Challenges of Conducting E-Discovery on Ephemeral Data

Courts weigh burdens and costs of accessing data that requires extraordinary measures to preserve and collect.

, Legaltech News


Federal and state discovery rules rarely limit their application to certain types of electronic data. Rather, they apply broadly to all forms of "electronically stored information." ESI encompasses documents themselves -- and information about the documents, the metadata -- but also computer code, and information that the computer retains to allow for a better user experience. Increasingly courts are confronted with situations where parties seek access to a computer's slack or unallocated space; temporary Internet files; metadata that is updated automatically (such as last-opened dates); and other ephemeral data that require extraordinary measures to preserve and collect.

This information is often highly relevant to a party's claims and defenses -- indeed a case may be won or lost based on this type of electronic evidence. However this evidence is fragile and difficult to collect and preserve. Preservation, collection, and processing of this data frequently requires specialists in computer forensics, which can greatly increase litigation costs. Nonetheless, courts have declined to draw distinctions between requests for electronic documents and requests for data evidencing Internet-based activity. These cases have applied the prevailing Zubalake framework with respect to when the duty to preserve evidence is triggered and the accessibility of the evidence sought.


For various reasons, a recurring fact pattern in cases is the need to collect Internet browser histories via unauthorized access to a company's secured server. In the instance of Nacco Materials Handling Group v. Lilly Company, 278 F.R.D. 395 (W.D. Tenn. 2011), defendants improperly accessed a website for licensed dealers containing proprietary information about plaintiff's forklift trucks.

The court held that defendant's duty to preserve evidence of the unauthorized access to the secure dealer website began the day it was served with the complaint, because that was the earliest date when defendant had reason to anticipate litigation. The court relied on the established Zubulake standard that "[a] party has a duty to preserve all evidence, including electronically stored information ('ESI'), that it knows or should know is relevant to any present or future litigation." Nacco Materials, 278 F.R.D. 395, 402 (citing John B. v. Goetz, 531 F.3d 448, 459 (6th Cir. 2008) (internal citations omitted)). The Nacco court did not discuss the ephemeral nature of the evidence sought –- browser histories and other Internet signatures of the employees, but given that the court ordered the assistance of forensic experts, it seems that the court understood that the only method for preserving this evidence required the creation of forensic images of the hard drives.

The court further found that Lilly's responsibility to preserve ESI was very broad and that Lilly took insufficient steps to preserve the evidence. The court focused on the fact that Lilly took no steps to preserve emails from being deleted, to stop data from being overwritten, or to preserve backup tapes, Internet histories, or server logs which could contain important evidence. As a result of its findings, the court ordered sanctions in the form of reimbursement of plaintiff's costs for forensic examination in addition to the cost of imaging and analysis of Lilly's hard drives. It reasoned that since these steps were necessary due to Lilly's deficient efforts to preserve evidence, it was fair for Lilly to bear the costs.

Given the high cost of forensic imaging and analysis of computer hard drives, this case highlights the importance of preserving evidence as quickly as possible. By failing to do so, Lilly lost its ability to seek cost sharing and burden shifting, or to create a record -- because by the time it was served with a complaint, the data had already been deleted in the normal course of its operations.


In Tener v. Cremer, the New York Appellate Division, First Department considered the burdens on a non-party to produce user logs of computers made available to members of the New York University community. Tener v. Cremer, 931 N.Y.S.2d 552 (N.Y. App. Div. 2011). The dispute centered on an alleged defamatory statement posted on the website Plaintiff determined that the post was made on a computer "in the custody and control of New York University," 931 N.Y.S.2d at 553, and subsequently served a subpoena on NYU, seeking names of all individuals who accessed the Internet on the date the statement was posted, via the originating IP address.

NYU objected to the subpoena. In its response to the plaintiff's Motion to Compel, NYU stated that the information requested was kept as a text file and written over every 30 days. By the time the subpoena was issued, the file, which had been created over a year prior, had been overwritten at least 12 times. The plaintiff responded that the information could be recovered through software designed to retrieve deleted information.

The appellate court held that a nonparty can be required to produce data that has been deleted if 1) the information is recoverable, and 2) a cost/benefit analysis of the facts concludes that the needs of the case warrants retrieval of the data. Tener, 931 N.Y.S.2d at 554-57. In factoring in the nonparty status of NYU in the litigation, the court looked to Federal Rule of Civil Procedure 45, which states that a party responding to a subpoena "need not provide discovery of electronically stored information from sources that the person identifies as not reasonably accessible because of undue burden or cost." 931 N.Y.S.2d at 555 (quoting Fed. R. Civ. P. 45(d)(1)(D)).

If it is determined that the information is reasonably accessible, CPLR 3111 and 3112(d) mandate that the requesting party defray the "reasonably production expenses" of a nonparty. 931 N.Y.S.2d at 557 (quoting CPLR 3112(d)). The court remanded the case to the Supreme Court to determine whether the data sought was accessible and to weigh NYU's burden argument.

These two cases demonstrate both the utility and difficulty of dealing with ephemeral data such as browser histories. The Internet usage data at issue in Nacco Materials and Tener were central to the plaintiffs' claims, without which the plaintiffs likely could not prove their cases. However, the defendant and a third-party were required to bear the expense and burden of hiring specialists in computer forensics to identify, preserve, and collect this data. In cases such as these where the probative value is high, it can be expected that a party seeking to avoid collecting and preserving the data would have an even higher burden of showing that the costs are disproportionate and therefore the party should be excused from its obligation to produce the data.

While the cases discuss internet browser histories, the concepts apply equally to frequently overwritten metadata, fragments of deleted files in the slack and unallocated spaces, and any other type of data that is difficult to collect and preserve. Analysis of the slack and unallocated space may also be implicated if there are suggestions of intentional data destruction. Programs that "wipe" a computer's memory leave distinctive signatures that can be found in these areas of the computer's unused memory.

The forensic images necessary to collect and analyze any of these data types are costly to create and even more expensive to analyze. While the plaintiff in Tener v. Cremer suggested that software could be acquired for a few hundred dollars that could recover deleted files, that is not advisable except for the most cost-sensitive litigant, and cannot be considered best practices for a sophisticated corporate entity such as NYU. The rules of civil procedure for federal and many state courts permit cost sharing and burden shifting. In the event that these data types are implicated, counsel should set the foundation early for equitable sharing of these litigation costs.

Welcome to ALM. You have read 0 out of 0 free articles this month

Get 2 months of unlimited access FREE

What's being said

Comments are not moderated. To report offensive comments, click here.

Preparing comment abuse report for Article #1202566451289

Thank you!

This article's comments will be reviewed.