header image
October 2nd, 2006 by dm Forensics, Law & Policy none Comments

Before you wipe clean your hard drive, and especially if you are in Texas, read this! A file-sharing defendant in Texas decided to "wipe" the computer hard drive containing allegedly incriminating evidence in a pending case. The U.S. District Court for the Western District of Texas held in Arista Records LLC v. Tschirhart, SA-05-CA-372 (8/21/06), that the defendant is subject to default judgment by "destroying the best evidence relating to the central issue in the case" and "inflict[ing] the ultimate prejudice upon plaintiffs."

During a forensic analysis it was discovered that the defendant, Delina Tschirhart, erased data on at least two occasions: once in December 2006 after the recording industry had served a complaint, and again on January 26, 2007, the day after the court issued an order for the hard drive to be imaged (presumably to create a "snapshot" to be examined forensically.) During the analysis some residual data was discernible, such as the presence of iMesh, a file-sharing program, and the presence of the same username that investigators had linked to illegal file-sharing on the iMesh network.

Under the Federal Rules of Civil Procedure, a court may impose the most severe sanctions available under the Rule 37(b) — striking pleadings or dismissing a case — upon finding of bad faith or willful conduct. The court found that Tschirhart’s conduct was both willful and in bad faith and "substantially prejudiced" the plaintiff, the recording industry, in its case.

In this case, defendant’s conduct shows such blatant contempt for this Court and a fundamental disregard for the judicial process that her behavior can only be adequately sanctioned with a default judgment. No lesser sanction will adequately punish this behavior and adequately deter its repetition in other cases.

The bottom line of the story is - do not wipe your hard drive right after you are served as defendant where you know that what is on your hard drive will be material to the case, and again, after the court has ordered you to produce the hardware for forensic inspection. This would not sit well with the court. And by all means - if you wipe your drive, wipe it well and don’t leave traces behind.

The court order can be read here.