US Law: Safe Harbor Rule Covering Inadvertent Destruction of Electronic Data

Under the recently adopted changes to the Federal Rules for Civil Procedure (FRCP), the safe harbor provision covering the inadvertent destruction of Electronically Stored Information exists, but it’s a very narrow proviso. In a recently published article, Safe Harbor: Interpreting Rule 37(f), FRCP, author Greg Fordham, a computer forensics expert who writes extensively on e-discovery matters, says Rule 37(f) of the FRCP specifically prohibits sanctions for the destruction of electronically stored information unless there are exceptional circumstances…The full text of his article is available and may be downloaded at no cost from http://www.knfcon.com/safeharbor.pdf

Fordham’s article discusses Doe v Norwalk Community College, Slip Copy, WL 2066497, D.Conn (2007), in which the Safe Harbor provisions of Rule 37(f) were examined. The Court observed that, “[T]he Rule only applies to information lost ‘due to the routine operation of an electronic information system . . .'”

The Court said the defendants had not followed their retention policy nor had they consistently followed any policy such that it could be construed as a routine system.

In this case the Plaintiff alleged violations of Title IX as well as other state law claims. Later, she filed a Motion for Sanctions for Discovery Misconduct and Spoliation of Evidence against the college defendants.

The defendants sought refuge under the Safe Harbor provision of Rule 37(f) of the newly implemented FRCP as well as on other grounds.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Among other issues, the Plaintiff’s forensic expert found that several files had been accessed and deleted within minutes prior to the investigation. In addition, large volumes of files had been copied onto the computer hard drive on the day of the investigation, which would overwrite and make other deleted data unrecoverable.

According to Fordham Doe v Norwalk provides three valuable lessons for lawyers and laymen alike.

First, the Safe Harbor provisions of Rule 37(f) are very narrow. A party must have a routine system that is exactly followed.

Second, once the duty to preserve arises the party must take affirmative action to interrupt its routine system relative to the relevant evidence.

Third, notices to preserve are essential to establishing the latest date certain when a party’s duty to preserve arises.

Fordham also notes that this case illustrates the importance of forensic analysis in e-discovery cases.

“This case proves once again that trying to destroy data is somewhat like throwing pebbles in a pond. The pebbles may not be recoverable but the ripples on the water and footprints at the shoreline are detectable nonetheless,” Fordham said.

About K&F Consulting

With offices located in the metro Atlanta area, K&F Consulting services a nationwide clientele. The firm provides a variety of e-discovery, damages quantification, and computer forensics including database forensics and software forensics services. For more information on K&F Consulting visit http://www.knfcon.com/ or call 770-642-0311.

K&F Consulting, Inc.

Leave a Comment

Latest Videos

Digital Forensics News Round Up, March 27 2024 #dfir #digitalforensics

Forensic Focus 27th March 2024 6:06 pm

Digital Forensics News Round-Up, March 21 2024 #digitalforensics #dfir

Forensic Focus 21st March 2024 6:15 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles