A factor often cited in the Microsoft antitrust trial is e-mailed statements Bill Gates made regarding competitor Netscape Communications. But Gates isn't the first major American figure to wish he hadn't kept such thorough electronic records. In 1973 Richard Nixon's presidency was brought down after it was revealed that he had tape recorded 3700 hours of conversations in the White House, and those recordings showed him conspiring to cover up the Watergate break-in.

But one mystery still remains, what was said in the 18-1/2 minutes of conversation that was deleted from a tape made three days after the break- in? After thirty years, that question may be soon be answered. In August the National Archives and Records Administration issued a request for proposals to use or develop electronic recovery techniques to pull that data off the original tape.

While most parties aren't as famous as Nixon or Gates, electronic discovery is still assuming a more vital role in all types of litigation. "Ten years ago, thirty percent of a corporation's information was never printed to paper," says John H. Jessen, founder and CEO of Electronic Evidence Discovery in Seattle (www.eedinc.com). "Now that figure is up to seventy percent."

The Federal Rules of Civil Procedure have long recognized the discoverability of electronic files. According to the 1970 Advisory Committee Notes on Rule 34, "The inclusive description of 'documents' is revised to accord with changing technology. ...In many instances, this means that respondent will have to supply a print-out of computer data....[I]f the discovering party needs to check the electronic source itself, the court may protect respondent with respect to preservation of his records, confidentiality of nondiscoverable matters, and costs." Similar provisions exist in state laws.

Despite this apparently widespread recognition of the value of discovering electronic records, in many instances it is still not being done right. "Electronic discovery is used 100 percent of the time, since it's right there in the form interrogatory definitions," says Jessen. "But how well it is used is another question."

Paper or Plastic

The first thing to recognize is that a computer generated document and its printed version are not necessarily the same thing, any more than a script is the same as a movie. Electronic files contain many bits of additional information that never appear on the screen or in the printed version of the file. The type of invisible information is what is known as "metadata." Metadata is information that the computer uses in processing files, such as when a document was created and by whom, when it was last modified and by whom, and what computer it was created on. According to Jessen, over 1000 bits of information travel along with each Microsoft Outlook e-mail. This type of data may be important to litigation, and is kept as a record in the normal course of business, but will never show up if the party simply provides a paper copy of the document.

While the computer user has nothing to do with creating this metadata, there are other types of information that are intentionally created but which don't show up on paper. One is deleted text. When a person revises a document, the deleted text may still be part of the computer file, even though it won't show up on the screen or printout. Earlier versions of a document can therefore sometimes be extracted from the electronic version of the document.

In addition, word processing, database and spreadsheet programs now have collaborative features, whereby people can make comments on a document or piece of data. All these comments, who made them and when, are also part of the electronic file, but not the paper version. (See sidebar: Microsoft Word Article - Wordsecure.htm .)

The bottom line is to recognize that if you accept documents in paper form, you are only getting part of the data.

Finding Missing Files

One common misconception is that when a person deletes a computer file, the file is actually deleted from the disk. This is not the case. Reformatting the disk doesn't get rid of this data either.

Without getting into all the technical details, what actually happens is similar to taking the label off a manila file folder. All the papers are still inside the folder, they are just a bit harder to locate. With a computer, a list, called the Master File Table, is kept of all the sectors on the disk where a file can be stored, and what is stored there. When you delete a file, the only thing that happens is that the entry in the Master File Table is changed to say that that sector of the disk is now available for reuse. But the deleted files themselves remain on the hard disk until the computer writes another file in that same location, and can be easily recovered.

Even once that is done, the earlier file data is not completely gone. Again, without getting too technical, computers resemble that earlier form of reusable writing material - pencil and paper. If you write something with a pencil, erase it and write something new in that spot, there is still a slight trace of what was originally written. Someone can carefully inspect the paper to see what was erased. Similarly with a computer, it is sometimes possible to recover earlier files that have been written over.

There is software to address this problem, known as "shredder" programs. These programs will, when a file is deleted, repeatedly rewrite random data over that area to eliminate any traces of what was there previously. The Department of Defense, for example, requires the use of such programs and that an area be overwritten at least seven times.

Even if the deleted original file is unrecoverable, there are often other versions of that same file elsewhere on the disk. Windows is continually making additional copies of files, which the user never sees, but which can be recovered. John Patzakis, General Counsel for Guidance Software in Pasadena, CA, cites several examples of these extra copies:

Windows regularly makes additional temporary copies of the file a person is working on. These files are useful for recovering files after a computer crashes.

The swap file or paging file. This is a large section of the hard drive that the computer uses as additional memory space.

Printer files. Whenever you print a document, Windows first creates a copy of that file (called an "enhanced metafile," or EMF) on the hard disk and then sends that copy to the printer. Even if the user never saves the document, that printer version is still on the disk. In a criminal case, for example, a bank robber created his demand notes on a computer and then printed them out without saving the files. The EMF files, however, were recovered from his hard drive, and he was convicted of the robberies.

E-mail Files. A similar thing happens when an e-mail attachment is sent. Windows creates a MIME file (a format used for sending files over the Internet) and these files may remain after the original file is deleted.

Both Patzakis and Jessen agree that a shredder program, if used ethically, can be an effective part of a company's or law firm's records retention program. It should also be used before getting rid of any old computers or sending a reused floppy disk to a client, in order to prevent inadvertent disclosure of confidential information. If a shredder program is used, it must be used on a regular basis and must be set up to handle all of the extra and temporary copies of files that Windows creates.

One other point they agree on is that you should not have your clients use a shredder program called "The Evidence Eliminator." Although the software may do an excellent job, you just don't want to have your client on the witness stand trying to explain why he was using a program by that name.

In the next issue, we will look at techniques and software for obtaining and managing electronic documents in litigation.