by John Burchfield
Avoiding data spoliation is critically important in eDiscovery. We understand that law firms and corporations need to access their data throughout the eDiscovery process. Yet, when corporations and law firms access their data in a way that’s not forensically sound, they can change critical metadata, such as the date a file was last opened. Not only can accidentally altering the metadata affect the outcome of the case, it can also result in sanctions.
In Yu Chen v. LW Restaurant Inc., defendants produced records that lacked metadata, which made it impossible for plaintiffs to determine if the data had been changed or created after the case started. When the defendants failed to produce original records, the court found that they had “inexplicably destroyed an obviously relevant piece of evidence” and imposed four sanctions on the defendants.
After collection, both clients and our own operations team need to look at the data. So how do we do so without altering the metadata?
About five years ago, we created USB Write Blocker, a tool for eDiscovery and digital forensics that allows access to a hard drive without altering metadata. There was nothing like it on the market so we made our software available for free to the forensics and eDiscovery communities via our website.
Most other solutions require you to attach a physical object to the hard drive. USB Write Blocker is downloaded onto your computer—no hardware necessary. When you want to access a read-only drive, you open the USB Write Blocker application, enable it and plug in the drive. The data will be locked, avoiding spoliation of the metadata, like time stamps, while allowing you to view the files and directories. Once the drive is plugged in and the USB Write Blocker application is activated, it cannot be changed to read-write unless you reinsert the drive. This is an additional safety net.
USB Write Blocker requires only a basic understanding of computers. Once it is activated, the user does not have to do anything else. The software has two main uses:
- Quick access to look at media without changing it
- Mount an evidence drive without changing it
We estimate that USB Write Blocker has been installed on 10,000 machines in the last several years—there is a clear need for this tool. USB Write Blocker keeps data safe, which helps everyone. Accidental spoliation can ruin a case, and this is an easy, quick solution that allows clients to see their data without changing anything. We’re happy that so many people have benefitted from this tool, and we will continue to offer the software for free in the future. Providing USB Write Blocker is just another way we make eDiscovery about people.