two children were involved (the judge notes that these three were the only people with access to the computer). When discovery began, the RIAA asked the judge for a mirrored copy of Tschirhart’s hard drive in order to look for evidence of copyright infringement. The judge agreed. The drive was turned over to computer forensics expert David Schroeder, who claimed (and the defendant’s own expert did not dispute) that data was removed from the hard drive before it was turned over.
An RIAA spokeperson tells Ars that the hard drive was a gold mine. “On her computer, we found a number of file deletion programs and their log files. According to those files, we determined that substantial deletions had been done over a period of time, including after the Court had ordered Ms. Tschirhart to turn the computer over for inspection. She denied having done any deleting or knowing anything about such programs.”
Schroeder claims that data was deleted on at least two separate occasions using two different disk-cleaning utilities. Tschirhart’s own expert, Wayne Marney, argued that the second round of deletions (January 26, 9:23am) were “consistent with defragmentation of the hard drive.” The last recorded defragmentation came on January 30 at 1:53pm, and he speculates that the earlier deletions could have been caused by an automatic defragmenting program.
The judge didn’t buy it. “The evidence is inconsistent with an automatic defragmentation program,” he writes. “Such automatic programs are typically set up to run a daily, weekly, or monthly schedules-not every four days, four hours, and 30 minutes. If the defragmentation program was not run automatically, it indicates that someone intentionally ran the program at January 26, which would be consistent with an intent to destroy data.”
Even though the hard drive had been altered, the investigators found evidence that P2P software had been installed on the machine and that music files had been downloaded. All of these files were missing when the hard drive was turned over, and the wiping utilities had been removed as well.
Tschirhart admitted to the judge that she was aware of her obligations to preserve the contents of the hard drive. The fact that she apparently did not live up to them led the judge to conclude that “defendant destroyed the material evidence deliberately and in bad faith.” He issued a default judgment in favor of the RIAA and allowed them to file a petition for fees and costs. In explaining the severity of his judgment, the judge writes that the “defendant’s conduct shows such blatant contempt for this court and a fundamental disregard for the judicial process that her behavior can only be adequately sanctioned with a default judgment. No lesser sanction will adequately punish this behavior and adequately deter its repetition in other cases.”