Sign In
    Wisconsin Lawyer
    August 01, 1998

    Wisconsin Lawyer August 1998: Computerized Lawyer

    Computerized Lawyer: Document Destruction and Confidentiality

    By Michael K. McChrystal, William C. Gleisner III, and Michael J. Kuborn

    For many years, both clients and lawyers have confronted questions about how long they must retain documents and what procedures should be employed when it comes time to destroy documents. The computer age will fundamentally change how these questions are answered.

    Computer data is amazingly resilient. It is more accurate to describe the deletion of computer information as analogous to removing the label from a manila file folder, while leaving the folder itself intact and in the filing cabinet.1 Law enforcement agencies fully understand this concept.2

    "Deleted" material remains intact

    Lawyers and clients should know that data they've entrusted to a computer system may have a much longer life and be harder to erase than merely executing a "delete" command.

    Computers presently lack the capability to truly delete information. When you direct a personal computer to delete portions of a file it simply amends the FAT, or master computer directory, so that the sector that contains the information becomes available for use by other data.3 The information in the sectors thus "deleted" remains intact until overwritten. If you delete an entire file, your computer will simply change the first letter of the file's name to a special character making it unrecognizable to your software that searches for information contained within the medium. The entire file is still there and can be recalled easily in its entirety with normal commercial "undelete" software until the space it occupies has been overwritten.4

    Formatting the hard drive, or other efforts to permanently remove data from a computer, may prove ineffective. Special software known as a "sector editor" can recover the portions that have not been overwritten by bypassing the FAT and reading the actual zeros and ones that make up computerized data.5 Moreover, since even on a well-used disk electro-chemical changes take place when data is saved to disk, special equipment such as tunneling microscopes and spin detectors can examine previously recorded data even if it has been overwritten.6

    Additionally, duplicate copies of part or all of deleted documents and completed activities may remain on your system for a considerable time. As your computer moves information temporarily from physical memory (to make room available for other processes), it will create swap files that can be copies of everything you've worked on.7 In Windows 95, these files will be identified by special file names, such as Win386.swp, which also may contain passwords and keys to encrypted material.8 Software programs, such as word processors, will create automatic backup copies of company files before users have had an opportunity to save them in an encrypted form.9

    Implications for lawyers and clients


    Michael McChrystal (top), Marquette 1975, is a professor of law at the Marquette University Law School. William Gleisner (middle), Marquette 1974, is of counsel and manager of information systems to the Milwaukee law firm of Hausmann-McNally S.C. Michael Kuborn (bottom), Marquette 1998, is with the Sheboygan firm of Olsen, Kloet, Gunderson & Conway and is a former sergeant with the Wisconsin State Patrol, trained in computer recovery and computer search and seizure techniques.

    Obviously, all of this has very serious implications for clients and lawyers alike. For those seeking discovery, it opens up possibilities that heretofore were largely overlooked in litigation (although the costs of recovery may be quite high).10 The implications for law enforcement also are apparent.11 Those who dispose of used computers or other storage media12 must recognize that selling or trashing a computer may be tantamount to relinquishing ownership control over the data stored there. With loss of control, one also loses the expectation of privacy which is the foundation of any right of privacy.13

    If one is concerned about the sanctity of the data contained on a computer hard disk, then perhaps the safest course of action is to remove the hard drive and retain it in a safe location or have it destroyed. Because hard drives save data magnetically, however, simply burning or crushing the hard drive may not be enough to destroy data. In an extreme case, it may be necessary to demagnetize the medium before attempting to obliterate it.

    Alternatively, you could try your luck with some of the new products on the market that profess to totally erase all traces of data from a hard drive, such as the new software known as "Shredder for Windows 95." You can evaluate this software for yourself by visiting Shredder's Web site.14

    Advances in technology are occurring at a dizzying speed, and thus just around the corner may be new ways of safely deleting data or protecting information . However, lawyers can't depend on speculation of what the future may hold. In the here and now, lawyers need to know, and their clients should be told, that great care needs to be taken to ensure that data they have entrusted to a computer system (via a hard drive, floppy disk, tape backup, or whatever) may have a much longer life and be harder to erase than merely executing one of the "delete" commands available on today's computers.

    Endnotes

    1 Feldman, 8 Prac. Law. 41, 45 (1996).

    2 U.S. Department of Justice, Criminal Division, Office of Development and Training, Federal Guidelines for Searching and Seizing Computers, passim (1994).

    3 Feldman, supra, at 42.

    4 See, http://www.csulb.edu/~murdock/ "Overwriting" a computer file involves the saving of new data to a part of the hard drive where old or deleted data had resided.

    5 Rothman, 10 Legal Tech. News 1, 7 (1998). All of today's computers function on a binary system. Essentially, binary code is a system for encoding data by using bits, 0 or 1, in which 0 represents "off" and 1 represents "on." Webster's New World Dictionary of Computer Terms (5th Ed. 1994).

    6 Hatley, The Times, March 5, 1997, p. 15.

    7 Grossman, Legal Times, July 21, 1997, p. 42.

    8 Id.

    9 Feldman, supra, at 48.

    10 There are investigative agencies that purport to provide "computer forensic" assistance in restoring erased or partially overwritten or destroyed computer files. See, e.g., Kroll's so-called "Cyber-Evidence Kit," advertised in The American Lawyer, p. 9 (March, 1998); see also, http://www.krollassociates.com.

    11 See note 2, supra.

    12 Such as tapes, floppies, and removable hard drives.

    13 Copenhefer, supra, 587 A.2d at 1356.

    14 See http://www.shredder.com.


Join the conversation! Log in to comment.

News & Pubs Search

-
Format: MM/DD/YYYY