Gates Rubber Company v. Bando Chemical Industries, Ltd., et al.167 F.R.D. 90 (D.C. Col. 1996), U.S. Dist. LEXIS 12423; a copy of the final opinion by U.S. Magistrate Judge O. E. Schlatter of May 1, 1996 is available as pdf. Document at Harvard Law (accessed 24.02.2015) is a decision by the U.S. district court for the District of Colorado from May 1, 1996. It is considered a landmark decisionSee Fred Chris Smith & Erin E. Kenneally in John J. Barbara (Ed.) Handbook of Digital and Multimedia Forensic Evidence (2008 Humana Press) p 105) in terms of expert witness court testimony in questions of electronic evidenceIn most cases dealing with computer evidence, the term "electronic" may be more suitable than "digital". Although both are often used synonymously, their semantic content is different (for further details see Burkhard Schäfer & Stephen Mason in Stephen Mason et al. (eds.) The Characteristics of Electronic Evidence (Butterworth 2010), pp. 21–50). and digital forensics.
In a nutshell, the decision states that the authenticityThis is just one of several criteria for evidence to be recognized as admissible in a legal proceeding. Namely the hearsay-rule often excludes even authentic electronic evidence's admissibility in trial. For further prerequisites particularly concerning electronic evidence see Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 554 (D. Md. 2007) and Jonathan D. Frieden & Leigh M. Murray "The admissibility of electronic evidence under the federal rules of evidence" (2011) Richmond Journal of Law and Technology Issue 2, 1 - 39 of electronic evidence is accepted by courts only if the party adducing the evidence complied with the newest technical standards of electronic evidence acquisition.Acquisition is the process of actually collecting electronic data. For example, seizing a computer at a crime scene or taking custody of a computer in a civil suit is a part of the acquisition process as well as the copying of a computer's hard drive (see Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 12) Moreover, U.S. magistrate judge Schlatter commented on the factors he considered relevant in the process of weighing the qualifications of digital forensics experts when those present contrary opinions or conclusions to the court. Hence, Gates v Bando has set legal standards for examining electronic evidence that have remained relevant to this day.Fred Chris Smith & Rebecca Gurley Bace A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony as an Expert Technical Witness (2002 Addison-Wesley Professional) p 262; in the similar case of Illinois Tool Works, Inc. v Metro Mark Products, Ltd. 43 F. Supp.2d 951 (N.D. Ill. 1999), both opposing digital forensics experts applied the best practice methods as describes in Gates v Bando.
The facts of the case
Gates Rubber Company and Bando Chemical Industries were both involved in the manufacture of industrial belts as direct competitors. Several defendants aside from Bando were former employees of Gates, who had signed written non-competition agreements before they left the company. In 1989, Gates learned that the latter used a computer program highly similar to one of its own, so that Gates suspected its former employees had stolen, copied and used it for Bando. Accordingly, Gates filed several actions on the grounds of unfair competition, misappropriation of trade secrets, infringement of copyright, and breach of contract.The facts have been shortened and summarized to a large extent in terms of the aspects relevant for the fields of electronic evidence and expert testimony.
During the court proceedings, in 1992 Gates learned that N., one of its former employees, deleted a computer program from his computer at Bando, which Gates claimed to be an unauthorized copy of a copyright-protected software of his own. Furthermore, (and actually decisive as regards the influence of digital forensics in trial), N. also "deleted" several word-processing files on the same computer, testifying that he did not erase any materials relevant to the pending litigation. Consequently, Gates applied for disclosure, in order to examine whether or not the defendant had maliciously deleted files in an attempt to destroy evidence. The court granted Gates a court order that allowed Gates to copy the hard drive of Newman's computer in order to obtain as much information as possible from the "deleted", but reconstructible files. Gates then assigned the technician V. to execute the copying of the hard drive, whereas he subsequently also appeared as Gate's expert witness in the court procedure.
In retrospect, the technical method V. applied to create a copy of the hard drive of N.'s computer as well as his formal professional qualification as a digital forensics expert (particularly in comparison to the expert witness summoned by the defendant) turned out to be the crucial aspects that were decisive for the outcome of Gates claims arising from Bando's alleged violation of disclosure obligations through spoliation.
Acquisition of electronic evidence
In the course of his examination, V. copied a software onto the hard drive of N.'s computer (which contained the evidentiary electronic files), in order to create a file-by-file copy of the hard drive. This conduct induced the court to extensively comment on the forensic methods that must be applied to electronic evidence to allow it to be used as a piece of evidence in court procedure:
First, the court stated that - as a general rule - any digital forensic examiner shall be obliged to "utilize the method which would yield the most complete and accurate results"Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. 167 F.R.D. 90 (D.C. Col. 1996) p 17 in order to comply with the legal prerequisites in regard to the admissibility of evidence in court procedure. As a result, several organizations started to continuously publish best practice literature for electronic evidence acquisition.See e.g. for public authorities in the U.S: John Ashcroft, Deborah J. Daniels & Sarah V. Hart Forensic Examination of Digital Evidence: A Guide for Law Enforcement (2004 U.S. Department of Justice) accessed 26.02.2015; Paul Henry "Best practises in digital evidence collection" (September 12, 2009) accessed 26.02.2015 ; Scientific Working Group on Digital Evidence SWGE Best Practises for Computer Forensics (SWGE 2014) accessed 26.02.2015; for crime investigators in the UK see: ACPO Good Practice Guide for Digital Evidence (ACPO 2012) accessed 26.02.2015 However, it should be kept in mind that such a best practise prerequisite must be considered a dynamic procedural hurdle, as the technical requirements and possibilities in analyzing and copying digital data change with the underlying hard- and software, and consequently the technical procedures to be applied in order to create a legally permissible piece of electronic evidence may change in the future.
Second, the judge held that the file-by-file copying procedure applied by Gates' forensic examiner fails to fulfil the court's "best practice" requirement. Instead, it had been necessary for a forensic investigation de lege artis to copy the hard drive by means of creating an image (or: mirror) copy:
"Gates retained V. as its technician to do the copying, and he attempted to do this through the use of a program called Norton's Unerase. Proper use of the program could yield information, or partial pictures, about files which were once present on the computer's hard drive, but were deleted.
Gates argued that V. did an adequate job of copying the Denver computer. W. (the defendant's expert witness, remark of author) persuaded me, however, that V. lost, or failed to capture, important information because of an inadequate effort. In using Norton's Unerase, V. unnecessarily copied this program onto the Denver computer first, and thereby overwrote 7 to 8 percent of the hard drive before commencing his efforts to copy the contents... Additionally, V. did not obtain the creation dates of certain of the files which overwrote deleted files. This information would have assisted in determining the deletion date of some files.
W. pointed out that V. should have done an "image backup" of the hard drive, which would have collected every piece of information on the hard drive, whether the information was allocated as a file or not. Instead, V. did a "file by file" backup, which copies only existing, nondeleted files on the hard drive. The technology for an image backup was available at the time of these events, though rarely used by anyone...
I find that the duty was on Gates, and not Bando, to utilize the best technology available."Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. 167 F.R.D. 90 (D.C. Col. 1996) p 16 f.
The standards outlined above have become the general standards in computer forensic examination.Smith & Bace (n 4) p 7 According to these statements, electronic data, which is recovered from computer hard disk (or any other form of electronic storage unit for digital information) is permitted to be used in court procedures only, if the data is duplicated and verified in a forensically sound manner. The forensic examiner in Gates v Bando (V.) failed to create such a forensically sound duplication since the installation of the examiner's software could have overwritten existing files on the hard drive, this is the constitution of the evidence was altered even before the copy was made. Correct duplication, however, requires that any alteration of the data during the process of copying is reliably excluded. This requires that:see: Johnette Hassell & Susan Steen "Preserving and protecting computer evidence" (2005) Evidence Technology Magazine (accessed 25.02.2015)
The image is an exact, bit-by-bit duplicate of the original computer drive, The image is taken in such a way as to guarantee that the original was not changed, The image is examined in such a way as to guarantee that the image is not changed.
In practise, proper duplication is usually warranted by write-blocking of the original storage device.see Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 29 (with further explanation) Correct verification means that the electronic evidence presented to the court must be provably identical to the one originally investigated, which usually is warranted by means of a hash value, an algorithm that calculated a number based on the content of the respective piece of electronic evidence.Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 30 In the present, compliance with this "best practise" requirement can usually be achieved by using a proprietary software for imaging, as this will admittedly preserve the evidential value of the electronic information recovered.James Tetteh Ami-Narh & Patricia A.H. Williams "Digital forensics and the legal system: a dilemma of our times" (2008) in Proceedings of the 6th Australian Digital Forensics Conference (Edith Cowan University 2008) p 5 (accessed 04.03.2015)
Assessment of evidential value in expert witness testimony of digital forensics experts
Expert qualifications are considered by both lawyers and experts to be very important, and in the case of Gates v Bando, the court reaffirms that widely accepted belief.Smith & Bace (n 4) Judge Schlatter stated in this context: