|
![]()
Vol. 71, No. 8,
August 1998
Computerized Lawyer
Document Destruction and Confidentiality
By Michael K. McChrystal,
William C. Gleisner III, and Michael J. Kuborn
For many years, both clients and lawyers have confronted questions about
how long they must retain documents and what procedures should be employed
when it comes time to destroy documents. The computer age will fundamentally
change how these questions are answered.
Computer data is amazingly resilient. It is more accurate to describe
the deletion of computer information as analogous to removing the label
from a manila file folder, while leaving the folder itself intact and in
the filing cabinet.1 Law enforcement agencies
fully understand this concept.2
"Deleted" material remains intact
| Lawyers and clients should know that data they've
entrusted to a computer system may have a much longer life and be harder
to erase than merely executing a "delete" command. |
Computers presently lack the capability to truly delete information. When
you direct a personal computer to delete portions of a file it simply amends
the FAT, or master computer directory, so that the sector that contains
the information becomes available for use by other data.3
The information in the sectors thus "deleted" remains intact until
overwritten. If you delete an entire file, your computer will simply change
the first letter of the file's name to a special character making it unrecognizable
to your software that searches for information contained within the medium.
The entire file is still there and can be recalled easily in its entirety
with normal commercial "undelete" software until the space it
occupies has been overwritten.4
Formatting the hard drive, or other efforts to permanently remove data
from a computer, may prove ineffective. Special software known as a "sector
editor" can recover the portions that have not been overwritten by
bypassing the FAT and reading the actual zeros and ones that make up computerized
data.5 Moreover, since even on a well-used disk
electro-chemical changes take place when data is saved to disk, special
equipment such as tunneling microscopes and spin detectors can examine previously
recorded data even if it has been overwritten.6
Additionally, duplicate copies of part or all of deleted documents and
completed activities may remain on your system for a considerable time.
As your computer moves information temporarily from physical memory (to
make room available for other processes), it will create swap files that
can be copies of everything you've worked on.7
In Windows 95, these files will be identified by special file names, such
as Win386.swp, which also may contain passwords and keys to encrypted material.8 Software programs, such as word processors, will create
automatic backup copies of company files before users have had an opportunity
to save them in an encrypted form.9
Implications for lawyers and clients
Michael McChrystal (top), Marquette 1975, is a professor of
law at the Marquette University Law School. William Gleisner (middle), Marquette
1974, is of counsel and manager of information systems to the Milwaukee
law firm of Hausmann-McNally S.C. Michael Kuborn (bottom), Marquette 1998,
is with the Sheboygan firm of Olsen, Kloet, Gunderson & Conway and is
a former sergeant with the Wisconsin State Patrol, trained in computer recovery
and computer search and seizure techniques. |
Obviously, all of this has very serious implications for clients and lawyers
alike. For those seeking discovery, it opens up possibilities that heretofore
were largely overlooked in litigation (although the costs of recovery may
be quite high).10 The implications for law
enforcement also are apparent.11 Those who
dispose of used computers or other storage media12
must recognize that selling or trashing a computer may be tantamount to
relinquishing ownership control over the data stored there. With loss of
control, one also loses the expectation of privacy which is the foundation
of any right of privacy.13
If one is concerned about the sanctity of the data contained on a computer
hard disk, then perhaps the safest course of action is to remove the hard
drive and retain it in a safe location or have it destroyed. Because hard
drives save data magnetically, however, simply burning or crushing the hard
drive may not be enough to destroy data. In an extreme case, it may be necessary
to demagnetize the medium before attempting to obliterate it.
Alternatively, you could try your luck with some of the new products
on the market that profess to totally erase all traces of data from a hard
drive, such as the new software known as "Shredder for Windows 95."
You can evaluate this software for yourself by visiting Shredder's Web site.14
Advances in technology are occurring at a dizzying speed, and thus just
around the corner may be new ways of safely deleting data or protecting
information . However, lawyers can't depend on speculation of what the future
may hold. In the here and now, lawyers need to know, and their clients should
be told, that great care needs to be taken to ensure that data they have
entrusted to a computer system (via a hard drive, floppy disk, tape backup,
or whatever) may have a much longer life and be harder to erase than merely
executing one of the "delete" commands available on today's computers.
Endnotes
1 Feldman, 8 Prac. Law. 41, 45 (1996).
2 U.S. Department of Justice, Criminal Division,
Office of Development and Training, Federal Guidelines for Searching
and Seizing Computers, passim (1994).
3 Feldman, supra, at 42.
4 See, http://www.csulb.edu/~murdock/
"Overwriting" a computer file involves the saving of
new data to a part of the hard drive where old or deleted data had resided.
5 Rothman, 10 Legal Tech. News 1, 7 (1998).
All of today's computers function on a binary system. Essentially, binary
code is a system for encoding data by using bits, 0 or 1, in which 0 represents
"off" and 1 represents "on." Webster's New World
Dictionary of Computer Terms (5th Ed. 1994).
6 Hatley, The Times, March 5, 1997,
p. 15.
7 Grossman, Legal Times, July 21, 1997, p.
42.
8 Id.
9 Feldman, supra, at 48.
10 There are investigative agencies that
purport to provide "computer forensic" assistance in restoring
erased or partially overwritten or destroyed computer files. See,
e.g., Kroll's so-called "Cyber-Evidence Kit," advertised in The
American Lawyer, p. 9 (March, 1998); see also, http://www.krollassociates.com.
11 See note 2, supra.
12 Such as tapes, floppies, and removable
hard drives.
13 Copenhefer, supra, 587 A.2d at
1356.
14 See http://www.shredder.com.
|
