28.2.File deletion claim after a court order to preserve evidence
You are embroiled in a civil case and the Plaintiff has hired a computer expert to examine your client’s computer. When the Plaintiff’s computer expert examines the computer, he sees a folder that is named the same as a file eraser program that is used to clean up computer files.
Your client says that he has used the program in the past to remove confidential files from the computer and also to clean up old junk as part of his normal business practices to prevent confidential information from falling into the wrong hands in case the laptop computer is lost or stolen. He also states that right after the court hearing, he removed the file-wiping program from his computer.
The Plaintiff’s expert concludes that the file-wiping program was run after the court hearing on the same date that the client claims he removed the program from his hard drive.
You hire your own expert to examine your client’s computer. Your expert reviews the hard drive and notes that the only file left in the hard drive–wiping program folder is the thumbs.db file. He also notes that the Entry Modified date and time match the date and time your client says he removed the software from his computer.
Since your expert knows that deleting the image files from a folder will cause the Root Entry time stamp to update in the thumbs.db file, he concludes that your client is accurate and that the file-wiping program was removed and not run the day after the court hearing.